Best tools for Self-Hosted Deployment

Self-hosted code understanding for humans and agents

Sourcebot is a self-hosted code intelligence platform that helps developers and AI agents understand large codebases through intelligent search, navigation, and inline-cited answers. Deployed as a Docker container with MCP server support, it indexes thousands of repositories without source code leaving your infrastructure.

AI-powered Infrastructure as Code management platform

IaC orchestration platform with AI-powered policy suggestions, drift detection, and automated remediation. Supports Terraform, OpenTofu, Pulumi, CloudFormation, Ansible, and Kubernetes. Centralizes infrastructure management with approval workflows, cost estimation, and compliance guardrails for teams running multi-cloud environments at scale.

Open-source headless CMS for developers

Strapi is the leading open-source headless CMS with 65K+ GitHub stars providing a customizable API-first content management system. Auto-generates REST and GraphQL APIs from content types defined through a visual builder. Features role-based access control, media library, internationalization, draft/publish workflow, and a plugin marketplace. Built with Node.js and supports PostgreSQL, MySQL, SQLite, and MariaDB. Self-hostable with Strapi Cloud also available.

Enterprise internal app platform with AI generation

Superblocks is an enterprise internal application platform that uses AI to automate backend integrations and UI generation for high-performance internal tools. It targets pro-developer teams who need more control than typical low-code platforms provide, offering code-level customization alongside visual building with enterprise features like SSO, audit logs, and fine-grained permissions.

Open-source Firecracker sandboxes for long-running AI agents

Superserve is an open-source sandbox infrastructure layer for AI agents that need durable computers instead of short-lived shells. It runs isolated Firecracker microVMs, supports pause, resume, snapshot, fork, preview URLs, MCP connectivity, SDK/API control, Docker workloads, and self-hosting, while the hosted service adds pay-as-you-go agent sandboxes for teams.

Multi-model database for the AI era — document, graph, vector, and relational in one

SurrealDB is a multi-model database that natively combines document, graph, relational, key-value, and vector storage in a single engine. It eliminates the need for separate databases by handling structured queries, graph traversals, full-text search, and vector similarity in one SQL-like query language called SurrealQL. Built in Rust for performance and safety, it supports real-time subscriptions, row-level permissions, and embedded or distributed deployment modes.

Zero-config VPN for developers

Mesh VPN built on WireGuard that creates secure networks between devices with zero configuration. Access dev servers, self-hosted services, and home labs remotely from anywhere. Handles NAT traversal automatically with MagicDNS for easy device naming, making it the simplest way to securely connect distributed development environments and infrastructure.

Self-hosted AI accounting for freelancers and small teams

TaxHacker is an open-source, self-hosted AI accounting app that automatically extracts financial data from receipts, invoices, and bank statements using LLMs. It supports 170+ currencies and 14 cryptocurrencies with historical exchange rate conversion, multi-project accounting, and custom AI extraction fields. Works with OpenAI, Gemini, Mistral, or local models via Ollama—deploy with Docker and keep all financial data under your control.

Enterprise feature platform for real-time ML

Tecton is an enterprise feature platform for building and serving ML features at scale. Created by the team behind Feast, it provides managed feature engineering, real-time feature computation from streaming data, feature monitoring, and a unified feature store with offline/online consistency. Used by production ML teams to eliminate training-serving skew and accelerate model deployment cycles.

Self-hosted SSH and server management platform

Termix is a self-hosted SSH and server management platform that provides a modern web-based terminal, connection management, SFTP file transfer, and multi-device sync without subscription fees. It serves as an open-source alternative to Termius, offering team collaboration features, connection sharing, and a clean interface for managing SSH connections across servers, all deployable via Docker.

IaC orchestration layer for scaling Terraform and OpenTofu

Terragrunt is an infrastructure-as-code orchestration tool that wraps Terraform and OpenTofu to keep configurations DRY, manage remote state, and coordinate multi-module deployments. The 1.0 release introduced stacks, filters, run reports, and backward compatibility guarantees after 900+ releases and tens of millions of infrastructure deployments. It provides a thin orchestration layer that eliminates duplication across environments without replacing the underlying IaC tools.

Open-source GitOps automation for Terraform and OpenTofu pull requests

Terrateam is open-source GitOps infrastructure orchestration for Terraform and OpenTofu pull requests. It automates plans and applies in GitHub workflows, supports monorepos and many workspaces, and adds apply-only locks, OPA/Rego policy checks, cost and drift signals, and approval controls without forcing teams into a separate IaC platform.

Hugging Face's open-source inference server for embeddings, rerankers, and classifiers

Text Embeddings Inference is Hugging Face's Apache-2.0 server for high-throughput embedding, reranking, and sequence-classification models. TEI packages token-based dynamic batching, optimized Transformers kernels, Safetensors loading, OpenAI-compatible embedding endpoints, Prometheus metrics, and configurable OpenTelemetry tracing in deployable CPU and GPU images.

