Coolify vs Rivet

Coolify has published the first release candidate for v4.4, its first entry since late April — a four-month gap in a feed that had been running on near-weekly betas. The release is dominated by authentication: first-class OpenID Connect with discovery, JWKS signing-key resolution, token validation, PKCE and identity linking, plus registration-policy controls and an option to auto-join OIDC users to the root team. Team-scoped integration tokens land alongside it, with their own create, edit and permission handling. It is explicitly not for production use.

The earlier beta run was security hardening — team-scoped queries, encrypted webhook secrets, mass-assignment protection, a guard against pruning persistent containers. v4.4 continues that line but changes its character: where the betas were closing holes in a single-team deployment, OIDC and team-scoped integration tokens are the features an organisation requires before it will let a self-hosted PaaS hold its infrastructure. Identity delegated to a corporate provider, and API access scoped per team, are the two things that were missing. The long publishing gap and the jump from a beta.474 numbering to a 4.4 candidate suggest the work was done off the release feed rather than paused.

The stable v4.4 is the next thing to expect and the release where this work should be judged, since the candidate ships explicitly for testing. Given the OIDC groundwork now includes registration policy and team auto-join, group or role mapping from the identity provider is the natural follow-on once SSO itself settles.