Deploy
Containers and Compose
Run a registry image, your Dockerfile or a Docker Compose file as a site, rootless.
Container sites run with rootless Podman as the site's own Linux user: a container can never act as root on the server. The web server in front handles the domain and HTTPS.
Add a container site
Add site with Runs on: Container (Docker):
| Field | Meaning |
|---|---|
| Image (optional) | A registry image such as ghcr.io/acme/app:1.0. Leave it empty to build from your repository's Dockerfile on every deploy. |
| Container port | The port your app listens on inside the container. It is published on the server's 127.0.0.1 only. |
| Compose file (optional) | Run a Docker Compose file from your repository instead of a single image. |
| Published service | The Compose service your domain points to; it listens on the container port. |
Image, Dockerfile or Compose
- Image: every deploy pulls the image and restarts the container. Use tags you control (
1.4.2rather thanlatest) to know what runs. - Dockerfile: set up a Git deploy; every deploy builds the image from the
Dockerfile(orContainerfile) at the root of the repository, then starts it. Build commands run before the image build. - Compose: the Compose file is started with podman-compose. Its
portsare removed and only the published service is reachable, on127.0.0.1; other services stay on their private network. Data folders mounted from the repository are moved to the site's shared directory so they survive releases.
Settings that would escape the sandbox are refused: privileged containers, host networking, the host's PID or IPC namespace, devices and added capabilities.
Health and rollback
After a deploy, the site must answer within a few minutes (the first start of a stack may take up to 15 minutes while images download and apps initialize). If it does not, the previous release comes back and the deploy log ends with the containers' last log lines.
Environment, data and logs
- The site's .env is passed to the containers.
- Container sites reach the server's MariaDB or PostgreSQL through the host address; connect a database to get the right
DATABASE_URL. - Named volumes keep data between deploys.
- The Logs pane shows the app's output under App process.
Ready-made containers and stacks are in Container apps and App stacks.
Updated October 18, 2026