Hugging Face's production LLM serving framework

Text Generation Inference (TGI) is Hugging Face's production-ready serving framework for large language models. It features flash attention, continuous batching, tensor parallelism, quantization via GPTQ/AWQ/EETQ, and Safetensors support. Powers Hugging Face's Inference API and Inference Endpoints, with an OpenAI-compatible API and Docker deployment. Supports LLaMA, Mistral, Falcon, and other popular model architectures.

Run and govern MCP servers across desktop, CLI and Kubernetes

Open-source MCP runtime and governance platform that runs servers in isolated containers, curates registries, enforces access policies, and operates gateways across desktop, CLI, and Kubernetes.

Open-source SOAR platform with AI-powered playbooks

Tracecat is a YC S24-backed open-source SOAR (Security Orchestration, Automation and Response) platform that lets security teams build AI-powered playbooks for automated incident response. It provides visual workflow builders for creating response procedures, integrates with common security tools, and handles alert triage, enrichment, and remediation — positioned as an open-source alternative to Tines and Splunk SOAR.

NVIDIA's optimized AI model serving platform

Triton Inference Server is NVIDIA's open-source inference serving platform that deploys AI models from TensorRT, PyTorch, ONNX, TensorFlow, OpenVINO, Python, and more across cloud, data center, and edge environments. It supports dynamic batching, model ensembles, concurrent model execution on GPUs and CPUs, and real-time, streaming, and batch inference patterns. Includes Model Analyzer for profiling and Model Navigator for automated optimization.

Comprehensive open-source vulnerability scanner

Trivy is an open-source vulnerability scanner with 24K+ GitHub stars by Aqua Security that scans container images, file systems, Git repositories, Kubernetes clusters, and IaC configurations for security issues. Detects OS package and language-specific vulnerabilities, misconfigurations, secrets, and license violations in a single tool. Runs as a simple CLI with zero configuration needed. Supports SBOM generation, VEX for vulnerability filtering, and CI/CD integration.

Low-code AI platform for internal tools with RBAC

UI Bakery AI is a low-code platform with AI assistance specifically for building production-ready internal tools, featuring enterprise-grade RBAC, SSO integration, and SOC 2 compliance. It combines visual app building with AI-powered code generation for complex business logic, targeting internal operations teams who need admin panels and dashboards with proper security controls.

Lightweight microVM execution layer for AI agent code sandboxing

Vercel Sandbox provides a lightweight microVM execution environment for running untrusted code generated by AI agents safely. It creates isolated sandboxes that prevent generated code from accessing the host system, network, or other processes. Designed for AI coding platforms that need to execute user or agent-generated code without security risks to the host infrastructure.

One vector-search extension across PostgreSQL, DuckDB and SQLite

MIT-licensed vector-search extension for PostgreSQL, DuckDB and SQLite that shares one graph-index core with PQ/RaBitQ quantization, persistent indexes and metadata filtering; SQLite packages cover Linux, macOS, iOS, Android and WASM, so it runs inside existing databases instead of as a separate vector service.

High-performance WebAssembly runtime for cloud and AI

WasmEdge is a CNCF sandbox WebAssembly runtime optimized for cloud-native, edge, and AI workloads. It provides a lightweight, secure, and portable execution environment that is faster than containers and safer than native processes. WasmEdge supports LLM inference via LlamaEdge, serverless functions, microservices, and plugin extensions for networking, AI, and cryptography across Linux, macOS, and Windows.

Batteries-included full-stack framework for React, Node.js, and Prisma

Wasp is an open-source full-stack web framework that brings the Rails-like batteries-included experience to the JavaScript ecosystem. It uses a declarative configuration file to define auth, database models, server operations, and routing, then compiles to a standard React and Node.js application with Prisma for data access. With 18,000+ GitHub stars and YC backing, Wasp eliminates boilerplate while giving AI coding agents clear structure and guardrails.

Lightweight self-hosted CI/CD engine for the Gitea stack

Woodpecker CI is a community-maintained open-source CI/CD engine forked from Drone CI, designed as the default continuous integration solution for self-hosted Git platforms like Gitea, Forgejo, and Codeberg. With simple YAML pipeline configuration, minimal resource usage (~100MB RAM), and Apache-2.0 licensing, it provides a lightweight alternative to Jenkins and GitHub Actions for developers who prefer infrastructure they control.

Desktop hub for managing all your server connections

XPipe is an open-source desktop application that centralizes access to your entire server infrastructure through a unified interface. It connects to remote systems via SSH, Docker containers, Kubernetes clusters, LXC, and virtual machines — eliminating context switching between multiple terminal sessions and infrastructure tools without requiring any remote-side setup or installation.

