# Limits

Every limit that applies to your apps, builds, and account, in one place.

Plan limits come from your organization's plan. They are plan settings, not fixed rules, and they can change. Run `deplane whoami --json` to see the limits that apply to you right now. To see what you used against them, open **Usage** in the dashboard or run `deplane usage`; see [Dashboard](dashboard.md#usage). To raise a limit, email support@deplane.cloud.

## Requests to your app

| Limit | Value |
|---|---|
| Request body | 100 MB per HTTP request to an app. |
| Time to the first response byte | 125 seconds. If your app sends nothing for 125 seconds after a request arrives, the request fails with a timeout. Send long work to a background job, or stream the response. |
| WebSockets | Supported, with no extra configuration. Connections stay open as long as data flows. Long-idle connections may be closed, so reconnect when that happens. |
| HTTPS | Every app gets `https://NAME.deplane.dev` with a certificate, set up for you. |
| Large media | Deplane is not a host for large video or file downloads. Use a storage service for those. |

## Instance sizes

| Size | CPU | Memory |
|---|---|---|
| small (default) | 0.5 vCPU | 512 MB |
| medium | 1 vCPU | 1 GB |
| large | 2 vCPU | 2 GB |

Every instance of an app has the same size. Change it with `deplane scale --size medium`.

An [autoscaled](scaling.md#autoscaling) app counts at its maximum instances, whether or not it runs that many, and a sleeping app counts too.

## Beta plan

| Limit | Beta plan | Error when you reach it |
|---|---|---|
| Memory, all instances of all apps together | 1536 MB | [limit_memory](errors.md#limit_memory) |
| Apps | 3 | [limit_apps](errors.md#limit_apps) |
| Instances, all apps together | 3 | [limit_instances](errors.md#limit_instances) |
| Sizes | small, medium, large | [limit_size](errors.md#limit_size) |
| Build time | 300 build minutes per month, reset on the 1st (UTC) | [limit_build_minutes](errors.md#limit_build_minutes) |
| Builds at the same time | 1; more builds wait in the queue | none, they wait |
| Log retention | 7 days | none |
| Database backups | Kept 7 days (point-in-time restore to any second in them) | none |
| Live log streams at the same time | 3 | [limit_log_streams](errors.md#limit_log_streams) |
| App disk space, all disks together | 10 GB (two 5 GB disks) | [limit_disk](errors.md#limit_disk) |
| Redis | 1 (256 MB memory each, counted in your memory) | [limit_redis](errors.md#limit_redis) |

For example, one large instance (2048 MB) does not fit in 1536 MB, but one medium and one small instance (1536 MB) do. Three small instances use 1536 MB too.

Errors for plan limits have codes that start with `limit_`, and the CLI exits with code 6 for them.

Besides your plan's limits, Deplane refuses a new app, a preview, a scale-up, a new or bigger worker or cron job, a new or restored database, a new Redis, or a template deploy while its servers are nearly full (above 85% of their memory reserved), with [capacity_full](errors.md#capacity_full). Running apps keep running; try again later.

## Redis

| Limit | Value |
|---|---|
| Size | 256 MB memory (200 MB of data), 1 GB storage |
| Redis per app | 1. See [redis_attached_elsewhere](errors.md#redis_attached_elsewhere). |
| Back up now | Once an hour per Redis. See [backup_too_soon](errors.md#backup_too_soon). |
| Backups | Nightly; kept 3 days (or your plan's backup window, if shorter), plus the newest that worked; off-site, 7 days. |

See [Redis](redis.md).

## Uploads and builds

| Limit | Value |
|---|---|
| Upload size | 100 MB compressed. |
| Project size | 2 GiB uncompressed. |
| Files | 200,000 files and folders. |
| Dockerfile | 1 MB. A `# syntax=` line is not allowed. |
| Uploads at the same time | 2 per organization. |
| Build time | 15 minutes per build. |
| Build memory | 3 GB. |
| Build disk | 10 GB. |
| Image layer | 2 GB compressed per layer. |
| Queue time | A build that waits in the queue for more than 1 hour expires. Run `deplane deploy` again. |
| Build logs | Kept 30 days. |

The CLI never uploads the `.git` folder or `.env` files. It honors `.gitignore` and `.dockerignore`. Keep `node_modules`, build output, and large data files out of the upload with them.

