Dependency-Track Hosting Live In 5 Minutes

Deploy Dependency-Track hosting and track every component in your software against known vulnerabilities on your own server, as a self-hosted software composition analysis platform. xCloud runs the pinned Dependency-Track 5.2.0 API server and web interface with a private PostgreSQL database, replaces upstream's public default admin password, and publishes both over HTTPS on two domains of your own in just a few minutes.

Deploy your Dependency-Track

No terminal
No technical skills needed
No lock-in, cancel anytime

What is Dependency-Track?

Self-hosted Dependency-Track is an OWASP software composition analysis platform. Upstream calls it an intelligent Component Analysis platform that helps organizations identify and reduce risk in the software supply chain, using the capabilities of the Software Bill of Materials (SBOM). Its docs describe an API-first design that consumes and produces CycloneDX SBOMs, integrates with multiple sources of vulnerability intelligence, and has a policy engine with global and per-project policies. You run it yourself, and it is licensed Apache-2.0.

On xCloud the template runs the Dependency-Track 5.2.0 API server and web interface images with PostgreSQL 18, all pinned by digest, on two domains: the interface and the REST API your CI tools upload to. Database data lives on a persistent volume. The vulnerability sources need outbound internet access, and the built-in admin password is replaced at install.

From Sign-Up to a Live Component Portfolio In Just 3 Easy Steps

A Dependency-Track stack normally means an API server, a web front end, a PostgreSQL database, two domains, CORS settings, a replaced default password and certificates before the first SBOM. This is the same result without assembling any of it.

Step 01
Sign Up
Create your xCloud account and pick Dependency-Track from the OneClick catalog. Choose your domain and target server — there are no extra fields to fill in, because xCloud generates the credentials.
Step 02
We Deploy It For You
One click. We bring up the official Dependency-Track API server and web interface, pinned by immutable digest, with a private PostgreSQL 18 database that is not published, mount the postgres_data and dtrack_data volumes, replace the default admin password with a generated one, and publish the web interface and the REST API over HTTPS on two domains.
Step 03
Sign In And Upload A BOM
Open the web interface and sign in as admin with the generated password; the first boot runs database migrations and loads the licence list, which takes a few minutes. Enable vulnerability sources under Administration, then create an API key under Access Management, Teams to upload BOMs from CI through the API domain.

Everything Dependency-Track Does, On Your Own Server

Dependency-Track runs in full here: SBOM ingestion, a project portfolio and a REST API, backed by a database you own.

SBOM Ingestion
Ingest CycloneDX software bills of materials and see the components of each project in one portfolio.
Vulnerability, Licence And Policy Findings
Flag known vulnerabilities, licence problems and policy violations across all of your projects.
REST API For CI
Upload BOMs from CI through the REST API with a team API key, up to 100 MB per upload.
Separate Web And API Domains
The web interface and the API each get their own HTTPS domain, and the API accepts cross-origin requests only from the web interface.
Private PostgreSQL Included
PostgreSQL 18 is reachable only inside the install's private network, and the API server's management port is not published.
Telemetry Off By Default
Anonymous usage telemetry is switched off in this template.

Everything You Need To Run Your SBOM Tracking 24/7

Managed hosting for Dependency-Track, so the parts that keep it online are not your problem.

Dependency-Track 5.2.0 deployed instantly
Official images pinned by digest
Generated admin password
Private PostgreSQL database
Free SSL certificate
Server backups and snapshots
Server security updates included
30+ server locations
Unused balance refunded

What You Can Do With Dependency-Track

SBOM vulnerability tracking for your projects
A security team uploads a CycloneDX or SPDX SBOM per project and sees which components carry known vulnerabilities, so risk is tracked across the portfolio instead of per repository.
Upload BOMs from CI
A DevOps engineer creates an API key under a team and has each build push its SBOM to the API domain, keeping the component inventory current with every release.
Watch licences and policies
A compliance owner reviews the licences of components across projects and defines policy conditions, using the licence data the server loads on first boot.
Keep supply chain data in-house
An organisation that does not want its dependency inventory held by an outside vendor runs the platform itself, with a private database and the vulnerability feeds it chooses to enable.

Dependency-Track vs Alternatives

Snyk: Choose Dependency-Track as a Snyk alternative for the SBOM and component inventory side. It ingests SBOMs and tracks each project's components against vulnerability, licence and policy data on a server you run, so this is a partial comparison.
OWASP Dependency-Check: OWASP Dependency-Check is a separate tool that people compare. This page makes no feature claim about it; Dependency-Track's own pitch is continuous tracking of SBOM components in a server with a web interface and API.
DefectDojo: DefectDojo is another security tool that people compare. This page makes no feature claim about it; Dependency-Track's own focus is component analysis from SBOMs.
Manual dependency audits: Reading lockfiles by hand for each project does not scale. Dependency-Track takes SBOMs from CI, keeps one inventory per project, and flags new vulnerabilities in components you already shipped.

