Coolify, Dokploy, or a raw VPS: where the self-hosted PaaS tools stop

You want to self-host an app — your own SaaS, a side project, a client's site — on a machine you actually control. Ask anywhere how, and the answer comes back fast: just use Coolify. Or Dokploy. And honestly? That's good advice. These tools are excellent, and for the job they do, hard to beat.

But there's a quiet assumption tucked inside that advice, and it's the thing that trips people up about three weeks in. Coolify and Dokploy don't give you a server. They run on top of one — a server that someone still has to secure, update, and keep alive. That someone is you.

This is an honest map of where the self-hosted PaaS tools end and the sysadmin part begins, so you can pick your setup with your eyes open.

What Coolify and Dokploy actually do (and do well)

Think of them as Heroku you host yourself. You point one at a Linux server, and it turns that server into a deployment platform:

• Push to deploy. Connect a Git repo (or a Dockerfile, or a buildpack) and your app builds and ships on every push.
• Reverse proxy and HTTPS, automatically. They stand up a proxy (Traefik or Caddy) and fetch free SSL certificates for your apps, so yourapp.com just works over HTTPS.
• Databases and services in one click. Postgres, Redis, MySQL, and dozens of ready-made apps, wired up for you.
• A real dashboard. Logs, environment variables, rollbacks, preview environments, even managing several servers from one screen.

If your pain is "I have an app and I want it online without paying platform rent forever," a self-hosted PaaS solves it beautifully. Genuinely — for the app-deployment layer, use one. This post is not "don't."

The layer they sit on top of

Here's the part the "just use Coolify" advice skips. All of that convenience runs on a server you provisioned and are responsible for. The PaaS handles your apps. The machine underneath them is still a Linux box, and it comes with its own job list:

• SSH access, done safely — keys instead of passwords, root login disabled, brute-force attempts blocked. The install script needs you to be able to log in; it doesn't harden how you log in.
• A firewall — closing every port you're not using. And a specific trap: **Docker punches its own holes straight through ufw*, so ports you thought were closed often aren't. A PaaS opens the ports it* needs; your server's overall exposure is still yours to manage.
• OS security updates — the kernel and system packages under Docker don't update themselves.
• The box itself, when something breaks below the app — the disk fills, the server runs out of memory, or the whole thing is unreachable and even the Coolify dashboard won't load. Now you're SSH-ing in and debugging at the operating-system level, which is exactly the world the dashboard was supposed to save you from.
• Backing up the server, not just its databases — a PaaS backs up the databases it manages. Snapshotting the whole machine and actually restoring it somewhere else is a bigger loop, and still on you.

None of this is exotic, and none of it is impossible. But it's a real skill set — the sysadmin skill set — and it's the part that has nothing to do with your app and everything to do with keeping the server it lives on safe and awake.

"Raw VPS" isn't really the other option

This is why "Coolify vs. a raw VPS" is a slightly false choice. A raw VPS is just an empty box — Coolify is one of the things you install on a box. They're not two ends of the same spectrum.

The real question hiding underneath is: who runs the server that your PaaS sits on? There are only a few honest answers — you learn the ops yourself, you stay on managed hosting and give up control, or something handles the server layer for you so you can enjoy the PaaS layer in peace.

Here's the split laid out plainly:

So which should you choose?

• Comfortable at the terminal and happy owning the server? Coolify or Dokploy on a VPS you manage is a fantastic combo. Set it up, harden the box, and enjoy the git-push life.
• *The app part was never the scary bit — the server underneath is?* Then a PaaS doesn't actually solve your problem. It assumes you've already crossed the wall it's standing on. That wall — SSH, firewalls, HTTPS at the edge, "why is it down" — is the real gap.

The layer underneath

That underneath layer is exactly where Server Manager lives. It isn't a Coolify competitor — it's the floor Coolify stands on, made manageable without being a sysadmin.

You connect your server once, then describe what you want in plain English: secure it, close the ports I'm not using, turn on HTTPS, set up backups, tell me why the site's down. It proposes each action, explains what it'll do, and asks before anything risky — on your server, with your provider and your data, no lock-in. You could even use it to keep a box safe and then run Coolify on top; the two solve different halves of the same wish.

If you're earlier than that and just got a fresh box, start with what to do with a new server and setting up a firewall. When you're ready to go hands-on, the help guides walk through each step, and you can try it on your own server.

The short version

Coolify and Dokploy are the right tool for deploying your app — use one. Just remember they run on a server, and the server has a to-do list of its own. Decide who's handling that before you're three weeks in and something below the app breaks.