Hacked twice, announced a shutdown, then open-sourced itself: Zeabur 13 days 641 stars, the stars come from the shutdown news

Zeabur is a Taiwanese cloud deployment platform. It was hacked twice in two months, and Oct 17 announced it would shut down by year-end. 11 days later, the team turned the 2.0 it was rewriting into an open-source version, a PaaS you install on your own Kubernetes. It got 641 stars in 13 days, nearly matching the 4 stars the old repo built over 745 years. This piece covers where those stars came from, what you can learn from it, and whether this direction is still worth building.

A shutdown letter

On Oct 17, 2026, Zeabur founder Lin Yuan-lin posted a letter that opened with: "Today, I have a difficult decision to share: we will be winding down Zeabur." New servers and domains stopped selling that day, services on the shared cluster were all paused starting Dec 1, and everything closes on Dec 31. The letter attached a migration guide titled "Migrating off Zeabur: hand this guide to your coding agent," meaning hand the guide to your coding agent and let it help you move.

Three days ago, on Oct 14, an attacker got hold of an internal credential that was created 2024 years ago in January, stored in plaintext, and never rotated. They got into the shared cluster and platform database across 9 regions, took the information of 321,810 accounts and about 3.2M environment variables (BleepingComputer 10-20). The August breach came in sideways through a customer-deployed NextChat app into internal systems. This is the second time.

Lin Yuanlin was candid about why they're stopping in his letter: 8 OpenClaw and vibe coding created unprecedented deployment demand, but AI is also making "deployment" itself easier at a rapid pace, and "our growth has started hitting a ceiling."

On Oct 28, the team published another blog post: "Zeabur is open source: a safer foundation for the deploy flow you know." One line explains the backstory: "Users told us they hoped Zeabur would be open-sourced."

What it is

zeabur-oss/zeabur, written in Rust, Apache-2.0. The repo description is a single line: "Self-hosted PaaS on your own Kubernetes."

What sets it apart from other self-hosted PaaSes is that it doesn't store a separate config. The old Zeabur kept each service's config in its own database and generated Kubernetes resources from it. If an engineer changed something with kubectl, the platform's records no longer matched the cluster. 2.0 installs no CRDs and has no database. It reads what's actually running in the cluster and assembles it into projects, services, domains, environment variables, and volumes. Services deployed with Helm, Argo, or Flux also show up in the UI.

Permissions are designed around the fact that they got breached: everyone logs in with their own account, and what they can do is governed by Kubernetes RBAC. Admin accounts can only log in with a passkey, and tokens expire after 5 minutes. The login system is complete enough that it has been split out into its own project, Zeabur Identity. There are two more features for newcomers: when something fails, it tells you in plain language what went wrong, and before applying changes it shows you a YAML diff first.

The project itself is labeled pre-alpha, and it says it has only been tested on a few clusters.

How the stars grew

Source: GitHub daily records. From 10-28 to 10-31, stars grew by about 450 over four days, then flattened into a straight line, a typical one-time spike. I couldn't find what post drove the +213 on 10-30.

Where the stars came from

This was mostly shutdown news, not a product story. In late October the name "Zeabur" was hot in developer circles. BleepingComputer, Cybernews, iThome, and Business Next all covered the breach and the shutdown. Reddit's r/sysadmin and r/SillyTavernAI (Zeabur was one of the most common hosts for one-click SillyTavern deploys) were also discussing it. The open-source announcement rode this wave of attention.

The headline itself has a twist. "A platform hacked twice has open-sourced what it's 'a safer foundation' for." The reposts by Taiwanese and Chinese-language developers on Threads almost all say the same thing: @stantheman_0128 "Zeabur actually open-sourced itself", @davepoon128 "Wow! Zeabur has now open-sourced their PaaS platform" (1.7K views). The vocus 10-29 headline is even more direct: "Since you can't keep them out, why not be generous? Zeabur officially 'open-sources' after being looted by hackers twice."

