An app and its database.
One push, one platform.
Deploy from a git URL, provision a dedicated PostgreSQL 16 microVM, and wire the two together with a single encrypted secret. The connection string is TLS-required end to end, deploys flip blue-green behind a health check, and both halves sleep to $0 when nobody is looking.
The whole stack in four calls.
Create the database, create the app, inject the connection string as a secret, deploy. Every step is a plain REST call — the same flow works from the CLI, the Python SDK, or the TypeScript SDK, and there is no YAML fleet to keep in sync with reality.
The credential is the wiring
Read the database's connection_url, set it on the app as a secret — encrypted at rest, masked on read, redacted from build logs. Nothing is injected automatically except PORT and HOST, so your code reads the same env vars it reads everywhere else. TLS is mandatory: a client that connects in plaintext is refused outright.
API=https://api.pandastack.ai/v1
AUTH=(-H "Authorization: Bearer $PANDASTACK_API_KEY" \
-H "Content-Type: application/json")
# 1. a dedicated PostgreSQL 16 microVM
curl -X POST "$API/databases" "${AUTH[@]}" \
-d '{"label":"my-app-db","size":"1g"}'
# 2. the app, straight from git — migrations run in the build
curl -X POST "$API/apps" "${AUTH[@]}" -d '{
"name":"my-app",
"git_url":"https://github.com/me/my-app",
"git_branch":"main",
"port":3000,
"build_command":"npm run build && npx prisma migrate deploy"}'
# 3. the connection string, as an encrypted production secret
curl -X PUT "$API/apps/$APP_ID/env/DATABASE_URL" "${AUTH[@]}" \
-d '{"value":"'$DB_URL'?sslmode=require",
"secret":true,"scope":"production"}'
# 4. ship it
curl -X POST "$API/apps/$APP_ID/deploys" "${AUTH[@]}" -d '{}'Deploys that fail closed, not down.
Every deploy builds in a fresh sandbox next to the one serving traffic. Your build command runs with env and secrets already loaded — put the migration there — then the app is started and health-checked before a single request moves. Only a passing check flips traffic; the old sandbox is torn down after.
Blue-green flip
The pipeline clones your ref, installs runtimes with mise, builds, starts the app, and health-checks its port. Traffic flips atomically once the new sandbox answers.
Migrations in the build
No separate release hook — chain the migration onto the build command. Prisma, Drizzle, Django, Alembic, or plain psql: it runs before the flip, with the secret loaded.
Failure keeps you up
A failed migration fails the deploy: the flip never happens and traffic keeps going to the previous, working sandbox. Fix it and redeploy — users never saw a thing.
Both halves sleep. Both halves wake.
The app scales to zero between requests, and a database with no live connections suspends its compute independently. Each side wakes on its own trigger — a request for the app, a connection for the database — which is what makes a per-branch or low-traffic stack cheap instead of a standing bill.
Independent sleep
App and database suspend on their own schedules. A quiet marketing site with a busy database — or the reverse — only pays for the half that's actually awake.
Wake on demand
The next HTTP request wakes the app; the next connection wakes the database. No cron pings, no keep-warm hacks, no orchestration to write.
always_on when it matters
Workloads that can't pay a resume on the first query opt out per database with always_on: true — one PATCH, set at creation or any time after.
One platform, not three dashboards.
The usual full-stack setup is an app host, a database vendor, and a secrets manager — three accounts, three bills, and credentials copy-pasted between tabs. Here both halves live behind one API and one bill.
| PandaStack | three vendors wired together | |
|---|---|---|
| Provisioning | one API, one flow | app host + DB vendor + secrets manager |
| Credentials | encrypted secret, set once, redacted from logs | copy-pasted between dashboards |
| Transport | TLS required — plaintext refused | often optional, easy to misconfigure |
| Idle cost | $0 — both halves sleep | always-on line items on every bill |
| Data safety net | clone & point-in-time restore built in | an add-on tier, another invoice |
Two primitives, already yours.
Full-stack hosting is not a separate product — it's apps and managed databases composed. Everything each primitive can do, the pair can do together.
Ship on the millisecond cloud.
Free tier with $5.40/mo usage credit. No card. Apache-2.0.