Cosmos Server

Last reviewed Sep 13, 2026 · 823 words

Cosmos Server is filed under dashboards, but treating it as one is how people get into trouble. It is a control plane: it takes ownership of ports 80 and 443, terminates TLS, provides an OpenID login for every app behind it, installs apps from a marketplace through the Docker socket, and shows you the result on a dashboard. Bring it into a homelab that already has nginx-proxy-manager or Caddy holding those ports and one of them has to go. Install it on a fresh box and it is the fastest route I know from bare Docker to "10 apps behind HTTPS with single sign-on".

One container, but it needs the keys to the kingdom

services:
  cosmos:
    image: azukaar/cosmos-server:latest
    network_mode: host
    privileged: true
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/lib/cosmos:/config
      - /:/mnt/host
    restart: unless-stopped

Host networking, a privileged flag, the Docker socket and the root filesystem mounted read-write: that is the recommended install, and it is worth pausing on. Cosmos needs the socket to install and manage other containers, host networking so it can hold 80 and 443 and forward to anything, and the host mount for its storage and disk-management features. The trade is explicit: this is an all-in-one platform with root-equivalent access, not a sandboxed dashboard tile. The project is Apache-2.0 and written in Go, so the code is inspectable, but the trust model is the same as CasaOS or a hypervisor: you are choosing a manager, not a widget.

The reverse proxy and SSO are the actual product

Every app you install or import gets a URL entry in the proxy, a Let's Encrypt certificate if the domain resolves, and an optional "require login" toggle that puts Cosmos's own OpenID provider in front of it. Apps that speak OpenID Connect, which is most modern self-hosted software, can use Cosmos as their identity provider directly, so a single account logs you into everything. The SmartShield layer adds rate limiting and blocks bursty clients per route, and the Constellation feature builds a WireGuard overlay so devices outside your LAN reach the apps without port forwarding. Assembling that stack by hand means Authentik or Authelia, a proxy, a VPN, and a weekend; the SSO comparison shows how much wiring that is. Cosmos ships it wired.

The app store is convenient and the reason it is opinionated

The marketplace is a curated list of compose-style templates. Click, set a few fields, and the container comes up already registered with the proxy and the dashboard. It is genuinely one-click and it is genuinely limiting: templates use the project's conventions for volumes and networks, and importing an existing compose file works but sometimes needs edits to fit. If you like writing your own compose files and keeping them in git, the usual compose-in-git workflow is a workflow Cosmos partly replaces, and you will fight it at the edges. Existing containers on the host are detected and can be added to the dashboard and proxy, so migration is additive rather than a rebuild.

When something lighter is the right call

Three cases. You already run a proxy and identity provider you understand: keep them and add Homepage, which is a dashboard and nothing more. You want the app-store experience without a proxy takeover: CasaOS and Runtipi both sit at a similar difficulty and are the bigger projects, with more templates and larger communities, though neither bundles SSO. You are on a machine with 1 GB of RAM total: Cosmos at 512 MB is heavier than any plain dashboard and the marketplace apps add up fast.

Backups and the migration story

Everything Cosmos knows lives under /var/lib/cosmos: the proxy routes, user accounts, certificates and marketplace state. Back that directory up and the platform can be rebuilt on a new host in minutes. The apps it installed are ordinary containers with ordinary volumes, so their data is wherever the template put it, usually under a Cosmos-managed path on the host mount. Nothing is locked in a proprietary format, and turning Cosmos off leaves the containers running; you would just be back to managing ports yourself.

What I'd do

On a fresh mini PC for someone who wants HTTPS, one login and a nice dashboard without learning three tools, install Cosmos, point a domain at it, and use the marketplace for the first five apps. It does the job with less to learn than any equivalent assembly. On an existing homelab with a working proxy, do not migrate to it; add Homepage for the dashboard and keep what already works. And if the app-store part is what appeals and SSO is not, CasaOS is the larger, more battle-tested pick in the dashboards category.