What CloudContainer actually does for you
Everything below is included on every plan. Plans differ by how much capacity your environment has, not by whether your application gets a database or a certificate.
Deployment
From commit to production, without a pipeline to maintain
Connect a GitHub repository, pick a branch, and CloudContainer takes it from there. Build, review, release, roll back.
GitHub-native
Authorise the repository once. Choose the branch that represents production. Your source never leaves your own organisation.
Build detection
If your repository has a Dockerfile we use it. If it does not, the stack is detected and a build is produced for you.
Deploy on commit
New commits on the tracked branch can build, pass review and go live automatically — or wait for you to press the button.
Reviewed before release
Every deployment passes the AI Security Review before it reaches production, so a risky change is caught while it is still cheap to fix.
Runtime
A private environment with dedicated resources
One CloudContainer is one isolated customer environment. Applications, databases and storage live together, with resources that are yours.
Isolation
Not a slice of a shared runtime. Dedicated CPU, memory and disk, so performance does not depend on who else deployed today.
Custom domains
Point a domain, add the record we show you, and it is live. Apex and subdomains, as many as you need.
Automatic HTTPS
Certificates are issued and renewed automatically. HTTP is redirected. Modern TLS defaults, no configuration file.
Environment variables and secrets
Encrypted at rest and injected at runtime. Values are masked in the interface and never printed into build logs.
Data
PostgreSQL and object storage, managed
The two services almost every application needs, provisioned from the same dashboard and backed up on the same schedule.
PostgreSQL
Standard PostgreSQL with managed setup, credentials, persistent storage, monitoring and nightly backup. Connection URL available to you.
S3-compatible object storage
Buckets for images, documents, PDFs, uploads, attachments and generated files. Private or public, addressed with the S3 API.
Daily backup
The whole CloudContainer is captured every night and stored separately from the production environment. Restoring is a first-class action in the dashboard.
Exportable credentials
Database and storage credentials belong to you. Use them from a local machine, a migration tool, or another platform entirely.
Operations
Someone is watching the environment. It just isn't you.
Logs, metrics, patching and service windows are part of the product, not an add-on you assemble from three other vendors.
Logs and metrics
Live application logs plus CPU, memory, disk and traffic. Searchable, retained according to your plan.
Managed maintenance
Set a service window. System updates and any required restarts are performed inside it, by the platform.
No SSH required
Normal operation never requires a shell. Deployments, configuration, restarts and restores are all first-class actions.
Independent runtime
Your applications keep serving traffic even if the CloudContainer control plane is unavailable. It manages the environment; it is not in the request path.
AI reviews
Two reviews: one before deploy, one after
CloudContainer applies AI where it has real leverage — reading a diff before it ships, and reading operational signal after it does. Both produce instructions your coding agent can act on.
AI Security Review — before
Possible authorization issue
/api/invoices/[id]
The endpoint verifies that the user is logged in, but does not verify that the requested invoice belongs to the authenticated organization.
recommended action
Add organization-level authorization before returning the invoice.
copy fix for coding agent
Review /api/invoices/[id]. The endpoint authenticates the user but does not verify that the requested invoice belongs to the authenticated organization. Add organization-level authorization. Do not modify unrelated functionality. Add a regression test confirming that a user from organization A cannot retrieve an invoice belonging to organization B.
AI Operations — after
Database errors increased after the latest deployment
- started
- +6 min
- after a829fc1
- errors
- 412/h
- current
- baseline
- 3/h
- previous
likely cause
A PostgreSQL client introduced in the latest commit is acquired inside a loop and not released correctly.
recommended action
Review src/api/orders.ts
copy fix for coding agent
In src/api/orders.ts a PostgreSQL client is acquired inside a loop and never released. Acquire the client once outside the loop, or release it in a finally block on every iteration. Do not modify unrelated functionality. Add a test that fails if a client is acquired without a matching release.
The AI reviews are advisory tools that raise the floor on quality and catch common mistakes early. They do not replace your own security testing, code review or professional judgement — and CloudContainer does not claim they do.
Architecture
cc-agent lives in your environment
A permanent agent runs inside every CloudContainer. It performs deployments, maintenance, backups and reporting locally, and talks to the control plane over an outbound connection it initiates itself.
That design has a practical consequence: there is no inbound management port to expose, and a control-plane outage does not take your applications down with it.
connection model
Long-running operations — restores, migrations, large builds — execute as asynchronous jobs with status you can poll or walk away from.