A request, from the internet to your app.
Only the gateway is reachable from the internet. Every other machine may sit behind a router; it dials out to the private network and is reached through it.
The parts, by name.
All open source. Meshploy installs, configures and upgrades them.
WireGuard and Headscale
Every machine gets a private address on one encrypted network. Machines behind routers and firewalls reach each other directly, without opening ports.
K3s
A lightweight Kubernetes spans your machines, so apps are placed where there is room and started again when they stop.
Caddy and the edge proxy
The gateway answers your domains, gets and renews certificates, and sends each request over the private network to the machine running the app.
Railpack and Dockerfiles
Builds run inside your cluster. Railpack works out how to build most apps; a Dockerfile is used when there is one.
CoreDNS
Names for private apps that only machines on your network can resolve.
gVisor
The sealed box: a kernel of its own for each app of a sandboxed project, written in a memory-safe language.
The sealed box.
Containers normally share the machine's kernel, so code that breaks out of one reaches the machine. A sandboxed project's apps and jobs run on gVisor instead: a kernel of their own in user space. A container that breaks out lands in gVisor, not on the machine.
It costs some memory and some speed for apps that work the disk hard, so it is switched on per project or per level. Databases stay on the host's kernel.
Private, by default.
The network denies by default. Each person's machines reach only the apps and databases they can see in the console. A private route answers only them, checked at the edge for every request.
Projects can be closed off from each other on the network, opening only what one project shares with another.
Agents, with their own keys.
Meshploy serves its tools over MCP. An agent signs in with a token of its own or through OAuth, as a person who approved it, and can do only what that person or token may. Operator tools are never offered remotely.
Upgrades you can trust.
A small agent on the gateway applies upgrades when you ask for one, from the console or the CLI, and brings back services a reboot left down. The API can ask; it can never run one itself.
ReleasesThe words the console uses.
Full documentation- Gateway
- The one machine that faces the internet. It runs the console, answers your domains and holds the private network together.
- Machine (node)
- Any computer joined to your workspace. A Linux machine can run apps; a Mac or Windows machine can reach private ones.
- Project
- A group of apps, databases and jobs that belong together, with its own people and its own network.
- Level
- A stage of a project: production, staging, dev. Each holds its own copies, and borrows what it does not have from the level above.
- Route
- An address an app answers at: public on the internet, or private to people and machines you grant.
- Promotion
- Moving the exact build a lower level ran to the level above, without building it again.
See it run today.
Install it on a server of your own, or start on Cloud.