ShelfHosted

ShelfHosted Logo
Homepage
App Details
Homepage with running apps
Security checks on import

Inspiration

OpenAI GPT-5.6 Sol, Terra and Luna inside of Codex app makes apps easy to build, but then what? I often built small local apps for personal use, but they rarely stayed running or accessible when I actually needed them. They would sit unused because starting them required remembering commands, managing dependencies, or dealing with broken environments. Over time, these apps became more like experiments than tools, even though they were genuinely useful.

ShelfHosted solves the deployment headaches of self-hosting by making app hosting as simple as placing a book on the shelf. The goal was to make running local apps as simple and reliable as using an app library without having to think about servers, setup, or maintenance.

What it does

Users can import .localapp bundles, review risks and dependencies, then install and run approved apps locally through Docker.

Apps can be started, paused, restarted, archived, restored, or deleted while keeping data by default.

How we built it

ShelfHosted uses a Python and FastAPI backend with a React and TypeScript frontend.

Every uploaded bundle is treated as untrusted. We scan it, block unsafe features, require approval, and generate our own Docker configuration instead of running imported files directly.

Challenges

The hardest parts were reviewing apps without executing them, recovering safely from failed operations, and explaining technical risks in simple language.

We also learned that local apps can expose a complicated mix of interfaces. While web frontends are the most common, supporting other types required designing flexible handling without compromising safety or usability.

Windows support also required running ShelfHosted inside WSL 2. This adds complexity of requiring WSL2, but removes the dependency on 3rd-party container solutions for Windows.

Accomplishments

We built the full flow from import and review to launch, monitoring, recovery, archive, restore, and safe deletion.

Apps stay local by default, unknown features are blocked, and data is not removed without confirmation.

What we learned

Local hosting brings its own security, storage, networking, and recovery challenges.

We learned that there is a complicated mix of potential interfaces for local apps. While web frontends are the main focus, supporting other types is important for flexibility.

We also learned that scanning cannot prove an app is safe. The product must clearly explain risks and enforce strong limits.