Point DevOps Buddy at a Git repo or paste a docker-compose. It provisions the VM, wires DNS and HTTPS, and keeps your apps running — on infrastructure you own, at cloud-provider prices.
Start deploying — free Read the docs$ git push origin main buddy › cloning github.com/acme/store… buddy › nixpacks detected php · composer install ✔ buddy › building image buddy-app-store ✔ buddy › DNS store.acme.com → 34.9.112.4 ✔ buddy › TLS via Let's Encrypt ✔ ✔ live at https://store.acme.com (58s)
Connect an API token and Buddy provisions VMs for you — or install the agent on any Linux server you already run.
Google Cloud
DigitalOcean
Hetzner
Vultr
Any VM (BYO)
AWS — soon
Azure — soon
GitHub deploys
Cloudflare DNS
Let's Encrypt TLS
Traefik ingress
From zero to a production URL in minutes — no Dockerfiles, no nginx configs, no SSH.
Add a provider API token and pick a region and size — Buddy creates the VM, installs Docker, Traefik and the agent. Or run one command on a server you already have.
Paste a Git URL (PHP, Node, Python, Go… built with Nixpacks, composer/npm included) or a docker-compose file for anything else.
Pick a domain and subdomain. Buddy sets the DNS record, gets a TLS certificate and routes traffic. Deploy, restart, logs and metrics from the dashboard.
The features of a managed platform, without handing your infrastructure to someone else.
If it runs in Docker, it runs here. Multi-service compose apps, databases, workers — attached to one shared ingress network per VM.
Buddy clones and builds on your VM with Nixpacks — composer install, npm build, pip install handled automatically. No Dockerfile needed.
Traefik + Let's Encrypt on every VM, Cloudflare DNS records managed for you. Your app is live at its domain in minutes.
App data is archived to a bucket in your own cloud project over pre-signed URLs — credentials never touch the VM. Restore any snapshot with one click.
CPU, memory and disk per server, plus per-app container metrics straight from the agent — refreshed every 20 seconds.
Clone any app to a staging copy — same code, own subdomain — with one click. Test before you touch production.
TOTP 2FA with any authenticator app. Cloud credentials are encrypted at rest; agents authenticate with per-server tokens you can revoke.
The agent polls out over HTTPS — no SSH keys to share, no management ports open on your servers.
You pay your cloud provider directly for the VMs. Buddy never resells compute or locks your workloads in.
Start free. Upgrade when you need more servers — never pay a markup on infrastructure.
Docker, Traefik (the reverse proxy that terminates HTTPS), a single ~5 MB Go agent, and your apps as containers. The agent polls the control plane over HTTPS — nothing on your VM listens for inbound management traffic.
Only through the API token or service-account key you add, encrypted at rest, and only for the operations you trigger (creating VMs, DNS records, backup buckets). You can revoke the token at your provider at any time.
Anything Nixpacks supports: PHP (composer), Node.js, Python, Go, Ruby, Rust, Java, .NET and more. If your project needs something custom, paste a docker-compose instead — that path supports literally anything that runs in Docker.
Your apps keep running. They live on your VMs behind Traefik; the control plane is only needed to make changes. That's the point of bring-your-own-cloud.
In an object-storage bucket inside your own cloud project (GCS today, S3-compatible targets on the roadmap). Transfers use short-lived pre-signed URLs, so storage credentials never reach the VM.
Yes, trivially. Your apps are standard docker-compose projects sitting in /var/lib/buddy/apps/ on your VM. Stop using Buddy and they keep working exactly as they are.