Skip to content
Meimo Cloud

Applications · Databases · Storage · Domains

A deploy isn’t live until it answers.

Meimo Cloud builds your code into a real container, waits until its port accepts a connection, then routes it over TLS to a URL that never moves. Databases, buckets and domains sit beside it on a network no other project can reach.

Start buildingHow a deploy works

From a project directory, after meimo login

$ meimo deploy
~/atlas — meimo deploy
$ meimo deploy

Deploying atlas

✓ 214 files, 2.4 MB
✓ Source uploaded
✓ Next.js detected

✓ Deployment successful

Live:
https://atlas-k7m2qx.apps.meimocloud.com/

Application

atlas

Running
atlas-k7m2qx.apps.meimocloud.com
Runtime
Next.js
Port
3000

How a deploy works

Six steps, and the platform shows you each one.

From the moment source arrives to the moment a URL answers, every step is real work on real infrastructure — and a step that fails stops the deploy with a message you can act on.

  1. Upload or push

    The CLI packs your directory — never node_modules, .git or .env files — and sends it straight to object storage on a presigned URL. A push to a linked GitHub branch clones that commit instead.

    .gitignore + .meimoignore respected

  2. Runtime detection

    The server reads the files you shipped. Your Dockerfile always wins; otherwise the runtime is identified from real evidence, or the build is refused with a message that says exactly why.

    Detected runtime: Next.js.

  3. Image build

    A real docker build runs from your Dockerfile or a template matched to the runtime, on the Node version your project declares. Secret environment variables never enter a layer.

    FROM node:20-alpine

  4. Readiness gate

    The container has to be running, must not have restarted, and its port has to accept a connection from the ingress. Until all three hold, the deploy is not live.

    Port 3000 accepted a connection from the ingress after 4s.

  5. Routed with TLS

    The route map is regenerated from the database and Nginx reloads it. Every application hostname is covered by a wildcard Let's Encrypt certificate.

    *.apps.meimocloud.com

  6. Live URL

    Each application keeps one permanent hostname for its lifetime. Redeploys and rollbacks change what it serves, never where it lives.

    https://atlas-k7m2qx.apps.meimocloud.com/

Platform

The resources a production app leans on, in one project.

A project groups applications, databases, buckets and domains, and gives them their own network. Each resource is the real thing: a container, a volume, a bucket, a certificate.

Everything on the platform

Applications

Push a directory. The platform works out how to build it.

Detection reads the files you actually shipped and never guesses: a project it cannot justify building is refused with the reason, and a development server is refused by name.

Detected runtime
  • DockerfileDockerfile at the root — used exactly as written
  • Next.jsnext in dependencies; standalone output when configured
  • Next.js (static export)output: "export" — served by Nginx
  • Static site (Vite)vite plus a build script
  • Static site (Create React App)react-scripts plus a build script
  • Node.js servicea start script that is not a dev server
  • Python (ASGI via uvicorn)FastAPI or uvicorn and a top-level app
  • Python (WSGI via gunicorn)Flask or gunicorn and a top-level app
  • Static siteindex.html at the root, nothing to build
  • Environment variables, with secrets masked and every reveal audited
  • Build logs and runtime logs from the running container
  • Health-check path for the readiness gate
  • Stop, restart, or roll back to an earlier deployment
  • Deploy a prebuilt image instead of source

Databases

A dedicated engine per database, not a shared server.

Each instance runs in its own container with its own volume and generated credentials, encrypted at rest and reachable only on the project’s network.

  • PostgreSQL
  • MySQL
  • MariaDB
  • Redis
  • MongoDB

Storage

Buckets that never proxy a file through the API.

Private or public-read buckets on an S3-compatible object store, with presigned upload and download URLs so bytes move straight between the browser and storage.

Domains & SSL

Prove the domain, then the certificate follows.

A TXT record proves ownership. Once DNS resolves to the platform, a Let’s Encrypt certificate is issued and renewed for you, with optional edge caching and purge.

Platform services

Building blocks your application calls.

Email
Verified sending domains with DKIM signing, delivered direct to the recipient's mail server, with a per-organization hourly quota.
Identity
OAuth 2.0 clients for your own applications, with client secrets stored only as hashes.
IoT
A device registry where each device authenticates with its own bearer token and reports telemetry.

Isolation & trust

Isolation enforced below your code, not promised above it.

Every project gets its own Docker network. Applications and databases in one project have no route to another project's — the only shared path in is the ingress.

The ingress reaches the application in each project network; the two project networks have no route to each other.ingress · nginxmeimo-project-aapppostgresmeimo-project-bappredisno route

  • Row-level security on every tenant table

    Tenancy is enforced by Postgres, underneath the application's own checks. The services connect as a role that owns nothing, and a query without an organization set returns nothing — never another tenant's rows.

    using ("organizationId" = current_org_id())

  • Host-only session cookies

    Customer applications share the platform's domain, so console sessions use host-only, __Host- prefixed cookies. A deployed app is never sent your session, and cannot plant one.

    __Host-access_token

  • Readiness-gated deploys

    A deploy is reported live only when the container is running, has not restarted, and answers on its port from the ingress — so a crash loop never shows green.

    restarts: 0 · port: open

  • An audit log written with the change

    Deployments, resource changes, membership and billing actions are recorded in the same transaction as the mutation — the action and its record land together, or not at all.

    BEGIN · change · audit · COMMIT

Developer experience

Deploy from a terminal, a script, or a git push.

Three ways in, one pipeline behind them. Every path ends at the same readiness gate and the same permanent URL.

CLI and API reference

  • CLI

    meimo, from any project directory

    Sign in once with an API token, pick a project, deploy. The CLI remembers the application for that directory, prints progress to stderr and only the URL to stdout — so scripts can capture it.

    terminal
    meimo login# paste a token from Account → API Tokensmeimo project use <project-slug>meimo deploy

  • API tokens

    Scoped tokens for scripts and CI

    Tokens start with meimo_pat_ so secret scanners can find them, carry read, write, deploy or storage scopes that narrow what your role allows, can expire, and are stored only as a hash.

    ci.sh
    echo "$MEIMO_TOKEN" | meimo login --stdinmeimo deploy --yes # or call the API directlycurl -H "Authorization: Bearer $MEIMO_TOKEN" \  https://api.meimocloud.com/api/v1/me

  • Git push

    Push to deploy from GitHub

    Install the GitHub App, link a repository and branch to an application, and each push to that branch clones the commit and runs it through the same pipeline.

    terminal
    git push origin main# the linked application builds and deploys this commit

Put something real on the internet today.

Create an organization, set up billing, open a project, and run meimo deploy. The first URL is a few minutes away.

Create your accountHow billing works