About 320k existing users looking for somewhere to go (inferred). Users were mainly in Taiwan, mainland China, and Japan, many of them using Zeabur for one-click deploys of n8n, SillyTavern, and Dify. They had just received shutdown emails, so "can I run my own Zeabur?" was a natural thought, and starring the repo was a way to make a statement. Notably, neither the official shutdown blog nor the homepage linked to the open-source repo. It spread through community word of mouth.

The English-speaking world only produced a long tail. ideatemple, faun.dev (11-04), a Russian DevTrends article, DeepWiki, and a few YouTube explainers each brought in a little. There were no real Hacker News threads on either the open-sourcing or the shutdown, and almost nobody on X mentioned it.

The fork rate of 17% is on the high side. Maybe people worried it would disappear again and forked a copy first. Or maybe there's real contribution happening in the pre-alpha phase (issue numbers have already passed #330, many of them tasks the team split out themselves).

Who it's competing with

The self-hosted PaaS space is already crowded, and the top projects have star counts two orders of magnitude higher than 641:

The ones who actually picked up Zeabur's users were managed platforms like Railway, Render, Fly.io, and Northflank. On Threads someone recommended Railway, saying its "setup architecture is the most similar." The race for migration traffic moved fast: Zenavo published a migration guide at 10-23, then a "best Zeabur alternatives" post at 10-31. Kuberns wrote "Zeabur Is Shutting Down: Where Should You Migrate?" and Northflank wrote "Top 7 Zeabur alternatives." I haven't seen anyone copying the open-source version.

If it were you

The bottom line: those 641 stars were bought with Zeabur's own shutdown. You don't get the brand, the 320k existing users, or a bad-news story that the whole internet is covering. The product itself is also crowded into a category where the leaders already have 60k stars. There's something to learn here, but copying it isn't worth the effort.

Who it fits: developers who already understand Kubernetes and want to build a reputation in platform engineering, or teams with a product about to shut down that want to wind it down gracefully.

Who it doesn't fit: solo developers hoping to build another "self-hosted PaaS" for stars. Without a shutdown pushing it, a new project will struggle to get noticed next to Coolify and Dokploy.

How to do it:

• Learn how to wind down, not how to position. When a product has to close, open-source the half-finished internal refactor and publish a post that clearly explains "why, and what we learned." The crisis turns into a wave of stars and goodwill, and the team leaves behind a body of work (the founder has moved on to Nuphos, an open-source agent workspace, and that reputation carries over).
• Learn to watch for other people's shutdowns. When a platform with hundreds of thousands of users announces it's closing, the next week or two is the best window: build an open-source tool that migrates from X to Coolify or your own K8s in one step, or a migration script a coding agent can execute directly. Companies like Zenavo captured search traffic within a week with exactly this, and open-source projects can capture stars the same way.
• If you really want to build a PaaS on K8s, go after what it hasn't finished: it's pre-alpha, has only been tested on a few clusters, and has no telemetry yet (issues #308 and #309 are still under discussion). For example, a read-only "plain-language diagnostics" tool that doesn't need admin rights would be useful on its own.
• The methodology in the post is itself a point of spread: "write a few user personas, have an agent play them through deploying, connecting a database, and setting up a domain, and see where they get stuck." That framing is easy to share.

How to get users: the first hop is the people being forced to move: wherever the old platform's users gather (this time Threads, r/SillyTavernAI, and Telegram channels), post a demo of "moving everything in one command." The second hop is the reporters and aggregator sites covering the shutdown, giving them an "alternative" angle.

When is "before": the Zeabur wave has already passed. Before the full shutdown on Dec 31, migration tools still have a little demand left. The more useful thing to remember is the playbook: the week the next platform announces a shutdown.

What would show I've misread this: if zeabur-oss keeps adding dozens of stars a day after December and shows real installs and outside contributors, that would mean the positioning "K8s-native, stateless, operated through RBAC" has real demand, and niche work in this direction would be worth reconsidering. Conversely, if it stops being updated a month or two after the shutdown, those stars were just applause at a farewell.