More room for a service
Pick a size profile, or set exact CPU and memory requests and limits for the workload that needs them.
A self-hosted PaaS
that runs Kubernetes for you.
Hakopod turns your Linux servers into your own cloud. It installs K3s, writes every Kubernetes object, and gives you a dashboard, CLI, Terraform provider and MCP server to deploy apps, databases, jobs and functions. It's open source under Apache-2.0, and you pay only for your servers.
Create your Cloud account Cloud beta. Signup is open; compute availability varies by workspace.
01 / KUBERNETES WITHOUT KUBERNETESONE COMMAND. NO YAML. NO KUBECTL.
INSTALL ONCE
How does Hakopod run
How does Hakopod run
Kubernetes for you?
One command sets up the cluster, and Hakopod generates every Kubernetes
object after that. Run the installer on Ubuntu 24.04 or 26.04, or Debian
12 or 13, on AMD64 or ARM64 with 4 GiB of RAM and 30 GiB free. It shows
you a plan, you type install, and it lays down pinned,
checksummed K3s, Helm and the platform's PostgreSQL. Nothing compiles on
the server, and Docker isn't required.
From then on Hakopod writes the workloads, Services, Ingress, quotas and deny-by-default NetworkPolicies. HAProxy handles ingress, with 20 of its settings editable in the dashboard. cert-manager fetches Let's Encrypt certificates, or you upload your own, and Hakopod verifies custom domains and can create their Cloudflare DNS records. Upgrades back up first, check compatibility and leave your apps running.
Install Hakopod on your server↗ CONCEPT ILLUSTRATION
02 / DEPLOYGIT. DOCKERFILE. BUILDPACKS. IMAGES. COMPOSE.
How do I deploy
an app to Hakopod?
Point Hakopod at a Git repository, a container image or a Compose file, review the plan, and deploy. Builds run in your own GitHub Actions or GitLab CI, never on the server that runs Hakopod.
HOW A DEPLOY WORKS
Deploy from Git, an image or Compose.
Connect GitHub through the GitHub App, or GitLab with OAuth or a token. Hakopod builds from your Dockerfile, Cloud Native Buildpacks or a detected framework: Next.js, Astro, SvelteKit, TanStack Start, Vite, Node or static HTML. Prefer images? Deploy any container image, or import an image-based Compose file into reviewed TOML. Git submodules check out recursively.
Build in your own CICONCEPT DIAGRAM / NOT A LIVE DASHBOARD
your-repositorymain / hakopod.toml
FrameworkDockerfileOCI image
Review deployment plan
03 / ALSO IN THE BOXEACH CARD LINKS TO THE DETAILS
01 / Rollback
Can I roll back a bad deploy?
Yes. Roll back to any earlier successful release in one step, on the Free plan. Failed rollouts recover, and the activity history for each revision shows what failed. Rollback restores the app, not the data, so database migrations stay applied.
How rollback works ↗ 02 / JobsCron jobs, workers and migrations
Run scheduled cron jobs, one-off migration jobs and long-running workers next to your web service, from the same configuration. Attach up to four sidecars to any service.
Configure jobs and workers ↗ 03 / PreviewsPreview environments from a built image
Start a preview environment from any image you've already built. It runs for 1 to 72 hours, then expires, with up to three previews per project.
Read the deployment guide ↗ 04 / ServerlessServerless functions that scale to zero
Run a JavaScript or Python HTTP function, or any HTTP container, and let it sleep at zero replicas until a request wakes it. Functions run zero or one replica and accept request bodies up to 4 MiB. Your operator turns on the activation gateway first.
How sleep and wake work ↗ 05 / VolumesPersistent volumes you can resize
Give a service a volume from 1 to 200 GiB and resize it as the data grows. Volumes, variables and secret references live in the same TOML file as the service.
Explore storage settings ↗ 06 / TemplatesSelf-hosted app templates
The template catalog lists 92 self-hosted apps, and 57 deploy straight from it: n8n, Umami, GlitchTip, Uptime Kuma, NocoDB, Vaultwarden, Ghost, Directus, Gitea, Meilisearch and more. The rest come with a prerequisite guide.
Browse the templates ↗ 07 / SecretsSecrets management, built in
Secrets are encrypted inside the cluster, masked in logs and can be generated for you. If they already live in HashiCorp Vault, OpenBao or Infisical, pull them from there. All of it is on the Free plan.
Read the security guide ↗ 08 / AdvisoriesSecurity advisories for running apps
Every hour, Hakopod checks each running app's image digest and runtime version (Node, Python, Go, PHP, Ruby, Java) against a signed Hakopod feed and OSV.dev. Affected apps get a banner, a Security page, a notification and a one-step update or rebuild. Auto-patching is optional and off by default.
See how advisories work ↗ 09 / ContainersHardened containers by default
Containers run as a non-root user (UID 10001) unless you say otherwise. Add a read-only root filesystem, or use a gVisor runtime class your operator grants.
Review container defaults ↗ 10 / AccessTeams, roles and two-factor login
Invite your team, give each person a fixed team or project role, and protect accounts with TOTP or passkeys, free. Pro adds OIDC single sign-on, Google, GitHub and GitLab login, and an actor audit history you can export as CSV.
Compare Free and Pro ↗ 11 / AI models (beta)Serve your own AI model (beta)
The vLLM template serves a Hugging Face model at a pinned revision behind an authenticated, OpenAI-compatible endpoint, on 1 to 8 NVIDIA GPUs once your operator installs the driver and device plugin. It's beta: not yet verified on real GPU hardware, and not on Cloud or serverless. Open WebUI, Flowise, Lobe Chat and Qdrant are templates too.
