Introduction

Hostrig is an opinionated self-hosted project runtime for one Docker host. Most apps need a database, cache, object storage, and a runtime. Hostrig runs that stack under your control — with gVisor for user apps — so you skip hosted Postgres/Redis/S3 tabs and hand-rolled backup cron.

Why not Coolify / Dokploy?

Those products win on breadth: Compose, templates, many databases, fleets. Hostrig wins on a narrow Railway-shaped loop:

Hostrig	Coolify / Dokploy
Typed services + explicit bindings	Resource catalogs and Compose
gVisor by default for user apps	Usually plain Docker / runc
Postgres + Redis + MinIO only	MySQL, Mongo, and more
Platform wildcard URLs in v1	Custom domains / many ingress modes
Dashboard-first (optional MCP)	Broader ops surface

If you need the kitchen sink, use them. If you want sandboxed app + Postgres + Redis + S3 with git push on a box you already run, use us. Full list: Scope.

The loop

create empty project
  → add web / worker / postgres / redis services
  → bind apps to data (DATABASE_URL / REDIS_URL)
  → deploy (image | Dockerfile | Railpack) under gVisor
  → URL on *.{baseDomain} via Caddy + cloudflared
  → scheduled Postgres backups → platform MinIO

Start here

PrerequisitesDocker, gVisor, BuildKit, Railpack

Quick startinstall.sh, then open the dashboard

Domains & URLsBase domain + optional Cloudflare Tunnel

Deploy an appBind, build, and run under gVisor

What you get

Service-first stack

Dedicated Postgres and Redis containers per service, shared MinIO with per-project buckets — add what you need, bind explicitly.

Build paths

Prebuilt image, Dockerfile, or Railpack from source. Compose deploys are not supported.

Secure by default

User apps run under gVisor with hardened container defaults. Secrets encrypted at rest. Docker socket never mounted into project containers.

Backups

On-demand and scheduled pg_dump to the platform backup bucket — no separate backup product to wire up.

Honest limits (v1)

• No custom domains — every web service is under *.{baseDomain} (custom domains are v2)
• TLS at Cloudflare — Caddy on the host is HTTP-only; we do not claim Let’s Encrypt on Caddy
• No typed CLI / public REST API — dashboard-first; MCP tokens are optional for agents
• Not a Coolify clone — see Scope