Dokploy Moved Its Enterprise Features Behind a New License — Here's Exactly What Changed

On January 21, 2026, the fastest-growing self-hosted PaaS on GitHub split its license in two. Dokploy's core stayed Apache 2.0 — you can still clone it, self-host it, and run your apps on it for free. But a new Dokploy Source Available License now governs the proprietary/ directories in the repo, and everything enterprise-shaped the project ships from here — SSO/SAML, fine-grained RBAC, audit logs, white-labeling — lands behind it. If you self-host Dokploy for your own apps, nothing changed for you this morning.

If you picked Dokploy partly because "open source" felt like a durability guarantee, the guarantee just got narrower. This post is the receipt: exactly what moved, what stayed, who trips the new restriction, and the five-question checklist to run against any self-hosted PaaS before you bet on its license.

The short version: what moved and what didn't​

The one-sentence verdict: solo developers and small teams self-hosting their own workloads are unaffected — the core that deploys your apps is still Apache 2.0. Teams that will eventually need enterprise identity, permissioning, or audit features just watched those arrive behind a paid term. And anyone building a business on top of Dokploy — reselling it as a hosted service — now needs consent they didn't need before.

One footnote before you quote that table: the boundary is contested, and you shouldn't take any single post's word for it — including this one. See the box in the next section.

What the restructure actually says​

The mechanics are simple and worth stating precisely, because "changed its license" gets misread as "isn't open source anymore." Dokploy didn't relicense its past. The repository's core remains under the standard Apache 2.0 license it always had.

What changed is that the project introduced a second license — the Dokploy Source Available License — that applies to code living in proprietary/ directories. Source-available means what it says: you can read the code, but the license withholds specific rights, here the right to resell it or offer it as a commercial service without permission. New enterprise capabilities go in those directories; the deploy path you already run does not move.

Here's the worked example that makes the restriction concrete. A five-person team self-hosting Dokploy on a $5 VPS to deploy its own SaaS, side projects, and staging environments: unaffected, today and under the announced scope. A small agency that takes that same Dokploy install, puts ten client apps on it, and bills each client a monthly "managed hosting" line item: that is the shape of use the new terms target, and it now needs a commercial arrangement. The line isn't "commercial use" in the abstract — it's competing with Dokploy's own hosting business on Dokploy's own code.

The contested boundary. Community reporting genuinely disagrees about how wide the new license already reaches. Some 2026 comparisons claim that templates, multi-node support, and preview deployments are also restricted; the most detailed comparison available holds that the source-available scope is currently limited to future enterprise features — SSO/SAML, RBAC, audit logs, white-labeling — and that the core stays clean. Don't resolve this by trusting either claim. Resolve it in thirty seconds: clone the repo, search for proprietary/ directories, and read which paths carry the Source Available header. Directory-scoped licenses are auditable in a way a press release isn't, and re-checking that boundary on every upgrade is now part of running Dokploy — which is itself one of the checklist items below.

Dokploy ships in four editions today — Self-Hosted (OSS, free), Cloud (from $4.50/mo), Enterprise Self-Hosted (license, contact sales), and Enterprise Cloud (custom). The restructure fills in the pricing logic above the free tier: the enterprise column finally has something in it worth charging for.

Why this keeps happening: the open-core playbook​

Dokploy is not an outlier; it is the latest entry in a pattern so regular you can set a watch by it. The industry even has a nickname for the mechanism: the SSO tax — single sign-on, audit logs, and granular permissions are the features that move behind a commercial license first, because they are the features only paying organizations demand.

Nobody's side project needs SAML. Every 200-person company does. Gating enterprise identity is how open-core projects convert adoption into revenue without charging the hobbyists who supply their stars.

The timeline:

Two things about that table matter more than the pattern itself. First, the direction isn't always one-way: Elastic returned to AGPL in 2024, and Redis added AGPLv3 in 2025 — community pressure and competitive dynamics can and do reverse a relicense.

Second, the community's response to a relicense is now institutionalized as the fork: Terraform's BSL produced OpenTofu, Redis's change produced Valkey, and both forks are doing fine. Research presented on the aftermath (CHAOSS's State of Open track) found the telltale signature: vendor employees were already making over 90% of contributions before each relicense, and outside contributors simply moved their commits to the fork afterward. The lesson isn't that relicensing kills projects — it's that the community rebuilds around open governance when it has to, and the project's bus factor was the vendor all along.

