Shipown is a desktop control centre for deploying Node and static web apps to your own Linux servers over SSH. Connect a server, pick a repository and a branch, get a live URL with HTTPS — and roll it back when it goes wrong.
What it does
Shipown is the polished client for a real deployment engine. It shows you what is actually happening on your machines, and refuses to invent the parts it cannot see.
Every progress state streams from the actual install, build and health check.
Shipown refuses to fabricate deployment success. Install output, build output and the health check stream from the server as they happen. When a deploy fails you get the exact command and the exact line that broke it, not a spinner that gives up.
CPU, memory, disk, uptime, processes and a live SSH terminal in one place.
Register a Linux server over SSH and Shipown inspects it, reports what is missing, and installs only what is needed — Node.js, PM2, Git, Nginx, Certbot. Open a server and you get its gauges, its busiest processes, its apps, its logs and a real terminal, with a way back to the rest.
Detected build command and output directory, shown before you commit.
Shipown reads your project and proposes a framework, an install command, a build command and an output directory. Every one of them is editable, and the summary you approve is what runs. A runtime Shipown cannot deploy is marked as such rather than attempted.
Every deploy is a versioned attempt you can return to.
Each deploy lands in its own release directory and the live pointer moves only after the build and the health check pass. A failed deploy restores the previous release by itself. Rolling back later is picking a known-good release, not reconstructing one under pressure.
The commit each app runs, against the head of its branch.
Shipown reads the commit each deployment is actually running off the server, and compares it with the branch on GitHub. An app that is behind says how far, and its deploy button says how many commits are waiting. Promoting from staging ships that exact commit, not whatever the branch points at by the time the deploy runs.
SSH keys and secrets never cross into the UI process.
The Electron main process holds SSH keys, passphrases and environment values behind a narrow bridge. Shipown never uploads private keys, environment variable values, source code, or command output for licensing or telemetry. Saving a server, you choose whether its password or key passphrase is kept on that computer at all: keep it, encrypted by the operating system, and the server reconnects by itself; leave it out and nothing secret is written to disk — the app asks you once per session instead, and forgets it when you disconnect.
Claude, ChatGPT or DeepSeek proposes one shell command at a time, with its reason — you approve before it runs.
Bring your own Anthropic, OpenAI or DeepSeek API key — Claude Opus 5, Claude Fable 5.1, Claude Sonnet 5, GPT-5.4, GPT-5.4 mini, DeepSeek V4 Pro or DeepSeek 4.1 Flash — and operate your servers in natural language. The AI operator diagnoses port conflicts, inspects system logs, checks failing builds, and proposes exact shell commands with clear rationale. Destructive commands — recursive deletions, reboots, firewall flushes, stopping SSH — are held for human confirmation. Keys are encrypted with OS keychains and private credentials never touch Shipown servers.
Inspect ports, memory, and crash loops — and Start, Stop, or Restart with one click.
Open any server to manage every Docker container: see image tags, runtime state, published vs internal ports, Nginx routing, CPU and memory gauges, restart policies, restart counts, and volumes. Crash-looping containers are surfaced first with last log lines. Safely trigger container lifecycle actions (Start, Stop, Restart) over SSH with live progress and feedback.
Create isolated deploy accounts, assign SSH keys, and grant scoped sudo rules without root sharing.
Shipown enables granular access management directly over SSH. Provision non-root deploy users, assign public SSH keys, configure tailored sudo rules, or revoke accounts with a single click. Secrets and private keys never leave your local Electron process.
Integrated @xterm/xterm console alongside CPU, RAM, disk, load average, and PM2 process monitoring.
Instant terminal access without external SSH clients or window switching. The embedded xterm console is a real PTY with full ANSI colour, alongside live server vitals read from /proc: CPU load, memory, disk usage, network throughput, uptime and the PM2 process list.
A Dockerfile or a compose file, with the same releases, health check and rollback.
Point Shipown at a repository or folder with a Dockerfile and it builds the image on your server, labels it with the commit it came from, and publishes it on 127.0.0.1 behind Nginx. A compose file is built and brought up as a project instead. Either way the previous container is kept until the health check passes, a failed release is put back automatically, old images are pruned, and every release stays available to roll back to. A server without Docker can have it installed from the app.
