Security risks and resource overhead in Coolify self-hosting

Fifty-two thousand eight hundred and ninety Coolify hosts were exposed in January 2026. Security researchers identified 11 critical flaws in the platform. These vulnerabilities, such as CVE-2025-66209 and CVE-2025-66210, carry CVSS scores of 10.0. Other flaws, such as CVE-2025-64420 and CVE-2025-64424, allow low-privileged users to view root private keys or execute system commands via Git source input fields. These flaws allow authenticated users to achieve remote code execution as root on managed servers. I find the security risk of unpatched self-hosted instances to be a major hurdle for teams that migrate from Railway. Coolify has a distinct resource footprint. It uses 5-6% idle CPU. It also consumes 500 to 700MB of RAM. Dokploy only uses 0.8% idle CPU and 350MB of RAM. This difference is a problem for teams on small servers. I observed that the high resource requirements of Coolify, specifically the 500 to 700MB of RAM usage at idle, can make it difficult to host multiple small applications on a single 2GB RAM VPS without hitting memory limits.

The cost of observability and management

The transition from managed services like Railway to self-hosting introduces new financial and operational burdens. While the software license is free under Apache 2.0, users pay for the underlying VPS and maintenance. Coolify lacks built-in web analytics, error tracking, session replay, and uptime monitoring. Adding tools like Sentry, Plausible, Better Uptime, and FullStory adds roughly $254 per month to the budget. You must manage your own SSH keys and UFW firewall rules to keep your VPS secure. I find the lack of integrated observability tools to be a significant drawback for teams that require production-grade monitoring. Dokploy supports more Git providers and build options, including Railpacks and Heroku buildpacks. Dokploy provides an open core, but teams needing enterprise-grade solutions can use pricing plans that scale with their needs.

Users must also configure manual database backups to S3-compatible storage. Coolify provides a wide range of database services, but it does not support volume backups for all of them. This forces teams to use third-party tools for complete data protection. A typical two-server setup for Coolify requires a budget of $10 to $25 per month for the infrastructure. This compares to the $4.50 per month Hobby plan on Dokploy or the $5 per month Hobby plan on Railway. I conclude that for budget-conscious teams, the operational overhead of Coolify often negates the initial cost savings compared to Dokploy.

Scaling challenges and version shifts

Coolify has 59,300 GitHub stars and over 325,000 reported users, but the roadmap presents uncertainty. The v5 rewrite focuses on full scalability in the core, but the v5 milestone on GitHub shows no target date and no announced migration path from v4. What happens to existing v4 configurations when the v5 migration path finally clarifies? Coolify requires manual load balancer setup with Nginx or Traefik. This differs from Dokploy, which uses Docker Swarm to manage traffic across a cluster automatically. Coolify Cloud provides a managed control plane for $5 per month for two servers, but it does not manage the application workloads or the underlying servers. I find that the maintenance of a self-hosted control plane adds significant labor that managed platforms like Railway avoid. The platform has a Discord community with 20,375 members, but managing the infrastructure remains a solo task for many. The latest stable version is v4.1.2, which was released in June 2026.