Transparent, self-hosted incident operations.
From alert ingestion and on-call routing through response, customer communication, and learning.
Paging reliability — delayed escalations remain delayed, orphaned work is recovered safely, and notification routes avoid duplicate delivery.
Operational confidence — the administrator Health Center consolidates supported runtime checks, while the release contract validates installation, upgrades, recovery, incident delivery, deployment rendering, and stable AMD64/ARM64 images.
Release notes · Integrations · Changelog
v1.2 added Slack ChatOps incident war rooms — setup guide.
- Why OpsKnight?
- Demo
- Key Features
- Mobile Command Center
- Integrations
- Built With
- Quick Start
- Container Images
- Deployment Options
- Architecture
- Documentation
- Security
- Roadmap
- Community & Support
- Support the Project
Own the incident loop, the operational evidence, and the data.
OpsKnight is an open-source, self-hosted alternative to per-seat on-call SaaS (including PagerDuty and Opsgenie). It is not affiliated with those companies. Designed for teams that want incident data on their own machines.
Whether you are an SRE team at a startup or a platform team at a larger organization, OpsKnight connects detect → route → respond → communicate → learn on infrastructure you control. Reliability and transparent operational evidence—not raw feature count—are the product contract.
| Feature | OpsKnight | Typical per-seat SaaS |
|---|---|---|
| Hosting | Self-hosted | Vendor cloud |
| Software fee | $0 (Apache-2.0) | Per-user plans |
| Users | No seat meter in the product | Per-seat pricing |
| Status pages | One page per install | Often a separate SKU |
| Voice paging | Not included | Often included |
| Incident data | Your Postgres / VPC | Vendor cloud |
|
Manage incidents, responders, and runbooks from a single real-time dashboard. Track SLAs (MTTA/MTTR) and automate assignments. |
Flexible scheduling with daily, weekly, or custom rotations. Handle time zones, overrides, and escalation policies with ease. |
|
Multi-channel notifications via Slack ChatOps, SMS, Email, and Push. Automatic Slack Incident War Rooms with 1-click triage actions. |
Full incident management in your pocket. Installable on iOS/Android with Push Notifications and biometric security. |
|
Keep your users informed with beautiful public status pages. Automate updates and subscriber notifications during incidents. |
Native parsers for Prometheus, Datadog, Sentry, CloudWatch, Grafana, Zabbix, GitLab, Vercel, Jira Cloud sync, and Events API v2 ingest. |
Respond to incidents from anywhere. OpsKnight includes a fully installable Progressive Web App (PWA) for iOS and Android.
- 🔔 Push Notifications: Get critical alerts instantly on your device.
- 👆 One-Tap Install: No App Store required. Just "Add to Home Screen".
- 🔒 Secure: Supports biometric authentication (FaceID/TouchID).
OpsKnight plays nicely with your entire observability and engineering stack.
OpsKnight is built on a modern, type-safe stack designed for performance and developer experience.
- Docker & Docker Compose
- Git
openssl(ships with macOS and most Linux distributions)
# 1. Clone the repository
git clone https://github.com/opsknight-labs/OpsKnight.git
cd OpsKnight
# 2. Create your environment file
cp env.example .env
# 3. Generate the two secrets OpsKnight requires
printf 'NEXTAUTH_SECRET=%s\n' "$(openssl rand -base64 32)" >> .env
printf 'ENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" >> .env
# 4. Start OpsKnight and PostgreSQL
docker compose up -dOpen http://localhost:3000. The database schema is created on first boot, so there is no migration step to run yourself.
ENCRYPTION_KEY encrypts integration credentials at rest — keep it safe and
back it up. Losing it means re-entering every integration secret.
Before exposing this to a network, change the default PostgreSQL password in
.envand setNEXTAUTH_URL/NEXT_PUBLIC_APP_URLto your real hostname.
