Autopilot, with Polish inside
The cleanup you would do by hand. Run for you, with proof.
Polish reads a server, writes a plan, then works through it one step at a time. Each step checks before it acts, proves it worked afterwards, and puts things back if it did not. It stops at the first failure.
€24.99 a month or €199.99 a year, everything in Pro included. Reading the plan is free.
What Autopilot does, step by step
-
01
polish_plan web-1First it reads. Nothing moves.
Polish reads the server and sorts what it found: what it would run, and what needs you. Reading is free on every plan, so you can see the whole plan before you pay for anything.
Polish plan for web-1
2 needs you · 5 would run
Needs you · 2
Pin floating image tagsThe tag lives in your compose file or Coolify, so this one is yours.Install updates and rebootPolish always asks before a reboot.Would run · 5
Back up databases and prove itRefresh old imagesRebuild apps built on this serverClose ports open to the outsideMove to key-only SSHReading changes nothing.
-
02
dump → size → last line → tablesBackups are read back before anything changes.
Each database is dumped, then the dump’s size, its last line and its table count are checked against the live database. A backup only counts once it is proved, and nothing else runs until it is.
Back up databases and prove itPostgreSQL · shop-db is backed up and proven.- Dump shop-db
48.2 MB - Ending line present
-- PostgreSQL database dump complete - Tables
12 in the dump · 12 in the database
Nothing is changed in the databases, and the dumps stay on the server.
- Dump shop-db
-
03
pull → recreate → healthy?Old images come back if the new one fails.
A newer image is pulled, compared and started, then the packages inside it are read. If it does not come up healthy, the old one runs again by itself. If the new image has no fix yet, the step waits and checks again later.
Refresh old images
nowpostgres:18-alpinebuilt 301 days agonewpostgres:18-alpinebuilt 6 days ago- Pull and compare
- Recreate shop-db
- Healthy and answering
shop-db runs the new image and stays up.
Had it failed, the old image would run again by itself.
-
04
data survives → deploy → it answersApps built on the server are rebuilt, one at a time.
Images built on the server cannot be pulled, so Polish rebuilds them in Coolify: it checks the app’s data survives a rebuild, deploys, then proves the app runs and answers. It stops at the first one that fails.
Coolify on web-1
Redeploys check the data first and prove the result after.
shopapplication · https://shop.example.com- Its data survives a rebuild
- Rebuild from scratch and deploy
- Runs and answers
https://shop.example.com → 200
The next app starts only after this one is proved.
-
05
block 8787 · 443 still answersPorts are closed, then checked again.
Ports that answer from the internet are blocked in Docker’s firewall chain with safe mode armed. Then the sites are checked again. If a port that answered before stops answering, the block is undone at once.
Ports open to the outside · web-1
8787shopanswers from outsideblocked443webanswersstill answers80webanswersstill answers
Blocked 8787 from the internet in Docker’s firewall. The sites still answer.
-
06
0 password logins · fresh key loginSSH goes key-only, only when it is safe.
Only after the login log shows nobody still uses a password. Passwords are turned off in safe mode, a brand-new key login is tried, and if it fails the server rolls itself back. On a server marked shared, SSH is never touched.
Safe modeRolls back by itself unless a new login works300 s- Password logins in the log
none - Rollback armed on the server
- Passwords off
PasswordAuthentication no - Fresh key login, new connection
- Rollback cancelled
Passwords are off. Only keys can log in now.
- Password logins in the log
-
07
28 updates · 0 sessions · Reboot?Updates go in. The reboot is always yours.
Polish installs the waiting updates, then shows who is on the server and asks before it reboots. It never picks a reboot time for you. Afterwards it checks that everything came back.
Install updatesInstalled the updates and everything is still running.A reboot is needed to finish the updates.On the server now: 0 interactive session(s) open, last login from another address 214 minute(s) ago.
CancelReboot
-
08
polish_status · polish_note · polish_pause · polish_abortYour AI agent watches. Only you resume.
Claude Code, Codex or Cursor can follow the run over MCP: read its status, leave notes, pause it or abort it. There is no tool to start, resume, approve or skip a step, so an agent can stop a run but never push one on.
Your agent · Stenvakt MCP
› polish_status web-1
Polish run on web-1: running
› polish_pause web-1
Paused before “Move to key-only SSH”. Waiting for you to resume or abort.
› polish_resume web-1
No such tool. Only you resume, in the app.
What it never does
- Delete data. No volume, database or backup is removed by any step.
- Reboot without asking. It shows who is logged in and waits for you.
- Carry on after a failure. The first step that fails stops the run.
- Hand your secrets to an agent. Keys and tokens never reach it, and Coolify tokens stay in your Keychain.
The run above is drawn from the app’s own screens and wording, with a made-up server.
Let it run the next one.
Autopilot is everything in Pro, plus Polish. €24.99 a month or €199.99 a year, 14 days free. Cancel any time from your account’s billing page.