The Open Source Incident Command Center.
Your entire incident lifecycle, on-call schedules, and status pages in one powerful platform.
Six new native integrations — Zabbix, PagerDuty Events API v2 (drop-in compatible), GitLab CI/CD, Vercel, Nagios Core & XI, and Icinga 2, each with severity mapping and automatic resolution on recovery.
Hardened alert ingestion — mandatory integration-key verification and timing-safe HMAC checks across all 24 webhook routes, so unverified alerts are rejected rather than trusted.
Release notes · Integrations · Changelog
v1.2 added Slack ChatOps incident war rooms — setup guide.
- Why OpsKnight?
- Demo
- Key Features
- Mobile Command Center
- Integrations
- Built With
- Quick Start
- Container Images
- Deployment Options
- Architecture
- Documentation
- Security
- Roadmap
- Community & Support
- Support the Project
Stop paying per-seat for reliability.
OpsKnight is the open-source alternative to PagerDuty and OpsGenie, designed for teams that want full control over their incident management stack without the massive SaaS bill. From the first alert to the final post-mortem, OpsKnight unifies your entire reliability workflow into a single, cohesive developer experience.
Whether you are an SRE team at a startup maintaining 99.99% uptime or a Platform Engineer at a large enterprise, OpsKnight gives you the tools to detect, respond, and resolve faster.
| Feature | OpsKnight 🛡️ | Proprietary SaaS 💸 |
|---|---|---|
| Hosting | Self-Hosted / Private Cloud | Public Cloud Only |
| Cost | Free (Open Source) | $20-$100 / user / month |
| Users | Unlimited | Per-Seat Pricing |
| Status Pages | Included (Unlimited) | Extra Cost |
| Custom Branding | ✅ Full Control | ❌ Limited |
| Data Privacy | ✅ 100% Owned by You | ❌ Third-Party Processed |
|
Manage incidents, responders, and runbooks from a single real-time dashboard. Track SLAs (MTTA/MTTR) and automate assignments. |
Flexible scheduling with daily, weekly, or custom rotations. Handle time zones, overrides, and escalation policies with ease. |
|
Multi-channel notifications via Slack ChatOps, SMS, Email, and Push. Automatic Slack Incident War Rooms with 1-click triage actions. |
Full incident management in your pocket. Installable on iOS/Android with Push Notifications and biometric security. |
|
Keep your users informed with beautiful public status pages. Automate updates and subscriber notifications during incidents. |
Native parsers for Prometheus, Datadog, Sentry, CloudWatch, Grafana, Zabbix, PagerDuty, GitLab, Vercel, and Jira Cloud bi-directional sync. |
Respond to incidents from anywhere. OpsKnight includes a fully installable Progressive Web App (PWA) for iOS and Android.
- 🔔 Push Notifications: Get critical alerts instantly on your device.
- 👆 One-Tap Install: No App Store required. Just "Add to Home Screen".
- 🔒 Secure: Supports biometric authentication (FaceID/TouchID).
OpsKnight plays nicely with your entire observability and engineering stack.
OpsKnight is built on a modern, type-safe stack designed for performance and developer experience.
- Docker & Docker Compose
- Git
openssl(ships with macOS and most Linux distributions)
# 1. Clone the repository
git clone https://github.com/opsknight-labs/OpsKnight.git
cd OpsKnight
# 2. Create your environment file
cp env.example .env
# 3. Generate the two secrets OpsKnight requires
printf 'NEXTAUTH_SECRET=%s\n' "$(openssl rand -base64 32)" >> .env
printf 'ENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" >> .env
# 4. Start OpsKnight and PostgreSQL
docker compose up -dOpen http://localhost:3000. The database schema is created on first boot, so there is no migration step to run yourself.
ENCRYPTION_KEY encrypts integration credentials at rest — keep it safe and
back it up. Losing it means re-entering every integration secret.
Before exposing this to a network, change the default PostgreSQL password in
.envand setNEXTAUTH_URL/NEXT_PUBLIC_APP_URLto your real hostname.
