sh0
Self-hosted deployment. Single binary. Zero complexity.
A deployment platform in a single Rust binary (~2MB). Git push deployments, automatic SSL, built-in AI chat with 20 MCP tools, database management, browser terminal, and multi-server orchestration.
Building sh0
Auto-Detecting 19 Tech Stacks from Source Code
How sh0's build engine detects 19 tech stacks, generates production-grade Dockerfiles with multi-stage builds, and creates optimized build contexts -- all in pure Rust.
Taming Caddy as a Programmatic Reverse Proxy
How we turned Caddy into a fully programmatic reverse proxy managed via its Admin API, with automatic SSL, route syncing, and crash recovery.
Blue-Green Deploys: Building a Zero-Downtime Pipeline in Rust
The 8-step deploy pipeline that powers sh0: clone, analyze, build, deploy, health check, route, swap, and cleanup -- with blue-green container swaps and automatic disk management.
Multi-Server BYOS: SSH Tunnels, Image Transfer, and Trust On First Use
How we built multi-server support: SSH tunnels to remote Docker sockets via russh, disk-based image transfer, Trust On First Use host key verification, and node-aware deployment.
Backup Engine: AES-256-GCM, 13 Storage Providers, and FTP Nightmares
Building a backup engine with pluggable storage, AES-256-GCM encryption, 13 storage providers via OpenDAL -- and the IPv6 FTP bug that forced us to write our own client.
Auth in Rust: Argon2id, JWT, TOTP, and API Keys
Building a complete authentication system in Rust: Argon2id password hashing, HS256 JWT tokens, TOTP 2FA with backup codes, API key generation, and AES-256-GCM encryption.
Automatic SSL: DNS, ACME, and Custom Certificates
How sh0 handles SSL certificates automatically via Caddy's ACME integration, supports custom certificate uploads with AES-256-GCM encrypted private keys, and configures DNS for self-hosted deployments.
AI Sandbox: Giving Claude a Safe Container to Debug Your Apps
We built an AI sandbox that gives Claude root access to an Alpine container with curl, git, node, and python -- so it can actually debug your deployments instead of just guessing.
Preventing Command Injection in a PaaS
A PaaS runs user-provided commands by design. Here is how we built validate_command() to prevent shell injection in cron jobs, deploy hooks, and Docker exec.
Writing a Docker Engine Client from Scratch in Rust
Why we wrote a custom Docker Engine API client using hyper and Unix sockets instead of shelling out to the Docker CLI, and the multiplexed stream parsing that made it work.
Day Zero: 10 Rust Crates in 24 Hours
How we scaffolded an entire PaaS platform -- 10 Rust crates, 24 database tables, Docker engine client, API server, build engine, and health checks -- in a single day.