Kaisin

The managed platform experience on your own Kubernetes cluster.

Build and deploy your applications with builds, registries and PR previews, on infrastructure you control.

Get started View on GitHub

Self-hosted. Free community edition. Yours.

Rented

  • Someone else's platform
  • Growing bills
  • Limited access
  • Proprietary lock-in
  • Complex to customise

Owned

  • Your Kubernetes cluster
  • Predictable costs
  • Full access, SSH in
  • Free community edition
  • Built for developers

helm install kaisin oci://ghcr.io/bluepawlabs/charts/kaisin

Your infrastructure.
Your data.
Your rules.

Renting was never about the servers.

What renting costs

the invoice grows with the thing you wanted to grow
  • The bill grows with the thing you wanted to grow.
  • Your source runs on hardware you don't control.
  • A build you can't attach a debugger to.
  • When it breaks, you open a ticket and wait.
  • The exit costs a rewrite, which is why the price can rise.

What owning costs, today

forty YAML files, all by hand
  • A Deployment, a Service, an Ingress, a cert issuer.
  • Secrets you rotate by hand.
  • No PR previews unless you build them yourself.
  • Forty YAML files between you and push-to-deploy.
  • Every one maintained forever.

This is the real reason people rent. Not the servers. The forty files.

Kaisin is the rented workflow, on the hardware you already own.

It installs into a cluster you already have. Connect a repo, and Kaisin builds on your nodes, pushes to a registry it runs, rolls the image out, gets TLS from cert-manager, and gives every pull request its own environment that disappears when the PR closes.

Kaisin is a tenant in your cluster, not a replacement. Everything it makes is an ordinary Deployment, Service and Secret you can read with kubectl and delete without asking anyone.
A Kaisin build log: clone, build the container image, push it to the registry, with the output beneath.
clone → build image → push to registry

What it does, on your nodes.

01

Builds

Rootless BuildKit in a short-lived Job. No Docker socket, no privileged pod. Or your own GitHub Actions builds it, and Kaisin deploys what it is handed.

02

Images

An in-cluster registry on a volume you own. Keeps the last ten images per app.

03

Domains and DNS

A route and a certificate per hostname. Given a Cloudflare token, Kaisin writes the record too, and opens a tunnel when the cluster has no public address.

04

Routes

One hostname can serve two applications by path, hand a subdomain to another, or do nothing but redirect.

05

Data

PostgreSQL, Redis and S3-compatible object storage per environment, with the credentials injected and the buckets browsable in the panel.

06

Previews

A namespace, a build of the exact commit, a hostname and empty databases of its own per PR. Removed when it closes.

07

Network map

Draws what reaches what. Turn isolation on, and an environment refuses every connection nobody allowed.

How isolation works
08

Import

Sees what the cluster already runs and takes a namespace on where it stands. Changes go back to its chart as a pull request.

Importing a cluster
09

Clusters

Build on one cluster and run production on another. Each environment says where it runs.

10

Command line

kaisin follows a failing build, tails logs, deploys and scales. Signed in by approving a code in the browser.

The command line
11

Agents

Claude Code, Claude, or anything that speaks MCP can do what you can do in the panel, as you. Or read-only.

Connecting an agent
12

kubectl-native

Standard Kubernetes objects, top to bottom. No opaque controller to debug at 2 AM.

Need a managed database for production?

Because Kaisin creates standard Kubernetes Secrets, you can inject external connection strings exactly like you do today. Point production at your existing RDS or managed Postgres; use the in-cluster databases for PR branches.

83s

From pull request opened to preview running. Measured on the reference installation: a Next.js app on a single node.

This page is deployed by Kaisin, on the cluster it is describing.
The Kaisin applications screen: two applications with their production environments, and a pull request preview nested beneath one of them.
a PR preview nested under a live production app

Read the chart before you trust the cluster.

Built by Blue Paw Labs

You are pasting a cluster-level chart, so inspect it first. Pull it, template it, and read every object it would create. Nothing reaches your nodes that you have not already seen.

View on GitHub

No lock-in, by design

Everything Kaisin makes is an ordinary Deployment, Service and Secret that you can read with kubectl and delete without asking anyone.

The community edition is free

Nothing to buy to run it. The chart and images are private packages, so installing takes a pull token, and that is all it takes. Telemetry goes to your own collector, or nowhere at all.

Runs on what you already have

Native to k3s, kind, and any existing Kubernetes cluster. Uses cert-manager for TLS, rootless BuildKit for builds, and the OCI registry at oci://ghcr.io/bluepawlabs/charts/kaisin. Where Coolify and Dokploy target raw Docker servers, Kaisin is built for the cluster you run.

Two answers and a token. The rest is paste.

Pick your machine and your cluster. Copy the commands.

YOUR MACHINE
YOUR CLUSTER

The community edition, free. The chart and its images are private packages on ghcr.io, so Helm and the cluster each need a token with read:packages on bluepawlabs.

Encryption key: Kaisin makes its own encryption key. Back it up. Losing it makes the secrets it protects unrecoverable.

The command line needs no token: brew install bluepawlabs/kaisin/kaisin

View on GitHub The full install guide covers servers, DNS, certificates, and private addresses.

Deleting Kaisin leaves your running apps, services and certificates intact, because they're standard Kubernetes objects. You can rip it out the same way you rip out anything else.

The PaaS workflow, on your own box.

Get the install command View on GitHub

Free community edition. On hardware you own.