The Security Layer for Self-Hosted Apps

Self-hosting has come a long way. Ghost for blogging, Plausible for analytics, Gitea for code, Vaultwarden for passwords, n8n for automation—the open-source ecosystem offers alternatives to almost every SaaS product. Container platforms like Coolify and Dokploy made deploying these apps accessible to everyone.

But the revolution came with a trade-off that the ecosystem quietly swept under the rug: shared resources. Every container on a host shares the same runtime. Namespaces and cgroups provide process-level isolation, but they're software boundaries that can be bypassed.

Kdral's Position

Kdral is to self-hosted apps what Cloudflare is to origin servers. Every app in our catalog—Ghost, Plausible, Gitea, Vaultwarden, n8n, and dozens more—runs inside a hardened isolated environment with runtime protection and ephemeral secrets. Same apps, complete isolation.

When we started building Kdral, we asked: what if every self-hosted app—not just container platforms, but every single app—got complete isolation, dedicated resources, and real-time threat detection? The answer changes everything about self-hosted security.

The Container Isolation Problem

Here's the fundamental issue with containers: every container on a host shares resources. If an attacker finds a vulnerability in the shared runtime, every container on the host is compromised.

This isn't hypothetical. Container escape vulnerabilities are discovered regularly. CVE-2024-21626 allowed container escape through a race condition. CVE-2019-5736 allowed malicious containers to overwrite the host runtime binary. These affected all major container runtimes including Docker and Kubernetes.

The Apartment Building Analogy

Containers are like tenants in an apartment building—you each have your own door and mailbox, but you share walls, plumbing, and electrical. A fire in one unit threatens the entire building. Complete isolation is like separate houses. Kdral builds separate houses, instantly.

Each App = Complete Isolation (The Core Insight)

This is the fundamental difference between Kdral and container-based platforms like Coolify or Dokploy: every single app runs in complete isolation with its own resources.

The Killer Feature: True Isolation

In Coolify/Dokploy: All your apps share one container runtime. A CVE in Ghost affects your Plausible. A vulnerability in n8n threatens your Vaultwarden. One breach = everything compromised.

In Kdral: Each app = complete isolation = true separation. Each app runs in its own protected environment. If Ghost has a CVE, Plausible remains isolated. The attacker is trapped in one environment, isolated from others.

Kdral provides lightweight isolated environments purpose-built for running workloads securely. Each environment gets:

Dedicated resources—each app runs on its own kernel
Complete memory isolation—boundaries software cannot bypass
Fast startup, minimal overhead—efficient by design
No shared attack surface—a compromised app is isolated from others

The technology achieves this by optimizing everything a workload needs while stripping away everything it doesn't. Just the minimal set of resources required to run securely.

Why Isolation Matters: Real-World CVEs

Remember Log4Shell?

In December 2021, Log4j (CVE-2021-44228) devastated the industry. Any Java application using Log4j was vulnerable to remote code execution. On container platforms, this meant:

Your vulnerable Java app could pivot to your Python apps
The attacker could access secrets from other containers
One CVE = entire infrastructure at risk

With Kdral: Your Log4j-vulnerable Java app is in complete isolation. Your Python apps, Node.js services, and password manager run separately. The attacker is contained within that environment.

This isn't just about Log4j. Every CVE in every dependency of every app you run becomes a potential entry point. The question is: what's the blast radius?

The Comparison

Scenario	Container Platforms (Coolify/Dokploy)	Kdral
CVE in one app	Risk to ALL apps (shared runtime)	Contained in that app only
Isolation type	Software (namespaces)	Complete
Resources	Shared across all apps	Dedicated per app
Startup time	Fast	Equally fast
Resource efficiency	Efficient	Equally efficient
Container escape CVE	Host compromised	Contained (hardware protected)
Security hardening	Host config (often default)	Production-grade per app

Kdral gives you the density of containers with the isolation of traditional VMs. You don't have to choose between security and efficiency anymore.

Four Pillars of Kdral Security

Kdral isn't just isolation. It's a complete security architecture with four reinforcing layers:

1. Hardened Isolated Environments

Each application runs in complete isolation with dedicated resources and network. Every environment is security-audited out of the box. No configuration required.

2. Runtime Protection

Think of it as an immune system for your infrastructure. It monitors activity and behavior in real-time—detecting and responding to anomalies to help prevent breaches.

Active Defense

Runtime protection monitors behavior and responds to threats to help prevent breaches. When suspicious activity is detected—unusual patterns, unexpected connections, privilege escalation attempts—the threat can be blocked in real-time, not just logged for later review.

3. Ephemeral Secrets

Database passwords, API keys, and certificates live in RAM only—they never touch disk. When an environment shuts down, secrets vanish. No .env files to leak. No volumes to exfiltrate. Just memory that evaporates.

4. Reproducible Infrastructure

Every environment is built identically, every time. No configuration drift, no undocumented changes. Rollbacks are instant.

Every App Gets the Same Protection

Same Security for Every App

Ghost, Plausible, Gitea, Coolify, n8n—every app in the catalog gets the same protection. No exceptions.

Whether you're running a blog, analytics platform, or automation tool—the same protection applies. Container platforms like Coolify are just one type of app you can install.

Deploy multiple apps with one click

From your Kdral dashboard, deploy Ghost, Plausible, Gitea, and dozens more from the app catalog. Each app runs in complete isolation with the same protection.

If your Ghost instance is compromised—say an unpatched dependency has a remote code execution vulnerability—the attacker gains access to that environment and nothing else. They can't pivot to your Gitea, can't access your Vaultwarden, can't read secrets from other workloads. The blast radius is one app.

When Containers Still Make Sense

We're not anti-container. Containers remain the right tool for many use cases:

CI/CD pipelines—Ephemeral build environments where isolation requirements are lower
Development environments—Docker Compose for local development is excellent
Ephemeral workloads—Short-lived batch jobs where multi-tenancy risk is low
Trusted single-tenant environments—If all the code is yours, shared resource risk is manageable

Right Tool, Right Job

The distinction is about threat model. When you're running persistent, internet-facing, multi-application production workloads—exactly what self-hosters do—the isolation requirements are fundamentally different from a CI job that runs for 30 seconds.

Kdral is complementary to containers, not a replacement. Use containers for what they're great at. When you need real isolation for production workloads, run those containers inside Kdral.

The Bottom Line

Containers traded isolation for speed and density. Traditional VMs traded speed and density for isolation. Kdral refuses the trade-off entirely: fast startup, efficient resource usage, and complete isolation.

Two Features That Change Everything

1. Each app = complete isolation. This is the killer feature. A CVE in Ghost doesn't touch Plausible. Log4j in your Java app doesn't reach your Python services. Each app runs in its own protected environment. The blast radius of any vulnerability is exactly one app.

2. Session-based authentication. Your infrastructure is protected by default. Dashboard-based security with automatic session timeouts. Strong access control for your self-hosted apps.

The shared resource era served us well. It's time for better.

Why Complete Isolation Beats Containers for Self-Hosted Apps