On AWS, three web apps can involve a long list of services. ECS runs the containers. An ALB routes traffic. ACM issues certificates. Route 53 holds DNS records. RDS runs the database. S3 holds uploads. CloudWatch collects logs. IAM controls access. Secrets Manager holds passwords. ECR holds images. EventBridge runs scheduled work. CloudFormation describes the setup.
Each service solves a real problem. Together they can make a small setup hard to follow. Where does an uploaded file live? What changed last Tuesday? What breaks if you remove one part?
Running a few web apps should not take a specialist. FlatRun starts with one binary on one server. Each app is a directory with a docker-compose.yml in it. You can also connect servers through Fleet, scale suitable apps with Capacity, route traffic across replicas, and group related failures through Notifications.
Here is the map. Where FlatRun has no counterpart, the row says so.
Compute
| AWS | FlatRun |
|---|---|
| EC2 | Your server. Any Ubuntu or Debian box, installed with one command. |
| ECS, Fargate | A deployment: a directory with a compose file. Start, stop, restart, rebuild, pull, per service or all at once. |
| Elastic Beanstalk, App Runner | Templates for WordPress, Ghost, Laravel, Next.js, Astro, Node, PHP, Nextcloud, MinIO and static sites, or a deploy straight from a git repo. |
| ECS Exec | A shell in any container from the browser, and a terminal on the host itself. |
| Lambda | Nothing. The closest thing is a scheduled command inside a container. |
| Auto Scaling | Autoscaling for compatible stateless services through Docker Swarm or K3s. Policies set replica limits, resource thresholds, observation windows and cooldowns. Capacity can use another Fleet server only when its administrator grants CPU, memory and replica limits. |
Networking and certificates
| AWS | FlatRun |
|---|---|
| ALB, ELB | Nginx routes each domain to its deployment. Managed workloads can spread traffic across healthy replicas. K3s uses Traefik instead. |
| Route 53 | DNS you host with PowerDNS, or your zones at Cloudflare, Route 53, DigitalOcean or Hetzner through stored credentials. |
| ACM | Let’s Encrypt certificates per domain, issued on request and renewed on their own. |
| VPC, subnets, security groups | Docker networks. A web network for anything public, backend and database for the rest, and a service joins only what it needs. |
Generated hostnames like *.elb.amazonaws.com | Generated subdomains, so an app has a working URL before you own a domain. |
| CloudFront | Nothing. Put a CDN in front of it yourself if you need one. |
Storage and data
| AWS | FlatRun |
|---|---|
| S3 | Object stores. Run MinIO as a deployment and FlatRun creates the bucket, stores the keys, and lets you browse, upload, download and replicate objects between stores. |
| EBS | Directories. A volume is ./data next to the compose file, readable with ls. |
| EFS | A relative path shared between two deployments. |
| RDS | The database manager for MySQL, MariaDB and PostgreSQL: databases, users, grants, tables, and a query window. |
| ElastiCache | A Redis deployment from the infrastructure templates. |
| Glacier | Nothing separate. Backups keep a retention count and can live on any S3 compatible storage. |
Operations
| AWS | FlatRun |
|---|---|
| CloudWatch metrics | CPU, memory, disk and network per container, plus requests, errors and p95 latency per deployment, taken from the proxy’s own request log. |
| CloudWatch Logs | Live logs per deployment and per service, streamed to the browser. Each deployment declares where its logs are, including files inside a container. |
| CloudWatch dashboards | Built-in charts for host, container and request metrics. The same metrics are available through Prometheus and OTLP for an external dashboard. |
| CloudWatch Alarms | Alert rules with a threshold and a duration, so a container at 100% during startup does not wake you. A rule notifies, and can restart the deployment. |
| SNS | FlatRun Notifications groups related events into incidents. It sends opened, updated or resolved reports to selected email, chat and webhook targets. Rules can filter by topic, severity, server and deployment. |
| EventBridge Scheduler | Cron tasks: take a backup, run a command in a container, or run an agent. Every run keeps its output and exit status. |
| AWS Backup | Per deployment archives with database dumps included, on a schedule, with retention, restore and download. |
| Systems Manager Session Manager | The host terminal and container shells in the panel, both permission gated. |
