Ship without a DevOps hire
Push a repo. dFlow builds it, wires up the database, issues the certificate, and keeps it running.
Stack
Designed for the stack you already run
Railpack reads the repo. Dockerfile if you bring one. Static if it is a folder.
Next.js
runtime · Railpack
runtimes
data
Compute
Ship anything
dFlow reads the project and picks the builder. Override any of it when you need to.
Builders
GitHub and GitLab connect as full integrations, so Auto Deploy ships every push. Turn on Require Approval Before Deploy when a human should sign off first.
How it works
Pick where it runs, push your code, get a URL with a certificate already on it.
01
compute
Buy a worker node from dFlow, provision one in your own cloud account, or attach a machine you already run. dFlow installs the runtime for you.
node ready · setup automated
02
build
Git push, or prompt Cursor via MCP. dFlow detects the stack, builds it on your node, and returns a preview URL.
stack detected · preview URL ready
03
live
Zero-downtime releases, databases beside the app, custom domains with automatic SSL, logs and backups in the same place.
https live · zero downtime
Data layer
Databases run on the same worker node as the service that needs them, on a private network, wired in by reference.
Image version
Any service in the environment can reference this key instead of copying the credentials.
Keep backups on the node, or push them to object storage you own. ClickHouse backups are not available yet.
Deploy pipeline
Builds run on the worker node behind the environment. Every line is streamed back while it happens.
Triggered by
4f1c9ae
checkout: retry failed payment intents
priya pushed to main
You stay in control
Variables
Static values, references to other services, and generated secrets. Written as templates, resolved on the node at release time.
production
production
{{ orders-db.POSTGRES_URI }}
postgres://acme:••••••@orders-db:5432
{{ storefront-api.DFLOW_PUBLIC_DOMAIN }}
https://api.acme.com
{{ secret(64, "aA1!") }}
•••••••••••••••••••••
1000
1000
Encrypted at rest
Values are encrypted in the database and never live in your repo.
Redacted for agents
An MCP client reads the key. It does not read the resolved secret.
Generated once
A secret() value is kept across later edits while its template is unchanged.
Applied on release
Changing a variable prompts a redeploy or a restart to take effect.
Domains and SSL
Point DNS at your node. dFlow validates the record, issues the certificate, and keeps it renewed.
Add the domain
api.acme.com attached to storefront-api
DNS checked
CNAME resolves to node-fra-01
Let's Encrypt issued
Auto-regenerate enabled
Serving traffic
Nginx routing, zero-downtime swaps
Awaiting issuance
renews without a reminder
Free default domain
service.node.up.dflow.sh
Wildcard dev domains
nip.io · sslip.io
Proxy
Per-app Nginx config
Domains per service
Unlimited, one default
Scale
Presets cover most services. When one needs more, set CPU, memory, and replicas per process type.
CPU limit
Memory limit
Replicas
2 of 5 running
HTTP traffic
Background jobs
Timed work
Limits and reserves are set per process type, then applied on the next release.
Templates
A template describes services, builders, variables, and wiring. Deploy it into any environment, or compose your own and publish it.
9Router
1 service
Authorizer
3 services
Beszel Agent
1 service
Bytebot
4 services
Code-Server
1 service
Docuseal
2 services
Deploy flow
Compose your own template from services you already run, keep it private to the workspace, or publish it to the community.
Operating layer
dFlow sits on the worker node behind your environment. Drive it from the dashboard, git, or MCP in the editor you already use.
+ dFlow compute · VPS · on-prem
control plane
on the node bound to the environment
+ any Docker image · templates
From the editor
Ask Cursor, Claude, or Copilot to deploy. The agent calls the same tools you would click in the dashboard — on the node bound to that environment.
import type { Metadata } from 'next'import { Geist, Geist_Mono } from 'next/font/google'import { ThemeProvider } from '@/providers/theme'import { QueryProvider } from '@/providers/query'import { Toaster } from '@/components/ui/sonner'import './globals.css'const geist = Geist({ subsets: ['latin'] })const mono = Geist_Mono({ subsets: ['latin'] })export const metadata: Metadata = { title: 'dFlow', description: 'Ship from your IDE.',}export default function RootLayout({ children }) { return ( <html lang='en'> <body> <ThemeProvider>{children}</ThemeProvider> </body> </html> )}deploy my ecommerce site on AWS EC2 using dflow MCPdflow MCP
AI workflow
dFlow ships an MCP server behind OAuth. Cursor, Claude, or any MCP client gets the same scoped tools your team has — nothing more.
Applications
6 tools
Environments
5 tools
Services
24 tools
Deployments
6 tools
Git providers
6 tools
Templates
5 tools
Docker registries
3 tools
Worker nodes
2 tools
Guardrails
Teams and vendors
Custom roles start read-only. Grant create, update, and delete exactly where a contractor needs it, and take it back when the engagement ends.
| Resource | Create | Read | Update | Delete |
|---|---|---|---|---|
| Applications | ||||
| Services | ||||
| Deployments | ||||
| Worker nodes | ||||
| Backups | ||||
| Roles |
Example: an agency role scoped to one application.
Enterprise SSO
OIDC and SAML — Entra, Okta, Auth0, Google Workspace, Keycloak.
Invitations
Invite by email with pending, accepted, revoked, and expired states.
Gated deploys
Require approval before a vendor push reaches production.
Encrypted variables
Values are encrypted at rest and redacted from agent reads.
The whole surface
No add-on tier for the basics. This is what a workspace can do on day one.
57
included
ready