Open-source identity management with built-in multi-tenancy

ZITADEL is an open-source identity and access management platform that handles authentication, authorization, and user management for B2B and B2C applications. It supports OIDC, SAML, OAuth 2.0, Passkeys, MFA, and passwordless login out of the box. Built with multi-tenancy as a core feature, ZITADEL lets you manage multiple organizations with delegated admin access, custom branding, and isolated identity stores—all from a single deployment.

Lightweight OS for running AI agents in-process

agentOS is a portable open-source operating system for AI agents that delivers ~6ms cold starts at 32x lower cost than traditional sandboxes. Powered by WebAssembly and V8 isolates, it runs agents like Claude Code and Codex directly inside your process with granular permissions and host-managed tool access for S3, GitHub, and databases. Available as a simple npm package with no special infrastructure or vendor lock-in required.

Nix-powered reproducible development environments

devenv uses Nix to create reproducible, declarative development environments that work consistently across machines. Define project dependencies, services, environment variables, and pre/post hooks in a single devenv.nix file. Supports automatic shell activation, process management for databases and services, and integration with direnv for seamless directory-based environment switching.

One-command local coding agent that auto-detects your hardware and picks the best model

hf-agents is a Hugging Face CLI extension that detects your hardware, recommends the best GGUF model using llmfit, and launches a local coding agent in a single command. It collapses the multi-step local LLM setup into hf agents run pi, automatically handling hardware profiling, model download, inference server startup, and coding agent activation.

Zero-friction single-binary Kubernetes distribution by Mirantis

k0s is a lightweight, CNCF-certified Kubernetes distribution packaged as a single binary with zero host dependencies. Backed by Mirantis, it simplifies cluster deployment by bundling all required components into one executable that works on any Linux system. Supports x86-64, ARM64, and ARMv7 architectures with automatic upgrades and a built-in control plane load balancer.

Lightweight Kubernetes distribution for edge, IoT, and development

k3s is a CNCF Sandbox lightweight Kubernetes distribution packaged as a single binary under 100MB. Created by Rancher Labs and now maintained by SUSE, it strips non-essential components and bundles containerd, Flannel, CoreDNS, and Traefik into a minimal but fully conformant K8s distribution. Ideal for edge computing, IoT, ARM devices, and local development environments.

Git-like version control for data lakes and object storage

lakeFS is an open-source platform that brings Git-like branching, committing, and merging to data lakes and object storage. It works on top of S3, GCS, Azure Blob, and MinIO, enabling teams to create isolated data branches for experimentation, run CI/CD for data pipelines, and maintain full data lineage. Acquired DVC in 2025, uniting data version control for both small and enterprise-scale workloads.

Hot-swap between local LLM models via OpenAI-compatible API

llama-swap is an open-source tool that manages multiple local LLM models behind a single OpenAI-compatible API endpoint. It automatically loads and unloads models on demand, letting developers hot-swap between different models without restarting services. With 3.1K+ GitHub stars, it solves the common pain point of running multiple specialized models on limited hardware.

Kubernetes-native distributed LLM inference stack

llm-d is an open-source Kubernetes-native stack for distributed LLM inference with cache-aware routing and disaggregated serving. It separates prefill and decode stages across different GPU pools for optimal resource utilization, routes requests to nodes with warm KV caches, and integrates with vLLM as the serving engine. Apache-2.0 licensed with 2,900+ GitHub stars.

Find which AI models actually run on your hardware in one command

llmfit is a Rust-based terminal tool that matches over 200 LLM models from 30+ providers against your exact hardware specs. The interactive TUI scores each model on fit, speed, VRAM usage, and context length, helping you avoid downloading models that won't run on your machine. It supports Ollama, llama.cpp, MLX, Docker Model Runner, and LM Studio backends.

Lightweight virtual Kubernetes clusters

vCluster creates lightweight, isolated virtual Kubernetes clusters inside physical host clusters, enabling teams to run sandboxed environments for development, testing, and AI agent experimentation without provisioning separate infrastructure. Each virtual cluster has its own API server, control plane, and resource isolation while sharing the underlying compute, reducing infrastructure costs by up to 90% compared to full cluster provisioning.

Official Kubernetes and Helm reference stack built on the vLLM inference engine

Official vLLM reference implementation for scaling the existing inference engine on Kubernetes with Helm, request routing, KV-cache offload, autoscaling and Prometheus/Grafana observability.

OAuth 2.1 provider framework for Cloudflare Workers

workers-oauth-provider is Cloudflare's official OAuth provider library for Workers. It implements the provider side of the OAuth 2.1 protocol with PKCE support and RFC 8414 compliance. Handles token management automatically via Cloudflare KV storage. Gives fullstack teams a path to implement OAuth at the edge without heavy auth servers. TypeScript-native with npm package available.