Browse, upload a whole folder, edit a file in place, unzip an archive.
Open any server and browse it from the SSH user’s home: breadcrumbs, hidden files, a search that filters the folder you are in. Upload single files, several at once, or a whole directory tree with its structure kept, by picker or by dropping them in — each transfer shows its own percentage. Download a file, rename or move it, edit a text file without leaving the app, unzip an archive in place, and delete after a confirm step.
The maintenance jobs that usually mean a shell session, with the dangerous parts guarded.
Read every cron job on the server — the SSH user’s, root’s, /etc/cron.d and the periodic directories — and edit a crontab with the syntax checked and a backup written before it is installed. Manage ufw or firewalld: the ports actually listening, the rules, allow or deny with a range and a protocol, and a rule that cannot lock you out, because the live SSH port is read from the connection and allowed first. Create or remove a swap file with the memory and disk checked first. Install and configure pm2-logrotate, and flush an app’s logs. Shipown can also tune sshd, clear stale temp files and clean up dead SSH sessions.
MySQL, MariaDB, PostgreSQL and MongoDB: back up now, restore, or run it nightly.
The app finds the database engines installed on the server and lists their databases. Back one up on demand with the right tool for the engine, compressed into the server’s own backup directory with only the newest kept. Restore a backup and a safety copy is taken first, before anything is overwritten. Schedule a daily backup at an hour you choose with its own retention, and see when cron is not running to carry it out. Database credentials, when you save them, are written on the server with 600 permissions and never kept on your computer.
A container that dies shows up in about a second, without an agent on the server.
The Overview keeps a live feed for the servers you are connected to. Docker events stream over the existing SSH connection, so a container that starts, exits, runs out of memory or turns unhealthy appears in about a second — and a container crash-looping is reported once as a loop, not forty times. PM2 apps are re-read every fifteen seconds and compared, so an app going down, coming back or restarting is called out. A server that stops answering is reported once, with the checks backing off, and its recovery is reported too. Deploys and rollbacks land in the same feed.
A moved server is traced through its own domains, and proved by its SSH host key.
Restart a cloud instance without a static IP and the address it had is gone. Shipown remembers the SSH host key of every server it connects to, and the public domains its Nginx serves. When a saved server stops answering, it resolves those domains, tries SSH on the new address, and accepts it only if that machine presents the same host key — a check that happens before any password or key is offered, so nothing is handed to a machine that merely took over a domain. If it matches, you are asked whether to save the new address.
Who is being locked out for failed logins, on what terms, and one button to set it up.
A firewall decides which ports answer; fail2ban decides who stops being answered. Shipown reads whether it is installed, whether the daemon is actually replying, whether it starts with the server, and every jail with the failures it has seen, the bans it has made and the addresses banned right now — each one unbannable in a click. One button installs it with the server's own package manager, writes the jail, switches it on and confirms the daemon answers afterwards. Exactly one file is managed, /etc/fail2ban/jail.d/99-push-ops.conf, so the distribution's own configuration is untouched, and the address your session comes from is always in the ignore list, so tightening the rules cannot lock you out. Where failed logins are read from is detected rather than assumed — auth.log, secure, the systemd journal, or Alpine's messages — because a jail pointed at a file that is not there never starts. PM2 log rotation lives beside it, so logs stop growing without a cron job of your own.
A new version announces itself with its release notes, downloads inside the app and is checked before it runs.
When a new version appears, Shipown says so once: the version, what is in it, and how long the copy you have keeps working. The installer streams inside the app with a progress bar — never a browser download — and is verified against the SHA-512 published beside it before anything runs; no checksum means no install, rather than trusting whatever arrived. An out-of-date install keeps working for a week after an update is first seen, warns on the last day, and then offers only the update.
Where it runs
Node applications run by PM2 and static sites served by Nginx, on a Linux server you reach over SSH. Every deployment shows what was built, which commit it came from, and where it is running.