Simple Pricing. Everything Included.

Dedicated Cloud VPS sizes, pre-configured for Dependency-Track hosting. Pick the one that fits, and resize any time.

Cloud VPS 6 GB

Cloud VPS 16 GB

More headroom if Dependency-Track sits alongside other security tools.

$59.99per month

16 GB RAM
6 vCPU cores
200 GB NVMe SSD
30 TB
Unlimited

Get started

Every size is a dedicated Cloud VPS we provision, patch, monitor and restore. Billed monthly with no lock-in — delete the server and the unused balance comes back to your account. Dependency-Track itself is licensed by its maintainers under Apache-2.0.

Docker hosting

Already Have a Server? Bring Your Own

Connect any VPS — DigitalOcean, Vultr, Linode, AWS, Hetzner or bare metal — and deploy Dependency-Track on it through the same panel, for a per-server management fee instead of a Cloud VPS rental.

Free

Start your journey without cost.

$0forever

1 server
10 sites

Start free

Starter

Professional

The same platform, discounted at 6–10 servers.

$4per server / month

6–10 servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Agency

The same platform, discounted at 11+ servers.

$3per server / month

11+ servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Priced per connected server, so your rate adjusts automatically as you add or remove servers. You pay your own provider for the server itself.

Self-managed hosting

Ready To Run Your Own SBOM Platform?

Dependency-Track on xCloud runs on a dedicated Cloud VPS that we provision, patch, monitor and restore. Deploy faster. Own the server. Stay in control.

Fast Provisioning
Deploy faster using an xCloud Managed Server built with optimized stacks and high-speed SSDs.
Enterprise-grade security
Protect your infrastructure with a free SSL certificate and more advanced security features at no additional cost.
Intuitive Control Panel
From Server creation to application deployment, everything can be managed from our intuitive control panel.

Hear what people are saying about us

See why agencies, developers, startups, and growing businesses choose xCloud to power their projects.

xCloud works really well, I am surprised by its performance being this the release version, I have tried many paid platforms such as runcloud, cloudpages or serveravatar, as well as free platforms such as CyberPanel, CloudPanel or Hestia Control Panel and direct competitors such as SpinupWP and FlyWP. Of all those that I have tried, the platform that works best for WordPress is SpinupWP and I believe that xCloud can reach and surpass that development, its roadmap is promising. Congratulations to the xCloud team, I hope they become the leading platform in the segment, it has all the potential to achieve it!

Brian Geovanny

I've been with runcloud for the last 3 years. However, after trying xcloud for the last month, I'm switching over. They are on a roll with their setup.

Kevin Pineda

I'm moving my servers to xCloud, a cloud control panel by M Asif Rahman and the WPDeveloper team. Their roadmap looks interesting and no, there are no team mates nor API limits with xCloud! #xCloud #wordpress #hosting

Leo Koo

How Cloud Nine Web Elevated Client Experience While Streamlining Hosting Operations using xCloud

Ed Ellingham

xCloud is like having an expert server team on call — without the big agency costs. It's given me back my time and given my clients peace of mind. Highly recommended for freelancers and small teams who want reliable performance and security.

Dumitru Butucel

xCloud isn't just a solution. It's like one of that friend who got your back when you screw things up pretty bad.

Waqar Ahmed

Trust me when I say, once people explore the potential of xCloud they gonna switch from other panels, just keep delivering the best tech, lots of love for the team 😍😍

Rahul Singh

So far my experience has been smooth like silk. I didn't imagine that configuring and managing a VPS would be so easy. As of today, I have deployed 8 sites. The support is good, and they treat users with respect, even if they ask stupid questions (myself included). For the future, I hope for greater flexibility in scheduled backups and more comprehensive and consistent documentation. I'm sure that within a few months, xCloud will become the leader in its segment. This community is amazing, and the Staff here is super helpful.

Massimo Villa

Came from cloudways then to runcloud then to xcloud. Looks like I'm staying here.

Gerson El

I've recently taken all of my Vultr-hosted sites and gotten rid of cPanel for them to substitute it with xCloud. I have to say, I'm really impressed with xCloud so far! The interface is definitely the standout feature for me.

Tony Lewis

I came from Cloudways and won't go back. Highly impressed with xCloud. Glad I gave them a chance.

