Why Bundar uses Podman, Caddy, and a plain server

Bundar starts with a server you own. Instead of asking you to move your applications into a new platform, the control plane connects over SSH, installs the tools it needs, builds or pulls an image, and runs it on that server. The host remains a regular Linux machine; you can inspect containers, networks, systemd units, and logs directly.

That choice shapes the stack: Podman runs containers; Caddy routes HTTP traffic and manages HTTPS; SSH connects the control plane to the host. There is no Bundar agent to install on every server. A deployment is a sequence of remote operations, not an opaque handoff to a second scheduler.

Why Podman?

Podman gives Bundar container images, named volumes, networks, and restart policies without requiring an always-running container daemon as the application's management API. Bundar installs Podman from the host's package manager and enables its systemd units. Each project gets a network for its services. Web applications also join the proxy network so Caddy can reach them; Bundar does not publish individual application ports on the host.

Application containers use Podman's --userns=auto to map container users into a subordinate ID range. Podman runs on the host under the SSH account you configure.

Why Caddy?

Caddy sits at the HTTP edge. Bundar runs it in a container, exposes ports 80 and 443, and updates its routes as deployments change. Caddy handles automatic HTTPS when the domain, DNS, and network allow certificate issuance. This leaves the application containers off host-published ports while giving web services a single entry point.

Why a plain host instead of another appliance?

Coolify and Dokploy offer self-hosted deployment workflows built around Docker. Bundar takes a different path: the control plane connects to your existing Linux server over SSH, deploys applications with Podman, and routes web traffic through Caddy. You can continue to inspect the host with familiar Linux tools.

Bundar also offers Firewalld setup, SSH configuration checks, and SSHGuard through its server management screens. These tools sit alongside the deployment workflow without changing the underlying host into a separate appliance.

SSH key storage

Bundar encrypts stored SSH private keys at rest. The control plane uses those keys to connect to your server and carry out deployments.

The result is a direct path from source or image to running service: SSH to the host, Podman to run the workload, and Caddy to serve it.