Your team can just ship things.
Push-to-deploy on the cloud account you already have.
Your credits, your provider’s prices, a platform you don’t have to run.
How Ship works
Install Ship anywhere you deploy.
Machines join a shared compute pool you set up once with one command or your favorite IaC tooling. The daemon connects to Ship to receive workloads, deploy apps to the pool, and route inbound connections.
- CLI
- Kubernetes
- Terraform
- Argo CD
- Flux
- OAuth
Connect your repo.
Ship detects your stack, builds your app's container, and deploys it across your compute. No Dockerfile required.
Share your app. Control access.
Every app gets a URL that can be public to the world or private to your team.
Push to deploy. Move without downtime.
Every git push rolls out blue/green: the old release keeps serving until the new replicas pass their health checks. Need cheaper machines or a different region? Move a live app to another provider and its URL stays put. We've moved apps between clouds in 9 seconds without anyone noticing.
DevEx. Velocity. Control.
Your devs love the DX. You hate the bill. Ship gives the apps your team builds with AI a PaaS workflow on compute you already pay for.
Get push to deploy and PR previews
Your team wants the ergonomics of PaaS, you want infrastructure you control. Now everyone wins.
Know where everything runs
Every app lands in one place you can see, instead of on a personal VPS you find out about later.
You're not limited to PaaS primitives
Your team's apps can use S3, RDS, IAM roles—anything in your providers' catalogs.
Choose the best compute providers
Optimize for price, geography, GPU, or cross-provider redundancy without changing your deploy workflows.
Spend the cloud credits you already have
Ship runs in your own cloud account, so your startup credits and committed discounts pay for the compute.
Operate one platform, not many
Keep using the observability and security tools you already standardized.
“A self-hosted PaaS in your VPC!”
We’ve heard that story before.
Ship is different.
You don’t host the control plane. Yes, your coding agent writes great Terraform, but with Ship, you only install a lightweight daemon and operationalize nothing. Nothing messes with your existing infra.
The gateway is built in. The agent connects your apps with secure tunnels and gives them URLs. Receive requests on any hardware without reconfiguring your network.
What will your team ship first?
No matter the app, public or private: one workflow covers the deployment, the URL, the access, and the routing.
- https://mcp-server.acme.com
- https://dashboard-pr-42-preview.internal
- https://discord-bot.ngrok.app
- https://n8n.internal
- https://fastapi.acme.com
- https://excalidraw.internal
- https://vibe-coded-dashboard.ngrok.app
- https://atlantis.acme.com
- https://lunch-roulette.internal
- https://nextjs-app.acme.com
- https://slack-bot.ngrok.app
- https://grafana.internal
- https://docusaurus.acme.com
- https://streamlit.ngrok.app
- https://kafka-ui.internal
- https://strapi.acme.com
- https://go-api-rust-rewrite.internal
- https://anything-with-a-dockerfile.ngrok.app
New deployment targets just dropped.
Connect a provider with one OAuth click, API key, or IAM role, and Ship provisions pools of VMs, GPUs, or Kubernetes clusters in your account. Pick by price, region, or GPU, and move an app between providers without changing its URL. Apps land in shared pools your platform team owns, not one-off clusters people spin up and forget.
- AWS ECS
- DigitalOcean Droplets
- DigitalOcean Kubernetes
- Hetzner
- Linode VMs
- Linode Kubernetes
- Vultr VMs
- Vultr Kubernetes
- Scaleway
- Lambda · GPU
- RunPod · GPU
- CoreWeave · GPU
Auth the app author can't skip.
Set SSO, OAuth, OIDC, or IP restrictions at the platform level, and Ship enforces them in front of every app. Nobody has to remember auth, and no internal app sits on an open URL.
Preview environments the whole internet can't see.
Every pull request gets a preview with a .internal URL that's only available on your team's private network.
With a production-grade gateway built in.
Flip on auth, firewalls, bot-blocking from a single screen. Ship turns those choices into Traffic Policy and enforces them at ngrok's cloud, before requests reach your app. DDoS protection and global acceleration come standard.
Services find each other by URL.
An app on a VM can call an API in your K8s cluster, no matter the networks or continents between them.
We earn when you run.
A share of your compute bill
plus Gateway traffic costs
You pay your cloud provider directly, at their price, with your credits and discounts. Ship takes a share of the machines your apps run on, never a fee per app, so a hundred small apps on one machine cost what the machine costs.
See full pricingAlready have a gateway? Ship only adds its share of the compute it runs.
All the boxes you need to check to safely host the apps your team builds with AI.
Frequently asked questions
We already ship with Ship.
“I moved a real app (medium size, about 20k lines of code) from Heroku to Ship and much to my surprise it 1-shotted whole thing flawlessly. I’m still kind of shocked.”
Your team is also building with agents on localhost. One more prompt gets those apps a real URL, running safe and snug on any compute you choose.