Push your code — builds, config, and deployment are handled automatically. Use our cloud or connect your own servers. Zero lock-in, completely open-source.
Designed for your favorite stack
Next.js
Node
Python
Go
Rust
Docker
Postgres
Redis
Rails
Laravel
Django
BunNext.jsNodePythonGoRustDockerPostgresRedisRailsLaravelDjangoBun
The system
From a git push to a served request — this is the actual path your code takes, and every box on it is something Openship runs for you.
Diagram of the Openship deploy path. A git push, CLI command, desktop app or AI agent triggers a build. The build runs on your machine and produces an immutable version, then streams over SSH to your server — Openship Cloud, your own VPS, or a homelab. On the server, managed Postgres, Redis, mail and object storage join the app on a private network. The edge layer terminates your domains with automatic SSL and serves visitors, and any previous version can be restored in one click.
A git push, a CLI command, the desktop app, or an AI agent over MCP. Whatever your stack — Node, Python, Go, Rust, Docker, a monorepo — it is detected for you.
The image builds on your machine, not on your production server. Every build comes out as an immutable, versioned artifact.
It streams to the target over plain SSH and starts as a fresh container. No agent, no daemon, nothing installed on your box.
Postgres, Redis, mail and object storage join it on an isolated private network — reachable by your app, never by the internet.
Your domains resolve to the edge, which terminates free auto-renewing SSL and hands each incoming request to the new container — the swap happens with zero downtime.
The version you were running stays warm. One click puts it back — no rebuild, no waiting, no lost state.
How it works
No agent on your servers, no black box. Here’s the exact path your code takes — and why your production machines never build.
Link a Git repo and pick a target — zyrix Cloud or your own server over SSH. Nothing is installed on your box: no agent, no daemon, no dashboard.
On every push the image builds on your machine (or in the cloud), runs your tests, and is tagged as an immutable, versioned artifact. Your production servers stay focused on serving.
The built image streams to the target over SSH and starts as a fresh container on an isolated private network — no exposed ports, no hand-written Docker or Compose.
Your domains are wired through OpenResty with automatic Let's Encrypt SSL, then traffic swaps to the new container with zero downtime. The previous version stays ready for rollback.
Stream logs, watch metrics, and roll back to any previous version in one click — from the CLI, the web dashboard, the desktop app, or an AI agent over MCP.
Where it runs
Same platform, three deployment shapes - and you can switch any day.
Sign up, point at a repository, ship. Zero infrastructure decisions. Multi-region by default. Auto-scaling per service.
Run the entire platform on machines you own. Any Linux box, any provider, any region. Add nodes as you grow.
Cloud for the burst, your servers for sensitive data. One control plane. Move workloads without rebuilding.
Your apps are plain containers and your services are standard images. Move workloads between zyrix Cloud and your own servers without rebuilding, rewriting, or paying an exit tax. Click, confirm, done.
The full platform
No add-on stores, no plugin marketplaces, no “requires an integration with”…
Every commit builds and ships. Branch environments included.
Every pull request gets its own URL. Auto-torn down on merge.
Builds run on your machine. Production servers stay focused.
Framework, language, package manager, commands - figured out.
Common failures (missing imports, version drift) diagnosed and patched.
Every deploy is immutable. Revert to any version in one click.
Horizontal scaling per service. Up on traffic, down when idle.
Health checks, weighted routing, sticky sessions - built in.
CPU, memory, network, disk - real-time charts and alerts.
Live tail across services and replicas. Search, filter, persist.
Cron-like jobs with retries, visibility, per-run logs.
Rolling restarts, blue-green, draining connections - automatic.
Unlimited apex and subdomains. Wildcards supported.
Let's Encrypt by default. Auto-renewing wildcard certificates.
Visual records and propagation. Verify domains in seconds.
Global edge, anycast IPs, low-latency routing.
Services talk over an isolated network, no exposed ports.
First-class support, persistent connections, sticky routing.
Versions 14–17. Daily backups, PITR, scheduled upgrades.
Cache or persistent. Cluster mode. Pub/sub and streams.
Replica sets, sharding, automated upgrades, migration tools.
S3-compatible buckets. Signed URLs, lifecycle rules, replication.
Transactional from your domain. Authentication chain auto-configured.
Static asset acceleration. Cache invalidation on deploy.
A single binary covering deploy, logs, secrets, domains, rollbacks.
Visual deploys, metrics, billing, team access.
Native Mac and Windows. Push from local, stream logs natively.
Drive deploys from AI agents — Claude, Cursor, any MCP client. Standard tools, authenticated.
Encrypted at rest. Environment-scoped. Rotated without redeploying.
Every action, exportable, retained for compliance.
Default-deny inbound. Per-service policies.
Per-route limits, IP or token based. Burst and sustained.
HSTS, CSP, COOP, COEP - production defaults.
Edge-level mitigation, automatic challenge.
TLS everywhere, encrypted backups, encrypted secrets.
Logs and config suitable for SOC 2, ISO 27001.
Multiple organizations per account — isolated projects, servers, and members. Switch in a click.
Owner, admin, member, and a restricted role. Assigned per teammate.
Grant access down to individual projects and resources - not just broad roles.
The restricted role starts with zero access. Every permission is explicit - least privilege.
Invite teammates by email. Expiring links, accept flow, per-inviter rate limits.
Every join, role change, and removal recorded and exportable.
Built-in mail server
A real mail server on your own box - not a send-only API. Outbound relays through a trusted provider (Amazon SES or any SMTP) so mail lands with a warmed, high-reputation IP, while every mailbox, message, and byte stays on your server. One click sets up the domains, certificates, and SPF/DKIM/DMARC chain.
Straight comparison
Git deploys, TLS, databases, backups, cron — every tool here has those, so they are not on this list. What is below is where the choice actually changes what you can do, and what it costs you to change your mind.
Where it runs, and what stays on
Included, not bolted on
Fits the setup you already have
If you change your mind
Compared against the shipping versions of each tool, July 2026. A dash means that tool genuinely matches Openship, or that the row does not apply to it. We would rather score a row even than invent a cross.
Open source
The dashboard, the CLI, the agents, the infrastructure adapters - all public, all readable, all auditable. Run it on a Raspberry Pi or a fleet. Contribute back when you want to.
Cloud or a server you own. No lock-in, no configuration files.