To run the published image against your own PostgreSQL, rather than the bundled one:
docker run -d --name opsknight -p 3000:3000 \
-e DATABASE_URL="postgresql://user:password@your-db-host:5432/opsknight" \
-e NEXTAUTH_URL="https://opsknight.example.com" \
-e NEXT_PUBLIC_APP_URL="https://opsknight.example.com" \
-e NEXTAUTH_SECRET="$(openssl rand -base64 32)" \
-e ENCRYPTION_KEY="$(openssl rand -hex 32)" \
ghcr.io/opsknight-labs/opsknight:latestPostgreSQL 14+ is required. See the deployment guides for TLS, connection pooling and scaling.
Images are published to the GitHub Container Registry and are public — no authentication needed to pull.
| Image | Channel | Tags |
|---|---|---|
ghcr.io/opsknight-labs/opsknight |
Stable releases | 1.4.0, 1.4, 1, latest |
ghcr.io/opsknight-labs/opsknight-test |
Pre-release, built from main |
latest, sha-<commit> |
# Pin a release — recommended for production
docker pull ghcr.io/opsknight-labs/opsknight:1.4.0
# Or track the latest stable release
docker pull ghcr.io/opsknight-labs/opsknight:latestPinning an exact version is strongly preferred in production: latest moves
whenever a release ships, so a container restart can change versions underneath you.
Browse all published versions →
We support multiple deployment strategies to fit your infrastructure needs.
| Method | Best For | Guide |
|---|---|---|
 Docker Compose |
Local Development, small teams | Read Guide |
 Helm Chart |
Production Kubernetes (Recommended) | Read Guide |
 Kustomize |
GitOps (ArgoCD/Flux) | Read Guide |
Note: For production, we recommend using an external managed PostgreSQL database.
OpsKnight runs as a single Next.js application (UI + API routes + server actions) with an internal DB-backed scheduler and a Postgres-backed job queue.
High-level architecture: clients → app (Next.js) → PostgreSQL (Prisma) → outbound channels.
- Full details: Architecture docs
Everything you need to configure and extend OpsKnight.
- Hosted Documentation (Recommended)
- In-Repo Guides (v1.5):
OpsKnight handles on-call rotations, integration credentials and incident data, so security is treated as a first-class concern:
- Integration secrets are encrypted at rest with envelope encryption, keyed by
ENCRYPTION_KEY - Inbound webhooks and Slack requests are signature-verified and rejected when they cannot be verified — there is no fail-open path
- Every push is scanned by CodeQL, Trivy, TruffleHog, Checkov and OWASP ZAP in CI
- RBAC governs incident, service and schedule access
Found a vulnerability? Please do not open a public issue — see SECURITY.md for private disclosure.
Hardening guidance: Security documentation
We are preparing Version 1.4.0 (August 2026)! 🚀
- Core Incident Management & On-Call Schedules
- Slack ChatOps Incident War Rooms & Interactive Cards
- Native inbound parsers (catalog size in docs; includes Events API v2 ingest, GitLab, Vercel, Nagios, Icinga, Datadog, Prometheus, etc.)
- Forensic Webhook Ingestion Security & Mandatory Key Authentication
- Master Encryption Key Architecture (12-Factor Security)
- Tier-2 SLA Engine Hardening & Custom Business Hours
- Jira Cloud Bi-Directional Synchronization & Real-Time Note Sync
- Public Status Pages with Subscriber Notifications
- Mobile PWA with Biometric Security & Push Notifications
- Administrator Health Center & Release-Quality Contract
- Reliable Delayed Escalation Recovery & Multi-Architecture Releases
See the full ROADMAP.md
We are actively seeking contributors! Whether you're a developer, designer, or technical writer, come help us build OpsKnight.
We love contributors! Please check our Contributing Guide to get started.
OpsKnight is an independent open-source project. If it helps you sleep better at night, consider supporting its development.
- 🌟 Star the repo: It helps others find us.
- 💝 Sponsor: Become a Sponsor
Built with ❤️ by Dushyant Rahangdale
