PodHull
GitHub
SoonVersion 1.0.0 is in preparation

Your own platform.
Nothing but Linux.

PodHull turns one RHEL server into a polished application platform. It deploys containers with Podman, describes them as Quadlet units and lets systemd run them. No Docker daemon, no Kubernetes, no extra database. Every application lives in its own sealed compartment.

Get started See how it works
An application in PodHull. The Traffic path diagram shows the internet reaching a public web service through the proxy, inside an isolated compartment with private api, db and worker services and two volumes.

Built entirely on the tools your distribution already ships

  • Podman
  • Quadlet
  • systemd
  • SELinux
  • nftables
  • journald
  • Go
50 MBMemory for the whole platform at rest
3Static binaries: panel, agent and proxy
0Third-party Go modules beyond golang.org/x
1:1One Linux user for every application

Platform

Everything a small team needs.
Nothing it has to babysit.

PodHull keeps to what the operating system does well and adds a careful interface on top of it.

See every path into your application

The Traffic path draws what is public, what is private and what each service may reach, live, from the units that actually run.

Explore the Traffic path →
Detail of the Traffic path diagram with services inside an isolated compartment.

Zero-downtime deploys

A new version starts beside the old one. Traffic moves only when its health check passes. Rolling back takes one click.

Automatic HTTPS

The built-in proxy issues and renews certificates through ACME and routes each domain to its service.

Keys, not passwords

People sign in with Ed25519 key files. Revoking a key ends its sessions at once.

Volumes and backups

Named volumes with scheduled local backups, retention, download and restore.

Push to deploy

Build from your Git repository's Containerfile on every push, with signed webhooks from GitHub, GitLab, Gitea and Forgejo.

Isolated by default, not by configuration

Every application gets its own Linux user, its own subordinate ID range and its own network. Private services can be cut off from the internet entirely.

Read the security model →

Architecture

Three small programs.
Each with the least privilege it needs.

Proxy

Terminates TLS on ports 80 and 443, holds the certificates and forwards each domain to the right service.

Panel

The web interface and API. It runs unprivileged, checks every request and sends validated orders on.

Agent

The only privileged part, started on demand by a systemd socket. It checks each Quadlet unit against strict allow-lists before writing it.

Read the architecture →

Install

From a fresh server to a working panel in minutes.

One package, one command. PodHull checks the host, opens what it needs in firewalld, obtains its certificate and prints a one-time setup token.

  • RHEL, AlmaLinux, Rocky Linux or Oracle Linux 10.2+
  • SELinux stays enforcing
  • Signed releases with verifiable checksums
  • podhull uninstall removes everything again
Installation guide → 
dnf install ./podhull-1.0.0-1.el10.x86_64.rpm
Complete!
podhull install --domain panel.example.com --acme-email ops@example.com
==> users and directories
==> configuration
==> firewall
==> services
==> panel
==> network table
==> certificate
••••••••••••••••••••••••••••••••
Expires at 2026-11-09T10:00:00Z. It is shown once and registers one key.
Open https://panel.example.com/setup and enter the token.
podhull doctor
ok   selinux Enforcing
ok   podman 5.8.2
ok   certificate valid until 2027-02-05

In the open

Built in public, every day.

The latest changes across the PodHull repositories, straight from GitHub.

Full changelog →

Own your platform.

Free software under the AGPL. No accounts, no telemetry, no lock-in.

Get started →Star on GitHub