Features Reference

Every built-in feature, organized by area.

Core

Private Mesh Network - WireGuard VPN between all servers. Encrypted by default.
Automatic DNS - Built-in .jiji DNS resolution. Access services by name.
Health-Gated Rollouts - For rolling services, the old version keeps serving until the new one passes its health check. stop_first services use a brief stop-then-start window instead; a service with a fixed host-port binding needs stop_first for the same reason, or its deploys fail outright instead of degrading gracefully.
Runtime Agnostic - Docker or Podman. Same config, your choice.
Multi-server - Independent services deploy concurrently. A service replaces its selected replicas in sequence, with a health gate for each replacement.
Multi-project - Run multiple apps on one server with isolated project networks and a shared per-host ingress proxy.
Scheduled Jobs - Run service commands on cron schedules in isolated one-off containers.

Auto SSL/TLS - Issue and renew HTTPS certificates for configured domains through jiji-proxy.
Path-based Routing - Route traffic based on URL path prefix to different services.
Cross-host Load Balancing - jiji-proxy discovers every healthy replica of a service across the whole server mesh, not just ones on the same host.
Wildcard Domains - Support for single-level wildcard domain matching like *.example.com.
Multi-port Services - Route multiple ports on a single service to different domains.
Raw TCP Proxying - Publish non-HTTP services on dedicated TCP ports with mesh-wide backend discovery.
HTTP Health Checks - Health checking via HTTP endpoints with configurable paths.
Command Health Checks - Custom shell commands for health verification.
Health Check Timing - Configurable intervals, timeouts, and deploy timeouts.

Multi-stage Builds - Support Docker multi-stage builds with target specification.
Custom Dockerfile - Specify a non-standard Dockerfile path for builds.
Build Arguments - Pass build-time arguments (ARGs) to Docker.
Remote Builds - Execute builds on remote SSH hosts for faster CI/CD.
Build Cache - Control whether to use Docker layer cache for builds.
Build Secrets - Mount tokens and credentials into a build via --secret instead of --build-arg, so they never land in image layers or metadata.

Resource Limits - CPU, memory, GPU limits. Device mapping support.
Privileged Mode - Run containers with extended privileges when needed.
Linux Capabilities - Add specific capabilities like SYS_ADMIN, NET_ADMIN.
Device Mappings - Mount host devices into containers (/dev/video0, /dev/snd).
Named Volumes - Use Docker named volumes instead of host paths.
File & Directory Mounts - Mount files and directories with fine-grained permissions.
Custom Commands - Override container ENTRYPOINT/CMD as needed.
Restart Policy - Configure restart behavior: unless-stopped, always, on-failure, no.
Project Bridge Networking - Give each deployment a dynamic address on the project bridge.
Container Namespace Sharing - Share another service’s network stack (network_mode: service:<name>) for VPN killswitch patterns. Redeploying the upstream automatically redeploys its dependents.
Host Networking - Run a service on the host’s own network namespace (network_mode: host) instead of the project bridge, for containers that need direct host-level ports.

Rolling Deployments - Replace compatible services without downtime, then clean up the old container.
Stop-First Mode - For stateful services like SQLite - stop old before starting new.
Fail-Safe Health Checks - A failed candidate is discarded; the previous version is never touched.
Image Retention - Control how many images to keep per service.
Deployment Locks - Prevent conflicting concurrent mutations with scoped, team-safe locks.
Service Filtering - Deploy specific services by name patterns.

SSH Jump Host - Connect through bastion/intermediate hosts via SSH proxy.
Multiple SSH Keys - Support multiple SSH keys for authentication.
Key Passphrase - Support encrypted SSH keys with passphrases.
SSH Config Support - Use system SSH config (~/.ssh/config).
Bounded Concurrency - Run SSH operations across many hosts without overwhelming any one connection limit.
Interactive Remote Execution - Run a command with a PTY on one selected server via jiji server exec.

Custom Network CIDR - Configure management and container IP ranges per project.
Network Plan Preview - See interfaces, ports, subnets, and infrastructure addresses before touching a server.
Per-Replica DNS Records - Resolve every replica together, or reach one server directly.
External DNS Forwarding - Service containers resolve normal internet hostnames too, forwarded to configurable resolvers (default public DNS).
Clean Teardown - Remove a project’s network, containers, and routes in one command.
Multi-Project Isolation - Each project has its own mesh, bridge, DNS, catalog, and agent state; jiji-proxy is shared per host.
Backup, Restore & Recovery - Export an encrypted control-plane backup and restore it into surviving hosts, or recover into a new fenced epoch after losing hosts.

Registry Support - Local registry, GHCR, Docker Hub, ECR, GCP Artifact Registry, or any custom registry.
Registry Login - Authenticate to remote container registries.
Local Registry Tunneling - Automatic SSH reverse tunnels let remote servers pull from your local build.

Multi-host Log Access - Fetch and filter service logs across selected hosts from one command.
Log Grep - Filter logs by pattern with grep options.
Time-based Filtering - Show logs since timestamp or relative time.
Log Follow Mode - Stream logs in real-time like tail -f.
Audit Trail - Best-effort, per-server operation history with filtering.
Deployment Timing - Timed audit entries record how long the operation took. Older or manually created entries can omit timing.

Cron Ownership - Assign each scheduled job to one active and healthy service replica.
Cron Status and Logs - Inspect durable run state and read output from retained run containers.
Manual Cron Runs - Start a configured job immediately without changing its next scheduled time.
Remote Execution - Run commands across servers in parallel or sequential, or drop into an interactive shell.
Service Restart - Restart services without full redeployment.
Service Removal - Clean removal with network unregistration.
Image Pruning - Explicitly remove old build-produced images with configurable per-service retention.
Server Teardown - Clean server removal from cluster.
Server Upgrade - Bring jiji-agent and jiji-proxy on each server in line with the installed jiji CLI, per host and per component, without downgrading.
Auto-install Engine - Install Docker/Podman automatically on servers.
Architecture Support - Explicitly set server architecture (amd64/arm64).