FAQ

#Does it use Docker?

No. Apps run as plain systemd services, each under its own Linux user, in a sandbox built from the same kernel features Docker uses. There are no images to build and no daemon to run, which leaves more of a small server's memory for your apps. Security explains the sandbox.

#What happens if I remove the panel?

Your apps keep running. They're ordinary systemd units and Caddy sites, with their builds and data in normal folders. Uninstall shows how to remove only the panel, and how to manage the apps afterwards.

#Can I see what it does on the server?

Yes. Every app is a folder in /srv/apps/, a unit in /etc/systemd/system/ and a Caddy file in /etc/caddy/sites/, and the docs show the raw commands next to every feature. The agent writes every change it makes to /var/log/layer/audit.jsonl. See Files and services.

#Which apps can it run?

Node apps (Next.js, Nuxt, Astro, Remix, React Router, Express, Fastify, Hono and others) and static sites, with npm, pnpm, yarn or bun. Other languages aren't supported yet. See Requirements.

#How many apps fit on a small server?

The panel, the agent and Caddy together use about 130 MB of memory at rest. The rest is your apps', and each one has a memory limit, so one can't take the server down. Builds are the heaviest moment; on small servers, keep one build at a time.

#Can one panel manage several servers?

Not yet: the panel manages the server it's installed on.

#Do my apps' data or secrets leave my server?

No. Builds, data, environment variables and logs stay on your server. Backups are encrypted on the server before they're uploaded to the storage you choose.

#What does the panel connect to?

Only what its work needs:

• GitHub, through your own GitHub App, to fetch your code and receive push webhooks.
• Let's Encrypt, for certificates.
• Package registries (npm and others) during builds, and nodejs.org for Node runtimes.
• Public DNS resolvers (Cloudflare's and Google's), to check your domains.
• The update feed at get.selfhostlayer.com, every 6 hours (you can turn that off) and when you update.
• Your backup storage and your alert channels, once you set them up.

There's no telemetry.

#Can I put it behind Cloudflare?

Yes. Domains can keep Cloudflare's proxy on; Domains lists the two settings it needs. The panel itself can also be limited to some addresses or to Tailscale in Settings.

#How do I update it?

Click Update available in the sidebar when a newer release is out (the panel checks every 6 hours), or use Settings → Version, or run layer update on the server. Apps keep running while the panel and the agent restart. See Updates and repair.