Built with Rust · Open Source

Lightweight GitOps for Docker

Secure, automated deployments for resource-constrained and edge environments. Features Docker Compose orchestration, AI model management, and compliance enforcement in a single, minimal-footprint agent.

RustPerformance & Safety
8Compliance Frameworks
ZeroProduction Panics

Core Features

Everything you need for modern, remote Docker deployments — from GitOps automation to AI model fleet management.

GitOps Automation

Repository polling, webhook triggers, and multi-branch deployments across environments. Features secure authentication, application auto-discovery, and a lifecycle event system for orchestration.

PollingWebhooksMulti-branchRetry Logic

Docker Compose Integration

Orchestration with environment-specific profile activation and variable injection. Supports rolling, blue-green, and canary deployment strategies with direct Docker API communication and health checks.

RollingBlue-GreenCanaryHealth Checks

AI Model Management

Automated deployment of AI models across device fleets via Docker Model Runner. Supports llama.cpp and vLLM inference engines with OpenAI-compatible APIs, health monitoring, and resource management.

Docker Model RunnerFleet DeployREST APIAsync Polling

Edge Computing

Optimized for constrained networks. Features offline mode for graceful outage handling, multi-site synchronization, and token-bucket bandwidth control to manage resource utilization.

Offline ModeBandwidth MgmtMulti-SiteLRU Cache

Secure Self-Update

Automatic update checking with Ed25519 signature verification for binary authenticity. Includes health-check based automatic rollback, zero-downtime binary replacement, and update history tracking.

Ed25519Auto-RollbackChannelsKey Rotation

Observability

Native Prometheus metrics endpoint, Loki log streaming integration, and OpenTelemetry tracing support. Monitor deployments, container health, and agent performance in real time.

PrometheusLokiOpenTelemetry

Configuration Management

Version-tracked configurations with a built-in diff engine, rollback validator, and Git sync. Fleet-wide templates let you push consistent settings to every device at once.

VersioningDiff EngineRollbackFleet Templates

Pre-Download Management

Priority queue for Docker image pre-pulls with bandwidth control and automatic cache cleanup. Ensures containers are ready before deployment windows open, minimizing downtime.

Priority QueueBandwidth ControlCache Cleanup

Maintenance Windows

Schedule deployments with cron expressions. Define recurring maintenance windows, one-time overrides, and black-out periods to deploy on your terms — not on every push.

Cron SchedulingRecurringOverride

Security & Compliance

Six-phase security architecture and eight compliance frameworks — hardened from the ground up.

AES-256-GCM Encryption

All credentials and secrets encrypted at rest. Credential health monitoring with rotation alerts and expiration tracking.

OIDC / SSO via Zitadel

Enterprise single sign-on with PKCE flow, JWKS caching, RS256 verification, silent token renewal, and automatic user provisioning.

Mutual TLS & HTTPS by Default

Hub deploys with HSTS (1-year), secure cookies, and SSL redirect out of the box. Agent-to-Hub communication secured with mTLS.

Ed25519 Audit Signing

Tamper-proof audit trail with Ed25519-signed log entries. Complete deployment history for forensic and compliance review.

CVE Scanning & SBOM

Container vulnerability scanning with CycloneDX and SPDX SBOM generation. Dedicated SBOM Dashboard in the Hub for supply-chain visibility.

Rate Limiting & Input Validation

Token-bucket rate limiting, CORS policies, comprehensive input validation, and bearer-token API protection across all endpoints.

SOX GDPR HIPAA PCI DSS NIST CSF ISO 27001 NIS2 Directive EU Cyber Resilience Act

Architecture

A typical GitOps deployment flow — from git push to running services, with centralized Hub oversight.

Git Repository

Push triggers change

MicroCD Agent

Poll / webhook detect

Docker Compose

Strategy & health checks

Running Services

Your applications, live

status reports ↓
↑ commands
MicroCD Hub

Fleet dashboard, config, AI models, compliance

Agent Components

Built with Rust — zero production panics, 11 domain error enums, intelligent retry logic.

Git Manager Config System State Manager Compose Manager Model Manager Edge Manager Status Reporter Audit Logger Web Dashboard Rollback System Self-Updater Pre-Download Engine Lifecycle Hooks

MicroCD Hub

Centralized fleet management and monitoring. Powered by Django with a React frontend, the Hub gives you a single pane of glass for every device in your fleet.

Real-time device status and deployment tracking
Fleet-wide configuration templates and rollout
AI model deployment commands and progress tracking
Compliance reporting with PDF export
OIDC / SSO single sign-on with Zitadel
Multi-tenant RBAC with organization isolation
Dashboard

Live fleet overview, deployment history & analytics

AI Models

Pull, deploy & monitor models across devices

Compliance

8-framework reports, SBOM dashboard & PDF export

Config & Releases

Version-tracked config, release publish pipeline

Get Started

Up and running in minutes.

Quick Install
$ curl -fsSL https://packages.microcd.dev/install.sh | sudo bash

Also available via Homebrew and as a Proxmox LXC deployment with dual GHCR/source install modes.

Setup Steps
1

Install MicroCD with the one-line installer or from source.

2

Generate a configuration file:

microcd --generate-config microcd.yaml
3

Point it at your Git repo and run:

microcd --config microcd.yaml
4

Access the local web dashboard:

http://localhost:8080

Enterprise Ready

Scale with confidence from a handful of devices to a global fleet.

Multi-Tenancy & RBAC

Organization-isolated tenants with role-based access control via Zitadel. Admin UI for user and team management.

Compliance Reporting

Generate compliance reports for SOX, GDPR, HIPAA, PCI DSS, NIST CSF, ISO 27001, NIS2, and the EU Cyber Resilience Act. Export to PDF.

OIDC / SSO

Production-hardened SSO with PKCE, JWKS caching, RS256 verification, silent token renewal, and runtime config injection.

Lifecycle Hooks

79 integration points in the deployment pipeline for pre/post deploy scripts, notifications, and custom automation.

Docker Exec Streaming

Execute commands inside running containers with Bollard stream multiplexing. Capture real stdout, stderr, and exit codes.

Release Pipeline

Complete publish command with multipart registry upload. Supports update channels, Ed25519 signing, and the full release lifecycle.

Deploy Anywhere

From cloud VMs to Proxmox LXC containers — MicroCD fits your infrastructure.

Linux (x86_64 / ARM) Proxmox LXC Docker Cloud VMs Edge / IoT Homebrew