Dokploy's version of this story has one unusual feature worth naming: timing. MongoDB, Elastic, HashiCorp, and Redis all relicensed from positions of entrenched dominance, years into mass adoption. Dokploy relicensed at 26,000-plus stars on a 0.x version line (v0.29.x as of mid-2026) — very early in its adoption curve, while a large share of its users are still evaluating rather than committed.

An early relicense is arguably more honest (the terms are visible before you're locked in) and simultaneously a louder signal about where the project's revenue must eventually come from. Both readings can be true.

The 5-question durability checklist​

"Is it open source?" is the wrong question — it's binary, and licenses stopped being binary years ago. Run these five yes/no checks against any self-hosted PaaS instead, shown here applied to Dokploy as the worked example:

1. Is the core under an OSI-approved license? Dokploy: yes — Apache 2.0 for the core platform. This is the floor. Anything below this (a fully proprietary core with a "community edition" binary) is a different category of risk.
2. Are the features you need free today — and where will the ones you'll need in two years live? Dokploy: deploys, databases, and Swarm mode are free; SSO, RBAC, and audit logs are designated paid territory. Map your own roadmap, not the project's: a solo dev's answer and a soon-to-be-SOC-2 startup's answer differ completely.
3. Does the license restrict resale or hosting-as-a-service? Dokploy: yes, for code under the new terms — you can't sell Dokploy-as-a-service without consent. If you're an agency or planning a platform business on someone else's panel, this is the clause that bites.
4. Could the community fork it if terms worsen? Dokploy: plausibly — tens of thousands of stars, TypeScript codebase, Docker primitives underneath rather than exotic internals. But note the CHAOSS lesson: check who contributes, not just how many stars. A fork needs maintainers, not stargazers.
5. Is the project pre-1.0, where terms churn most? Dokploy: yes — still 0.x. Pre-1.0 means the API, the architecture, and the license are all still settling. Discount every promise accordingly, in both directions: terms could tighten further, or competition could force them looser (see: Elastic, Redis).

Two companion data points belong in any Dokploy evaluation even though they aren't license terms. Coolify — the incumbent alternative at roughly 55,000-plus stars — remains Apache 2.0 throughout with no paid tier on the self-hosted side, but it is heavier at idle and its Docker Compose path still can't do zero-downtime deploys (only Dockerfile, Nixpacks, or single-image deploys can). And January 2026 also brought disclosed Coolify CVEs — eleven critical flaws, patched in v4.0.0 that April. License durability and security response are separate axes; grade both.

Where this leaves your pick​

For the record, here is the honest positioning. If license purity is your top criterion and you want zero paid tier on the self-hosted side, Coolify's all-Apache-2.0 stance is the cleaner answer, and you pay for it in idle footprint. If you want the lighter, Swarm-native panel and you don't need enterprise identity features, Dokploy's core remains a genuinely free Apache 2.0 platform.

You're just accepting an open-core gamble that the features you'll want at 50 people will cost money. And orthogonal to all of it: both are single-box-first tools. When you outgrow one machine, neither gives you declarative fleet lifecycle — no node provisioning, no machine reconciliation — which is the seam a Cluster-API-based platform exists to remove.

Disclosure, since this post argues licenses are a selection criterion: bex itself is Apache-2.0 licensed, and that commitment is load-bearing for the argument above rather than decorative. The checklist in section four is the same one we'd hand you to run against us — core license, your-roadmap features, resale terms, fork-ability, maturity. Run it on every candidate, including ours.

Sources: Dokploy's license-update announcement (dokploy.com/blog/we-are-updating-dokploys-open-source-license, effective January 21, 2026); Dokploy docs editions comparison (Self-Hosted (OSS) / Cloud / Enterprise Self-Hosted / Enterprise Cloud, Cloud Hobby $4.50/mo per server, Startup from $15/mo); Cloudzy's Coolify vs Dokploy comparison (June 2026 — stars, v4.0.0 vs v0.29.4, CVE and license analysis); Deploynix self-hosted PaaS showdown 2026; Dusko Licanin's 2026 open-source SaaS models piece (the "SSO tax"); CHAOSS/State of Open '25 research on post-relicense contribution dynamics (Terraform, Redis, Elasticsearch); arXiv 2411.04739 on relicensing, forks, and community impact; OpenAlternative/Stormkit license tables (Coolify Apache-2.0, Dokploy Apache-2.0 + proprietary parts).

Bex.co is the open-source, AI-native Render alternative — push a git repo, get a running HTTPS service on machines you own. Star the repo on GitHub or deploy your first app today.