| CloudTrail | An audit trail of who did what, filterable and exportable. |
| EC2 auto recovery | A health watcher that restarts an unhealthy container, with a cooldown so it cannot loop. |
| Managed Prometheus, OTLP ingest | Metrics on a Prometheus endpoint, and an OTLP push to any backend you already run. |
Access and safety
| AWS | FlatRun |
|---|---|
| IAM | Users with admin, operator or viewer roles, granular permissions, and access scoped to named deployments. API keys for automation. |
| WAF | Blocked IPs, protected paths and rate limits, per deployment or server wide, applied at the proxy. |
| Secrets Manager, KMS | A credential store for registries, S3, DNS and git. Files are locked down on disk but not encrypted yet, and app secrets still sit in plain .env files. |
| CloudFormation change sets | Plans. A change is shown to you as a plan and applied only when you approve it. |
| Termination protection | Protected mode. Destructive actions on a deployment need explicit confirmation. |
| Organizations, cross account console | Fleet. Link FlatRun servers, browse each server’s deployments from one panel and grant each peer only the actions it needs. Resource sharing stays off until an administrator enables it and sets limits. |
Developer workflow
| AWS | FlatRun |
|---|---|
| CodePipeline, CodeDeploy, Amplify | Deploy from a git repo, from the flatrun CLI, or from a GitHub Action. |
| ECR | Registry credentials for Docker Hub, GHCR, ECR and private registries. FlatRun stores the login, it does not host a registry. |
| CloudFormation, CDK | The compose file. It is the description, and it runs without FlatRun. |
| Bedrock Agents, Amazon Q | An assistant that reads a deployment’s logs and config, using your own model key, plus agents defined as markdown files and an MCP server for outside agents. |
What FlatRun does not do
FlatRun now manages replicas through Docker Swarm or K3s, but it is not a replacement for AWS across regions. These gaps remain:
- Multiple availability zones and automatic regional failover
- Autoscaling for stateful services or services that cannot run as interchangeable replicas
- A CDN or global edge
- Functions as a service
- An SLA
If you need those, AWS is the better fit. FlatRun keeps the smaller system understandable and leaves the limits visible.
Others are gaps we are working on:
| Gap | Where it is going |
|---|---|
Secrets in plain .env files | Encrypted at rest secret handling |
| Backup archives unencrypted | Encryption on backup archives |
| DNS records added by hand for a new app | DNS records created with the deployment |
| Deploys triggered from the panel or CI only | Webhook triggers, deploy on push, rollback to a previous commit |
| Agents run when you run them | Agents on a schedule or a webhook, and runs that park and wake on events |
| One local account store | LDAP and single sign on |
| No mail | A mail server template with the DNS records generated for it |
| CPU and memory limits, but no disk quota | Disk quotas and bandwidth accounting |
What AWS has no row for
The map runs both ways, and this is the half that made us build FlatRun.
The compose file, service config, environment files and mounted data stay as files on your server. FlatRun also keeps its own state on that server. You do not need a hosted control plane to read it.
For a normal Compose deployment, moving starts with copying its directory. Run docker compose up -d on the new server.
You can stop the FlatRun agent without stopping the containers it already started. The apps remain Compose projects, so there is no special export format.
The control plane remains one agent and a browser interface.
When to stay on AWS
Stay if you need multiple regions, if an hour of downtime during a server rebuild costs real money, or if a compliance auditor wants a managed provider’s certification. Stay if your workload cannot meet FlatRun’s safety checks for scaling. FlatRun does not compete for that work.
If your apps do not need those guarantees, a smaller system may be easier to run.
Try it on one app
Install FlatRun on one small server, move one app, and keep your AWS account exactly as it is. You will know inside an afternoon whether the whole system fits in your head again.
curl -fsSL https://raw.githubusercontent.com/flatrun/installer/main/scripts/install.sh | sudo bashThen open the dashboard and deploy something. If a row is wrong or missing, open an issue and tell us. The map is useful only while it stays honest.