Jared McDowell

I like xCloud better than RunCloud, but one thing I'll point out is that some years ago RunCloud was hungry for business, the support was outstanding, and the community was active and helped each other. Maybe it was sold, there was a change in management, or they stopped being hungry, but the quality of the RunCloud offering declined and it hasn't been moving forward quickly. My point is that currently the xCloud team has the edge and it is theirs to keep or lose

David McCan

How Kevin Heinrichs Cut Hosting Costs by 84% While Running WooCommerce & Node.js Sites Efficiently

Kevin Heinrichs

I had 150 sites on cloudways and am in the process of moving them to xcloud. Much faster and better priced.

Dan Spinoza

Dear xCloud Team, I have been using xCloud for some time now and am genuinely impressed with its capabilities and the flexibility it offers by allowing users to bring their own VPS for management. It's a fantastic service, and my experience so far has been very positive. Successful migrated 5 sites on a single server. Xcloud migration tool worked great. There were few hiccups with security plugin like MalCare but disabling the plugin prior to migration worked just fine.

Rahil Maknojia

Came from runcloud. Tried xcloud and never came back.

Karl Fanega

How Advanced Web Strategies Saved Over $2,000 & Recovered 56 Hours per Month Managing 70+ Client Websites

Gary Moody

xCloud gave me what no other hosting platform could: the flexibility of a VPS with the convenience of managed WordPress. As a solo founder running an entire business on one server, that combination is an important unfair advantage.

Jorge de los Reyes Martínez

I use Server Avatar and xCloud and I'll sooner use xCloud than Server Avatar personally.

Jay Pagano

How Newman Web Solutions Ensured Perfect Uptime and Seamless Scaling For 120+ WordPress Sites with xCloud

Lori Newman

I too have moved over to xCloud. It's pretty sweet. One click n8n and uptime Kuma apps

John Aperture

I went from Cloudways to xCloud. No intention on switching in the foreseeable future.

Blaine Moore

Frequently Asked Questions

Feel free to contact us with any questions or concerns you may have.

Is Dependency-Track free and open source?

Yes. Dependency-Track is released under Apache-2.0, so using it costs nothing in licences. xCloud bills for the dedicated Cloud VPS. The server needs outbound internet access to download vulnerability data, and the built-in admin password is replaced at install.

Can I run Dependency-Track with Docker?

Yes, and this template does it for you: the ghcr.io/dependencytrack apiserver and frontend 5.2.0 images and PostgreSQL 18, pinned by digest, behind HTTPS on two domains. It is Dependency-Track Docker hosting without writing the compose file or the CORS settings.

Docker hosting on xCloud

How much RAM does a Dependency-Track cloud server need?

A Dependency-Track cloud install needs 2560 MB of RAM at the least, and the 6 GB Cloud VPS sold here sits above that. The Java API server and PostgreSQL share the machine, so large portfolios and many vulnerability sources need further headroom.

What is an SBOM?

A Software Bill of Materials is a list of the components inside a piece of software. Upstream builds Dependency-Track around SBOMs, ingesting CycloneDX and SPDX, so it can track each project's components against vulnerability, licence and policy data.

How do I upload an SBOM from CI to Dependency-Track?

Create an API key under Administration, Access Management, Teams, then have your build push its SBOM to the API domain, not the web interface domain. Use the API domain as the server address in your CI plugin or upload command.

Does Dependency-Track need internet access?

Yes, for vulnerability data. The server must reach the internet to download the feeds of the sources you enable under Administration. Without outbound access it can hold your SBOMs but cannot refresh the vulnerability and licence information it matches them against.

How do I sign in to Dependency-Track the first time?

Open the web interface address and sign in as admin with the generated password from your credentials. The install replaces upstream's public default admin password, unless the account was already changed. First boot runs migrations and loads the licence list, which takes a few minutes.

How do I back up Dependency-Track?

Back up the postgres_data and dtrack_data volumes together: postgres_data holds projects, components, findings and settings, and dtrack_data holds the key that protects integration secrets stored in the database. Without it those secrets cannot be read. Changing the admin password later does not update the credentials card.

Backups in xCloud

How do I upgrade from Dependency-Track 4 to 5?

This template installs version 5. Upstream keeps version 4 in maintenance mode, says it reaches end-of-life in December 2026, and publishes a migration guide for moving from 4 to 5. Read it first, and back up both volumes before adopting a newer template version.

Can I cancel anytime?

Yes. There is no lock-in — cancel any time. Hosting is billed monthly and charged for what you actually use, so when you delete the server the unused balance is refunded to your account, less up to 10% in payment-processing fees.