What’s running, down to the detail.

Your Node version, not ours

Node 18, 20 or 22, chosen from engines.node or .nvmrc. A version with no image is refused rather than built on the wrong runtime.

Refused by name

Development servers (next dev, vite, nodemon…), Bun and Deno projects, monorepo roots and Django without a Dockerfile are stopped with a message that names what triggered the refusal.

Environment variables

Secret values are masked, never written into an image layer, injected only at runtime, and every reveal is recorded in the audit log with the key — never the value.

Contained by default

Each container runs with memory, CPU and process limits, no-new-privileges, and on its project's network only.

Operate it

Runtime logs from the running container, stop and restart, a configurable health-check path, and a permanent hostname under apps.meimocloud.com.

Custom domains

Attach verified domains to an application; see Domains & SSL.

• PENDING
• BUILDING
• DEPLOYING
• SUCCESS
• FAILED
• ROLLED_BACK

Readiness gate

Success means the container is running, has not restarted, and its port accepted a connection from the ingress — optionally on your health-check path. What the gate proved is written into the build log.

One at a time

An application has at most one deployment in flight. A second request is refused with a clear message instead of racing the first.

Roll back

Re-run an earlier deployment's exact image — no rebuild, just a container replacement. Images from recent deployments are kept on the host for this.

Nothing left hanging

A reaper closes out deployments that stopped making progress, so a crashed worker cannot leave one building forever.

• PostgreSQL
• MySQL
• MariaDB
• Redis
• MongoDB

Credentials sealed at rest

Generated per instance and encrypted with AES-256-GCM; decrypted server-side only when the platform has to act on the instance.

Reachable only from the project

No host port is published. Your applications reach the instance over the project network; other projects have no route to it.

Lifecycle

Start and stop an instance, view its connection details, and reset its password from the console.

Metered while running

Instance hours count the time an instance is actually running, reconstructed from recorded status changes.

Private or public-read

Buckets are private by default. A public bucket gets a read-only policy for its objects — nothing more.

Presigned upload and download

Signed URLs for a single object, valid for between one minute and one day, for browser or server use.

Browse objects

List a bucket's objects page by page from the console.

Metered by real bytes

Storage is measured in GB-months from a scan of the objects actually stored.

1. 01

   Verify

   Publish the TXT record the console gives you.

2. 02

   Point

   Resolve the hostname to the platform's address.

3. 03

   Issue

   Let's Encrypt certificate issued, expiry tracked, renewed automatically.

Edge caching, honestly scoped

Optional Nginx caching and compression per domain, with a configurable TTL, purge, and hit metrics. It runs on the platform host — a cache in one region, not a multi-region CDN.

Application hostnames

Every application also gets a permanent name under apps.meimocloud.com, covered by a wildcard certificate — no setup required.

Email

Verified sending domains with DKIM signing, delivered direct to the recipient's mail server, with a per-organization hourly quota.

Identity

OAuth 2.0 clients for your own applications, with client secrets stored only as hashes.

IoT

A device registry where each device authenticates with its own bearer token and reports telemetry.

AI, Maps, SMS and Push have screens in the console, but no provider is connected to them yet. Requests to them are recorded as not configured rather than faked.

• Owner
• Administrator
• Developer
• Billing
• Support
• Read-only

Six roles, one matrix

Each role maps to a fixed set of permissions, checked on every request against the membership as it is now — a revoked role stops working immediately.

Project membership

Owners and administrators reach every project. Everyone else needs a membership on that specific project.

No self-promotion

Only an owner can grant or change the owner role, nobody can change their own role, and an organization always keeps at least one owner.

Environments

Projects are marked development, testing or production, so the environment is visible wherever the project is.

Scoped and filterable

Audit history is isolated per organization and browsable per project, filtered by category: auth, access, billing, resources, deployments and platform services.

Retained

Entries are kept for 400 days by default, then swept by a daily retention job.

meimo loginmeimo projects listmeimo project use <project-slug>meimo deploy

Scopes narrow, roles still apply

A token can do only what both its scopes and your role allow. No token can create another token, reach the operator surface, or reveal a secret environment variable.

Built to be found and revoked

Tokens begin with meimo_pat_ for secret scanners, can expire, are stored only as a hash, and are revoked from the console.

curl -H "Authorization: Bearer $MEIMO_TOKEN" \  https://api.meimocloud.com/api/v1/me# the signed-in account, and this token's name and scopes