Kamal

What Kamal does

Kamal is a deployment tool rather than a hosted-style platform. It runs on your laptop or in CI, reads a config/deploy.yml file from your app repository, and uses SSH to build, push and start Docker containers on the servers listed there. 37signals built it to move its own applications, including HEY, from cloud services to its own hardware, and describes it as Capistrano for containers. It was first made for Rails, but any app that runs in a Docker container works.

On each server, kamal-proxy listens on ports 80 and 443 and switches requests from the old container to the new one once the new one is healthy, which gives zero-downtime deploys. Servers are grouped into roles, so the same image can run as web processes on some hosts and as background job workers on others. If a release goes wrong, kamal rollback starts a previous container again without downloading anything, as long as it has not been pruned (old containers are removed after three days by default).

How it differs from a PaaS

Kamal leaves no control plane behind. There is no dashboard, no database of apps and no daemon apart from Docker and kamal-proxy. That keeps the moving parts few and means you can see every step, since Kamal issues ordinary Docker commands. The project site contrasts this with Kubernetes and Docker Swarm, which reconcile a desired state; Kamal runs imperative commands, one deploy at a time.

The trade-off is that features a PaaS gives you for free must be arranged yourself. Kamal has no git push hook or pull-request previews, so deploys are usually started from CI. Databases and caches can be declared as “accessories”, but these are booted separately, are not updated when you deploy and do not get zero-downtime restarts, and backing them up is your job.

Self-hosting Kamal

Install Kamal as a Ruby gem, or run it from a Docker container with some limitations. kamal init creates the configuration and a secrets file, and kamal setup connects to each server, installs Docker if it is missing, logs in to the registry, builds the image from your Dockerfile and starts everything. Kamal connects as root by default; with a non-root user you prepare Docker on the servers yourself.

Images go through a container registry: Docker Hub by default, AWS ECR or another registry, or a local registry that Kamal starts for you. Builds can target amd64 and arm64 and can run on a remote builder, and Cloud Native Buildpacks are an option if you do not want to write a Dockerfile. Secrets can be fetched from password managers such as 1Password, LastPass and Bitwarden through their CLIs.

Hosted version

None. Kamal is a command-line tool and there is no hosted service.

Limitations

Automatic HTTPS through Let’s Encrypt only works when you deploy to a single server with a host name set; with several servers, certificates must be handled another way, for example on a load balancer. There is no web interface or team access control beyond SSH access to the servers. You need to be comfortable with Docker and Linux; the project itself says a fully managed service is a better fit otherwise.

Who it suits

Kamal suits teams that already package their app as a Docker image and want to run it on rented VMs or their own hardware without operating a platform. It fits well with a CI pipeline. If you want a dashboard, managed databases and preview environments, a platform such as Coolify or Dokploy is closer to Heroku; Uncloud is another option for spreading containers across several hosts.