Self-hosted OneCLI

Run OneCLI in your own infrastructure: the free Community edition or the fully featured Enterprise edition, each a single Docker image.

Self-hosted OneCLI runs the stack (dashboard, REST API, and the credential-injecting gateway) as a single Docker container in your own infrastructure, backed by PostgreSQL.

There are two self-hosted editions:

• Community: free and open source. The full dashboard with community integrations, for individuals and small teams.
• Enterprise: the commercial edition. Every feature enabled, including premium app integrations and granular per-agent access policies, with an organization API key for headless provisioning. There is no license key to manage.

The Enterprise edition ships in more than one deployment shape. Today that’s the all-in-one image (onecli/slim): the entire stack in your infrastructure. A connector deployment is coming, pairing the OneCLI Cloud dashboard and API with a gateway and database that run inside your network, so credentials never leave it.

The Enterprise image is private. Access is granted as part of your Enterprise agreement — contact us to get started.

Choose an edition

	Cloud	Community (self-hosted)	Enterprise (self-hosted)
Image	-	ghcr.io/onecli/onecli	onecli/slim (all-in-one)
Price	Free tier + paid plans	Free, open source	Commercial
Runs in your infrastructure	No	Yes	Yes
App integrations	All, managed OAuth	Community apps, your own OAuth credentials	All, your own OAuth credentials
Granular per-agent access	Paid plans	No	Yes
Organization API key at boot	-	No	Yes
Operations work	None	Yours	Yours

If you don’t need to run in your own infrastructure, OneCLI Cloud is the fastest way to use OneCLI: no operations work, and it’s always up to date.

What’s in the box

Both editions bundle the same three components into one container:

Component	Port	What it does
Dashboard	10254	Web UI for connecting apps and managing secrets, agents, and rules
REST API	10254 (/v1)	The same API as OneCLI Cloud, served by your instance
Gateway	10255	The HTTPS proxy your agents route through for credential injection and policy enforcement

Your data stays in your environment: secrets are encrypted at rest in your PostgreSQL, and request activity is logged to your database only. See Telemetry for the product’s telemetry policy.

Get started

Deploy Community Edition

The free, open source edition. One command with Docker Compose.

Deploy Enterprise: all-in-one

The fully featured commercial image, API-ready from first boot.

Configuration

Environment variables, authentication modes, and networking.

Connect the CLI and agents

Point agents at your instance, including headless provisioning.

Support

The Docker Compose setups in these docs are intended for evaluation and small teams; the production checklist covers hardening. For help, open an issue on GitHub or contact us through onecli.sh.