oneDeploy
The platform oneAI runs on. On EU cloud or your own servers.
oneDeploy runs your containers and everything around them: rolling deploys, a preview for every pull request, HTTPS and DNS, monitoring, on-call and backups. One install, patched every night.
- One container, the whole platform
- Database, DNS, gateways, mesh, monitoring and mail come up with one command.
- Sandboxed by default
- Every container runs in gVisor, with Kata VMs and whole-GPU passthrough where you need them.
- Runs oneAI today
- oneAI's production, its previews and this website are deployed with it.
What it does
Everything a production app needs. Without a cluster to operate.
Deploy, roll, roll back
New images roll out one container at a time behind health checks, and any earlier version, down to its image digest, is one click away.
A preview for every pull request
Each pull request gets its own address, started on the first visit and behind a passkey login by default.
HTTPS and DNS, end to end
Its own DNS servers with DNSSEC, certificates that live six days and renew themselves, CAA and HSTS preloading.
A firewall that follows dependencies
Services talk over an encrypted mesh, and each one reaches only what it declared it needs.
Seen, and woken up
Metrics, logs, traces and profiles, alerts that page the person on call by phone, and status pages for your customers.
Patched every night
Nodes install operating system and kernel updates at night: traffic drains, the node reboots, the next one follows.
In daily work
Your CI builds. oneDeploy runs it.
.forgejo/workflows/build.yml- name: Push image run: buildah push "$IMAGE:$SHA"- name: Deploy run: curl -fsS -X POST "$ONEDEPLOY_WEBHOOK_URL"Rolls out by digestA webhook, not a migration
Push the image from the CI you have and call one webhook; oneDeploy pulls it from any registry and rolls it out by digest.
Nightly patchingToday
Four nodes updated and rebooted, traffic drained before each.
Certificate renewedToday
portal.nordwerk.de, valid for the next six days.
Nothing to do in the morning
The night's patches and certificate renewals are in the log, each node drained before it rebooted.
status.nordwerk.de90 days- Customer portalOperational
- Public APIOperational
- Document exportDegraded
Incident posted 09:20 · RSSA status page your customers trust
Each service can publish its status on its own domain, with 90 days of uptime and the incidents you post.
From pull request to production
One place for the whole way. Preview, approve, roll out, watch and, if you must, go back.
- ImagePinned by digest
- DatabaseIts own
- AccessPasskey login
- StateRunning
The pull request gets its own address and, if the app needs one, its own database. It starts when someone opens it.
Native in oneAI
Under every oneAI request. And under the apps people build with it.
oneAIChat, apps, previews- Rolling deploy · by digest01
- /.well-known/status04
- pr-2184.preview03
Everything in oneDeploy
All in one, secure, reliable. And a few things beyond hosting.
All-in-one deployment
- Containers from any registry, deployed by digest
- Rolling deploys with health checks
- Replica autoscaling, and new nodes on Hetzner Cloud and Scaleway
- Live migration and rebalancing between nodes
- Preview environments per pull request
- Automatic HTTPS and self-hosted DNS
- Metrics, logs, traces, profiles and browser monitoring
- Alerts, incidents and on-call with phone escalation
- Email hosting with IMAP and filters
- 41 app templates, from PostgreSQL to n8n and Nextcloud
Secure
- Short-lived certificates, CAA and DNSSEC
- HSTS with preloading, Certificate Transparency watched
- Encrypted overlay network, firewall by dependency
- Post-quantum key exchange for TLS and SSH
- Sandboxed containers with gVisor or Kata VMs
- Passkey-only sign-in
- Sign-in wall in front of any app
- Server-managed passkeys and SSH keys
- Passwords encrypted at rest
- DMARC monitoring and CSP report ingestion
- Vulnerability scans with an SBOM per image
- Audit log with before and after for every change
Reliable
- Highly available control plane
- Several DNS servers
- Several gateways with automatic DNS failover
- Health checks for every application
- Highly available templates, such as PostgreSQL with Patroni and etcd
- Application backups as LVM snapshots, restic to S3
- Platform backups every night, a second copy on a managing cluster
- A whole cluster restorable onto a fresh server
And beyond
- Knowledge base with collaborative editing
- Password manager with a browser extension for autofill and passkeys
- CLI that works as an SSH agent
- SSH, RDP and VNC to servers outside the cluster
- Tunnels that expose an app without opening a port
- Load tests and cost allocation per project
- Agent access for Claude Code and Codex, every change approved
Where it runs
- Any Ubuntu 24.04 server reachable over SSH
- New clusters created on Hetzner Cloud, Hetzner dedicated or Scaleway
- One cluster across regions, gateways added where you need them
- Whole GPUs passed through to a service
- REST API with more than 500 operations, CLI and SSH into containers
Questions
What operations teams ask first.
Another question?Talk to us
The oneAI family
Three building blocks, one sovereign AI OS. Sovereignty is a matter of freedom of choice — we offer the choice.
oneAI, oneStack and oneDeploy run in the cloud, in your private cloud or on-premise. Each works on its own, and all of them work together natively.
Next step
See oneDeploy run your apps.
Thirty minutes with an engineer, your services and where you want them to run.
Talk to a partnerBook a demo
Thank you.
Your request is with us. A person from oneAI answers within one business day.
A person from oneAI answers within one business day. No ticket queue. By sending the form you agree that oneAI stores and processes your details to answer your request. Privacy policy