npx create-next-app@latest) to a live app at https://<app>.getfloo.app, with managed Postgres, signed-in users, and your own domain.
New to floo? Start with the Quickstart.
1. Add a Dockerfile
Configure standalone output, which makes a much smaller container:next.config.js
Dockerfile
2. Build-time env vars (NEXT_PUBLIC_*)
Any NEXT_PUBLIC_* variable your code references is baked into the JS bundle at build time, not read at runtime. floo passes every env var whose name starts with NEXT_PUBLIC_, VITE_, or REACT_APP_ to the image build as a Docker build arg, and injects it at runtime too. Two things have to line up.
First, once step 4 has created the app, set the value as an ordinary env var. The name prefix is what makes it a build arg; no extra flag is needed.
ARG makes Docker accept the value; ENV puts it in process.env for next build.
Dockerfile
undefined baked in. The build step records a diagnostic when a build-time var is passed but not threaded into the stage that runs next build.
Env vars are per environment (--env dev is the default). After the first release creates prod, set any differing build-time values there and publish another release to rebuild. See Environments for image reuse and rebuild rules:
/api/...) avoid the question entirely. See Container contract and Environment variables.
3. Initialize the floo config
Install the CLI and sign in:curl -fsSL https://getfloo.com/install.sh | bash, then floo auth login. An agent can run the same journey over the HTTP API instead, starting from getfloo.com/agents.md.
floo.app.toml
migrate_command under [services.web]. It runs as a one-off job with the new image before traffic
moves to it. A failed migration stops the deploy. Use
expand-then-contract migrations
to keep the schema compatible with both old and new code.
4. Connect the repo and deploy
floo builds from GitHub, not local files, so push first. Before the firstfloo apps github connect, a human installs the floo GitHub App on the account that owns the repository and links it to your floo org; see Quickstart steps 2 and 3. If either step is missing, connect opens a setup link and waits.
Your Next.js app is live at
https://my-nextjs-app-dev.getfloo.app.Every git push origin main ships to dev. gh release create v1 --repo <owner>/<repo> publishes to https://my-nextjs-app.getfloo.app. See Environments.5. Add a Postgres database
floo.app.toml
DATABASE_URL is injected into the runtime. Configure your database client to read it. For Prisma, follow the configuration for your installed Prisma version.
Next.js standalone output does not automatically include the Prisma CLI, schema, or migration files. Include those in the runtime image and generate the client during the build before setting migrate_command = "npx prisma migrate deploy". The command must run from the packaged dependencies without downloading tools at deploy time.
Optional: add file storage
Add[managed.uploads] with type = "storage" and attach it to the web service. Once a service lists managed, it receives only the services listed there, so keep postgres in the list or DATABASE_URL disappears:
floo.app.toml
6. Add per-user auth
Setaccess_mode = "accounts" and floo handles sign-in:
floo.app.toml
- Redirects unauthenticated requests to a hosted login page.
- Validates the session cookie on every request.
- Injects identity headers into every request that reaches your Next.js app.
app/dashboard/page.tsx
floo dev --fixture-user (see section 8) or hit your dev server with curl -H 'X-Floo-User-Email: you@example.com'. Access modes and identity headers in full: App sign-in.
7. Add a custom domain
Declare the domain infloo.app.toml:
show prints, then watch
activation:
Host and X-Forwarded-Host from the request, so it needs no extra config. DNS setup and troubleshooting: Custom domains.
8. Local development with dev credentials
dev_command locally with DATABASE_URL and readable env vars from the app’s dev environment: a real connection to your dev Postgres, with no credentials in your shell history. Write-only secrets are withheld; supply separate local values when needed. Prod credentials never reach a local session.
To test signed-in flows, add --fixture-user:
floo dev then puts a proxy in front of each accounts-mode service that injects the same X-Floo-User-* headers floo’s gateway adds in production. The output table shows the raw service URL and the auth-proxied URL; use the auth-proxied one for any path that reads identity headers.
Faster pushes
A push that changes only code reuses every layer aboveCOPY . ., so its build time is mostly next build, and type checking is usually the longest part of it.
- Run
npm run build(ornext build) as its ownRUNline, as in the Dockerfile above. floo then keeps.next/cachebetween pushes, so Next.js recompiles only what changed. Acd, a comment, a heredoc, or the exec form (RUN ["npm", "run", "build"]) on that line turns this off. - Keep
"incremental": trueintsconfig.json.create-next-appsets it. With it, type checking reuses the previous push’s results from.next/cache. - Copy
package.jsonand the lockfile before the source, as in thedepsstage above.npm cithen reruns only when the lockfile changes. A push that changes dependencies also produces a larger new image layer, so it takes longer to build and to start. - In the final stage, copy anything that rarely changes before
.next/standalone, such as a fullnode_modulesfor a migration tool. A layer after a changed one is rebuilt and uploaded on every push. See Layer order.
next build runs your project’s own tsc by default (docs), so installing typescript@^7 is enough for floo builds to use it. It turns on strict by default and ships no JavaScript API yet, so tools such as typescript-eslint need @typescript/typescript6 alongside it.
Build files from the edge cache
floo serves/_next/static/* from its edge cache, close to the visitor. It
caches what your app marks cacheable: Next.js sends hashed build files with
Cache-Control: public, max-age=31536000, immutable, so after the first
request they load from the cache and never reach your app. There is nothing to
configure.
- Only public apps are cached. An app behind sign-in or an
edge policy gets
privateon every response, and the cache stores nothing for it. See Caching signed-in responses. - When an app stops being public, gains an edge policy, or loses a host, floo clears that host’s cached files.
- Requests to
/_next/static/*bill as edge cache requests, and files served from the cache bill as edge cache bandwidth. Rates are on getfloo.com/pricing. Cache hits are not counted infloo analytics.
Common gotchas
/healthzis reserved. floo’s edge intercepts that exact path. Use/healthor/livez.HOSTNAME=0.0.0.0. Next.js standalone defaults tolocalhost, which floo cannot reach.NEXT_PUBLIC_*build args. Set them withfloo env setand thread them through the build stage asARGplusENV, or the bundle hasundefinedbaked in.output: "standalone"innext.config.js. The Dockerfile above assumes standalone output. Without it, the build artifact is much larger and theCOPY --from=build /app/.next/standaloneline fails.- A
.dockerignorelistingnode_modules.COPY . .runs after the clean install is copied in, so without one your localnode_modulesoverwrites it.
Next steps
App sign-in
Identity headers, access policies, and access modes in detail.
Multi-service routing
Deploy Next.js alongside a FastAPI or Express backend with shared origin.
Environment variables
Build-time vs runtime env vars, secrets, and per-service scoping.
Custom domains
DNS, verification, multi-service routing.