To run the published image against your own PostgreSQL, rather than the bundled one:
docker run -d --name opsknight -p 3000:3000 \
-e DATABASE_URL="postgresql://user:password@your-db-host:5432/opsknight" \
-e NEXTAUTH_URL="https://opsknight.example.com" \
-e NEXT_PUBLIC_APP_URL="https://opsknight.example.com" \
-e NEXTAUTH_SECRET="$(openssl rand -base64 32)" \
-e ENCRYPTION_KEY="$(openssl rand -hex 32)" \
ghcr.io/opsknight-labs/opsknight:latestPostgreSQL 14+ is required. See the deployment guides for TLS, connection pooling and scaling.
Images are published to the GitHub Container Registry and are public — no authentication needed to pull.
| Image | Channel | Tags |
|---|---|---|
ghcr.io/opsknight-labs/opsknight |
Stable releases | 1.3.1, 1.3, 1, latest |
ghcr.io/opsknight-labs/opsknight-test |
Pre-release, built from main |
latest, sha-<commit> |
# Pin a release — recommended for production
docker pull ghcr.io/opsknight-labs/opsknight:1.3.1
# Or track the latest stable release
docker pull ghcr.io/opsknight-labs/opsknight:latestPinning an exact version is strongly preferred in production: latest moves
whenever a release ships, so a container restart can change versions underneath you.
Browse all published versions →
We support multiple deployment strategies to fit your infrastructure needs.
| Method | Best For | Guide |
|---|---|---|
 Docker Compose |
Local Development, small teams | Read Guide |
 Helm Chart |
Production Kubernetes (Recommended) | Read Guide |
 Kustomize |
GitOps (ArgoCD/Flux) | Read Guide |
Note: For production, we recommend using an external managed PostgreSQL database.
OpsKnight runs as a single Next.js application (UI + API routes + server actions) with an internal DB-backed scheduler and a Postgres-backed job queue.
High-level architecture: clients → app (Next.js) → PostgreSQL (Prisma) → outbound channels.
- Full details: Architecture docs
Everything you need to configure and extend OpsKnight.
- Hosted Documentation (Recommended)
- In-Repo Guides (v1.2):
OpsKnight handles on-call rotations, integration credentials and incident data, so security is treated as a first-class concern:
- Integration secrets are encrypted at rest with envelope encryption, keyed by
ENCRYPTION_KEY - Inbound webhooks and Slack requests are signature-verified and rejected when they cannot be verified — there is no fail-open path
- Every push is scanned by CodeQL, Trivy, TruffleHog, Checkov and OWASP ZAP in CI
- RBAC governs incident, service and schedule access
Found a vulnerability? Please do not open a public issue — see SECURITY.md for private disclosure.
Hardening guidance: Security documentation
We are proud to announce Version 1.3.1 (August 2026)! 🚀
- Core Incident Management & On-Call Schedules
- Slack ChatOps Incident War Rooms & Interactive Cards
- 24+ Native APM/Monitoring Integrations (Zabbix, PagerDuty v2, GitLab, Vercel, Nagios, Icinga, Datadog, Prometheus, etc.)
- Forensic Webhook Ingestion Security & Mandatory Key Authentication
- Master Encryption Key Architecture (12-Factor Security)
- Tier-2 SLA Engine Hardening & Custom Business Hours
- Jira Cloud Bi-Directional Synchronization & Real-Time Note Sync
- Public Status Pages with Subscriber Notifications
- Mobile PWA with Biometric Security & Push Notifications
See the full ROADMAP.md
We are actively seeking contributors! Whether you're a developer, designer, or technical writer, come help us build OpsKnight.
We love contributors! Please check our Contributing Guide to get started.
OpsKnight is an independent open-source project. If it helps you sleep better at night, consider supporting its development.
- 🌟 Star the repo: It helps others find us.
- 💝 Sponsor: Become a Sponsor
Built with ❤️ by Dushyant Rahangdale
