Self-Hosted PaaS Control Planes on Cloud VPS: Coolify vs. Dokku vs. CapRover Architecture & Security

1. Bridging the Gap Between Managed PaaS (Vercel/Render/Heroku) and Raw KVM VPS

Managed Platform-as-a-Service (PaaS) providers offer effortless git push deployments and automatic Pull Request preview environments, but charge steep markups on compute ($20/user seat fees, $0.15–$0.40/GB bandwidth, and $50–$150/month for modest 4 GB RAM containers).

On the other end of the spectrum, managing raw docker compose files, Nginx reverse-proxy configs, Let's Encrypt ACME cron jobs, and S3 database backup scripts by hand across multiple VPS nodes is error-prone. Open-source Self-Hosted PaaS Control Planes—specifically Coolify, Dokku, and CapRover—automate the entire build, TLS, reverse-proxy, and rollback lifecycle directly on your own $8–$30/month cloud VPS or bare-metal servers.

2. Architectural Comparison: Coolify v4 vs. Dokku vs. CapRover

| Architectural Dimension | Coolify (v4+) | Dokku | CapRover |
| :--- | :--- | :--- | :--- |
| Control Plane Architecture | Web UI + REST API managing remote nodes via agentless SSH (Docker Engine / Docker Compose) | CLI-first (git push dokku@server:app) on single host via bash/Go plugin hooks | Web UI + CLI built on top of Docker Swarm (docker service) |
| Multi-Server Orchestration | Yes (Native): 1 Control Plane VPS can manage 10+ separate worker/build servers over SSH | Single-server focused (multi-server requires external tooling) | Yes: Joins multiple worker nodes via native Docker Swarm overlay |
| Reverse Proxy & Auto-SSL | Traefik or Caddy (Let's Encrypt HTTP-01 & DNS-01 wildcard) | Nginx (default) or Caddy/Traefik via plugins | Nginx + Let's Encrypt Certbot |
| Supported Build Packs | Nixpacks, Dockerfile, Docker Compose, Static Sites | Cloud Native Buildpacks, Herokuish, Dockerfile | Dockerfile, Captain Definition, One-Click Apps |
| Control Plane RAM Overhead | ~600 – 900 MB (runs PHP/Laravel + Postgres + Redis + Soketi containers) | < 60 MB idle overhead (no heavy background web dashboard) | ~250 – 400 MB (Node.js dashboard + Nginx + Docker Swarm) |
| PR Preview Environments | Native GitHub App integration with automatic per-PR sub-domains | Supported via dokku-redirect / CI workflows | Requires custom CI webhook scripts |

3. Crucial Production Architecture Rule: Separate the Build Server from Production Runtime

The single most common cause of production downtime when self-hosting a PaaS on a single 4 GB or 8 GB RAM VPS is running docker build / nixpacks (npm run build, cargo build, next build) on the exact same server that serves live production HTTP traffic and hosts PostgreSQL!

A single TypeScript/Next.js/Astro or Rust build easily spikes CPU usage to 100% across all cores and consumes 2.5 to 4 GB of RAM—starving your live web containers and risking a Linux OOM kill on your database.

Two Clean Solutions

1. Dedicated Build Server in Coolify: In Coolify v4, attach a separate low-cost VPS (or ephemeral CI runner) with the "Use as Build Server" role enabled. Coolify compiles the container image on the isolated build server, pushes the finished layer to your container registry (GHCR or local registry), and instructs the production server to simply run docker pull and perform a zero-downtime rolling container swap. 2. Build in GitHub Actions CI & Deploy Pre-Built Images: Use GitHub Actions free/standard runners to execute docker buildx build, push the immutable tagged image (ghcr.io/org/app:sha-8f9a2b1), and trigger a lightweight webhook on Coolify, Dokku (dokku git:from-image), or CapRover.

4. Hardening Docker Socket & Firewall Exposure (UFW / nftables Trap!)

By default, Docker manipulates iptables / nftables FORWARD chains directly (DOCKER-USER), which bypasses ufw rules whenever you publish a container port with -p 5432:5432!
- Never bind internal database or Redis ports to 0.0.0.0: Bind internal services strictly to the internal Docker bridge network or 127.0.0.1:5432:5432.
- Protect the PaaS Control Plane Dashboard (Port 8000 / 3000): Never expose the Coolify or CapRover administrative port directly on 0.0.0.0:8000. Bind the management UI to an HTTPS domain behind two-factor authentication (2FA) and restrict access via a WireGuard VPN or Zero-Trust IP allowlist.

5. Zero-Downtime Rolling Deployments, Log Rotation & Database Backups on Self-Hosted PaaS

The most common cause of unexpected downtime on self-hosted Docker PaaS servers (Coolify, Dokku, CapRover) is unbounded container JSON log growth filling the root NVMe partition (/var/lib/docker/containers).

Mandatory /etc/docker/daemon.json Log Rotation & Live-Restore Configuration

Before installing Coolify, Dokku, or CapRover on your VPS, configure the Docker daemon to cap per-container log files and keep containers running during Docker daemon restarts (live-restore):

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "25m",
    "max-file": "3"
  },
  "live-restore": true,
  "default-address-pools": [
    {
      "base": "10.210.0.0/16",
      "size": 24
    }
  ]
}

6. Architectural Selection Matrix: Coolify v4 vs. Dokku vs. CapRover

| Engineering Team Profile | Recommended Self-Hosted PaaS | Architectural Justification |
| :--- | :--- | :--- |
| Full-Stack Product Teams managing Multi-Server Docker Compose, Databases & Preview PRs | Coolify v4 (With Dedicated Build Server) | Native Web UI, GitHub PR preview environments, multi-server SSH orchestration (zero agent lock-in), and built-in S3/R2 backup scheduling. |
| CLI-First Engineers Hosting 5–20 Stateless Apps on a Single 4GB–8GB VPS | Dokku | Ultra-lightweight (<100 MB idle overhead), rock-solid git push dokku main workflow, and simple Nginx + Let's Encrypt plugins. |
| Teams Already Standardized on Docker Swarm Service Definitions | CapRover | Built-in Docker Swarm overlay networking and one-click app templates. |

Compare the underlying KVM VPS providers for your PaaS stack in our Hetzner vs. Vultr vs. DigitalOcean vs. OVHcloud VPS Guide.