## Releases and rollout

| Limit | Value |
|---|---|
| Time for a release to become healthy | 5 minutes. After that the release fails with `Timeout` and the previous release keeps serving. |
| Startup | An instance has up to 2 minutes to start answering its health check. |
| Releases shown by `deplane releases` | The newest 50. |

## Databases

| Limit | Value |
|---|---|
| Databases per team | 5. See [too_many_databases](errors.md#too_many_databases). |
| Disk per database | 10 GB. |
| Size | `small`, `medium`, or `large`; a database counts against your plan as one instance of its size. |
| Databases per app | 1, as `DATABASE_URL`. |
| Backup window | Your plan's: 7 days on the Beta plan. Restore to any second in it, up to about a minute ago. |
| Deleted databases | Restorable for the backup window, then deleted for good with their backups. |
| Preview databases | 3 per team at a time, smallest size, free (they do not count toward the 5 or your plan). Never backed up. |

See [Databases](databases.md).

## App disks

| Limit | Value |
|---|---|
| Disks per app | 1, of 5 GB. See [disk_exists](errors.md#disk_exists). |
| Disk space per team | Your plan's: 10 GB on the Beta plan. See [limit_disk](errors.md#limit_disk). |
| Instances of an app with a disk | 1, without autoscaling. See [disk_needs_one_instance](errors.md#disk_needs_one_instance). |
| Back up now | Once an hour per disk. See [backup_too_soon](errors.md#backup_too_soon). |
| Disk backups | Nightly. Disk backups are kept 3 days (or your plan's backup window, if shorter), plus the newest that worked; off-site, 7 days. |

See [Disks](disks.md).

## Apps, previews, domains, and processes

| Limit | Value |
|---|---|
| Pull request previews | 3 per app at a time. They count toward your plan's apps and instances. |
| Custom domains | 10 per app. |
| Workers and cron jobs | 10 per app; a worker runs 0 to 20 instances. |
| Instances of one app | Up to your plan's instance limit. The autoscale maximum is 1 to 1000, also bound by your plan. The AI tools' `scale` tool takes at most 20 for `instances`. |
| Sleep when idle | After 5, 15, or 60 minutes without requests, or never. |
| Automatic rollback | Watches a release for its first 10 minutes live. Needs at least 50 requests and 10 errors from the app (502, 503 and 504 do not count), reaching visitors on at least 3 networks. |
| Alert channels | 10 per team. |

## Logs

| Limit | Value |
|---|---|
| `deplane logs` | The last 100 lines of each running instance by default. |
| `deplane logs --tail N` | Up to 1000 lines per instance. |
| Live stream (`deplane logs -f`) | Up to 30 minutes per stream; run it again to continue. |
| Live streams at the same time | Set by your plan: 3 on the Beta plan. A deploy that follows its build log uses one too. |

## Rate limits

| What | Limit |
|---|---|
| Login, sign-in links, and second-factor attempts | 5 per minute per IP address and per email |
| Access requests and abuse reports | 3 per hour per IP address |
| API requests | 120 per minute per token |
| Deploys | 10 per hour per app |
| Live log streams | 3 per organization at the same time |

When you hit a rate limit, the API answers HTTP 429 with [rate_limited](errors.md#rate_limited) and a `Retry-After` header. Wait and try again.

## API

| Limit | Value |
|---|---|
| Request body | 64 KB, except source uploads (100 MB). |
| CLI login token | Lasts 30 days. |
| CI token | 90 days by default, at most 365 days. |
| Login code (`deplane login`) | Expires after 10 minutes. |
| Fresh passkey confirmation | Valid for 5 minutes. |

## App names

- 3 to 40 characters.
- Lowercase letters, digits, and single hyphens.
- Start with a letter, and do not end with a hyphen.
- Names are unique across Deplane. A destroyed app's name becomes free again.
- Some names are reserved for Deplane, such as `api`, `www`, `admin`, `login`, `docs`, `status`, and `support`.
- Names that contain a well-known brand are refused, to protect people from phishing. `paypal-login` and `my-google-app` are refused. Common letter swaps such as `paypa1` count too. If you own the brand, email support@deplane.cloud.

## Secrets

| Limit | Value |
|---|---|
| Name | Capital letters, digits, and underscores; not starting with a digit; at most 128 characters. |
| Reserved names | `PORT` and names that start with `DEPLANE_`. |
| One value | 32 KB. |
| All values of one app, per kind (runtime or build) | 256 KB. |

## Network from your app

Your app can reach the internet. Some destinations are blocked for everyone:

- Outbound email on port 25 is blocked. Use an email provider's API, or its submission port 587 or 465, which are rate limited.
- Private networks, cloud metadata addresses, and Deplane's own servers are blocked.
- Known cryptocurrency mining pools are blocked.

## Regions

Apps run in one region today: `fra` (Germany).