See the vLLM template ↗ 12 / Managed Actions (Pro, beta)Managed GitHub Actions runners
Run repository or organization workflows on your own AMD64 and ARM64 runner pools. Each job gets its own runner in a gVisor sandbox, with resource limits, searchable step logs, a Docker Hub mirror and an overlay2 workspace that took a PostgreSQL image pull from 95 s to 15 s. Not yet tested on real multi-node installs.
Explore Managed Actions ↗ WHEN YOUR APP GETS BUSIER
How do I scale
How do I scale
a service on Hakopod?
Scale each service on its own: give it more CPU and memory, run more replicas, or let CPU autoscaling add copies up to 20 as load climbs. Per-app quotas keep one app from taking the whole server.
Explore resource settings Managed databases / Eight engines
Which databases
Which databases
can Hakopod run?
Hakopod runs eight managed database engines on your own servers: PostgreSQL 17 and 18, Redis 8, MongoDB 8.0, MySQL 8.4, ClickHouse 26.3, Vitess, Oracle Database Free and DuckDB through MyDuck. PostgreSQL gets 1 to 6 replicas, PgBouncer and switchover; Redis runs standalone or as a sharded cluster; MongoDB runs 1, 3, 5 or 7-member replica sets; MySQL runs as an InnoDB Cluster with Router.
Every database stays private, with no public endpoint. Backups are encrypted, scheduled to any S3-compatible store and read back to verify. Run queries from the dashboard's SQL console, the CLI, the API or your agent, capped at 20 s, 1,000 rows and 1 MiB.
Explore managed databases Self-hosted operators enable each engine's controller as an installer module. MySQL, Vitess, Oracle Database Free and MyDuck run on AMD64. On Hakopod Cloud (beta), managed PostgreSQL and Redis are available in eligible workspaces. Backups / Recovery workflow
- 01Restore.A separate copy.
- 02Inspect.Your chance to check.
- 03Switch.Only when you decide.
Source data stays available. New writes need a fresh capture before cutover.
OPERATIONSLOGS. REQUESTS. ALARMS. SERVERS.
How do I monitor and debug
apps on Hakopod?
Every service gets live logs, stored log history, CPU and memory metrics, an HTTP requests view and a container terminal in the dashboard. Alarms and notifications tell you when something needs a look.
Logs that survive a restart.
Follow live logs, search them with SQL-like filters, and read back stored history across restarts and rollouts (7 days or 512 MiB by default). CPU and memory metrics sit beside them, secrets are masked, and a container terminal is one click away.
Explore logs and metricsFind the request that failed.
The Requests view keeps HAProxy access records for 24 hours, up to 100,000 of them. Find a failed request, inspect its timings and backend, then check the service's current route. Query strings, headers and bodies stay out of the log.
Explore RequestsHear about it when it breaks.
The alarms inbox collects readiness failures and node pressure, with optional email. Deploy results go to email, Discord or a signed webhook on Free, and to Slack on Pro. Choose the events each app cares about and check delivery history when a message goes missing.
Set up notificationsAdd servers. Choose where things run.
Join a worker server with an expiring K3s join token, then cordon or drain it from the dashboard. Leave placement automatic, or pin a service to a node with Run on node; plans check capacity and storage first.
Choose a node deliberatelyAll of this ships in the open-source self-hosted release; Slack notifications need Pro. Admins also get host terminals. Read the release notes on GitHub. Illustrations explain the concepts.
04 / SOURCE AND RELEASEKEEP THE EVIDENCE IN VIEW
Which commit is running
in that container?
Hakopod can trace a running service back to the commit that built it. Your GitHub Actions or GitLab CI pipeline reports the image digest, source commit and run URL to the release, so you, or your agent through the provenance tool, don't have to guess from a moving tag.
Connect CI to the releaseCI provenance records what your authenticated pipeline reports; it isn't a signed attestation for your own images. Hakopod's releases do ship with SBOMs and build-provenance attestations, and the installer verifies checksums before it runs anything.
How do I run Hakopod
from code or an AI agent?
Use the CLI, the REST API, Terraform or the MCP server; they all drive the same application model as the dashboard. The API has 329 operations, and an agent can reach about 282 of them with a key that allows it.
See the whole system.
Projects, apps, deployments, databases, logs, alarms and servers in one place. Every change shows up as a diff you review before you click Deploy.
Let your agent run your cloud.
Run hakopod mcp over stdio in Claude Code, Cursor or any MCP client, or point it at the Streamable HTTP endpoint on a self-hosted install. Agents read apps, runtime state, logs, provenance and plans by default; deploys, rollback, SQL, exec and terminals each need their own opt-in flag.
How agent access worksKeys that stay in their lane.
Each key is scoped to one project and environment, expires and can be revoked. An admin wildcard doesn't grant exec or SQL, SQL stays read-only unless you allow writes, and the audit log keeps a hash of every command. Login, MFA and OAuth consent stay human-only.
Read the agent controlsStay in your terminal.
Install it with a one-line script or npm, Windows included. Plan and deploy a whole folder of apps with --dir, follow logs, open a terminal, roll back, and create, resize, restore or query databases.
Deploy from the CLIDeclare it in code.
The hakopod/hakopod provider on the Terraform Registry manages projects, virtual networks, applications and secrets. The hakopod/deploy@v1 GitHub Action deploys from your workflow, and an OpenAPI contract describes the API.
Use the Terraform providerHand the fix to your coding agent.
When a deploy fails or a security advisory lands, Copy fix prompt gives your coding agent a brief with what broke and where, ready to paste.