Next.js, Nuxt, Remix, SvelteKit, NestJS, Fastify and plain Express. Installed, built and started on your server under PM2, with the port, the health check and the restart policy set for you.
Vite with React or Vue, Astro, or plain HTML. Built once, published to a release directory, and served straight from Nginx — no process, no port, nothing to restart.
A Dockerfile or a compose file, built on your server and published behind Nginx. This is also the answer for languages with no runtime of their own here: if it ships in a container, it deploys.
Point a domain at an app or a site and Shipown writes the virtual host, tests the configuration before reloading it, and asks Certbot for a certificate. A configuration Nginx rejects is put back the way it was.
Real output
Build output, container startup, health checks and routing all stream from the control plane. There is no client-side progress simulation anywhere in Shipown — when a step fails, the line that failed is the line you see.
Beta access
Keys carry an expiry, a status, and a device limit. Activation is checked by the licence server — not by the desktop client — so a revoked key stops working everywhere. Ask for an invitation and we will send one when a slot opens.
Windows · Linux — same installer on the site and in-app updates
FAQ
Still unclear on something? Everything the product does is written down here and in the docs.
Shipown is a cross-platform Electron desktop application that deploys and operates web applications on Linux servers you own. It gives you the workflow of a managed deployment platform — connect a source, build, get a live URL, roll back — while the servers and the data stay yours.
Managed platforms run your app on their runtime and their account. Shipown deploys to a server you already rent or own, over plain SSH, and installs no agent to do it. You keep the smooth workflow without handing over the infrastructure.
Three runtimes. Node applications run by PM2 — Next.js, Nuxt, Remix, SvelteKit, NestJS, Fastify and plain Express. Static sites served by Nginx, including Vite with React or Vue, Astro and plain HTML. And Docker, from a Dockerfile or a compose file, which covers any language that ships in a container. Python, Go, Rust, PHP, Ruby, Java and .NET have no native runtime here; deploy them in a container.
No. Node applications run directly under PM2 and static sites are served by Nginx, on a server with no Docker at all. If you do use Docker, Shipown deploys to it as well — a Dockerfile or a compose file, with releases, health checks and rollback — and manages the containers already on the server: every container inspected, published and internal ports mapped, CPU and memory gauges, crash loops called out, start, stop, restart, a shell inside the container, and its logs. It can also install Docker on a server that has none.
A Linux server you can reach over SSH — a VPS, a cloud VM, or a box in your office. Ubuntu, Debian, the RHEL family and Alpine are handled. Your own computer is where a project comes from, not somewhere Shipown deploys to.
No. SSH private keys, passwords, passphrases, environment variable values, source code and project files never leave your machine for licensing or telemetry. Credentials are held by the Electron main process and are never exposed to the interface. The one exception is one you opt into: the AI terminal sends its conversation to the AI provider you pick.
Only to the provider you choose (DeepSeek, Anthropic Claude, or OpenAI), and only while you actively interact with it. The AI operator sends your prompt and the terminal outputs of the commands it runs under your own encrypted API key. Shipown does not intercept or store this telemetry. Destructive commands (reboots, rm -rf, firewall changes, stopping SSH) are never executed automatically without your explicit confirmation.
Yes. Every deploy lands in its own release directory, and the live pointer moves only after the build and the health check pass. A deploy that fails restores the previous release by itself, and you can switch back to an earlier release later from the app.
No. Shipown tells you when a branch has moved ahead of what a server is running, and how many commits are waiting, but a person still presses deploy. Automatic deployment on push is not part of this beta.
No. Shipown is a commercial product and its source is not published. What runs on your servers is plain SSH and shell — nothing is installed to phone home — but the desktop application itself is licensed, not open.
The beta is invite-only. An administrator issues a revocable licence key with an expiry and a device limit — typically two machines per key. Activation is checked server-side, and keys can be extended, revoked, or have a device slot freed.
Windows, as an .exe installer, and Linux, as a .deb for Debian and Ubuntu. Both come from the same download server the app updates from, so the file on the invite page and the file an update fetches are the same file. macOS is not published yet.
