pterodactyl.io

Pterodactyl secures a deployment in two layers: access control at the panel (bcrypt password hashing, two-factor authentication, and scoped tokens passed to Wings) and isolation at the workload level (every game server runs in its own locked-down Docker container with hard CPU, memory, and disk limits). Extensions work differently from typical panels: they plug into versioned panel APIs rather than editing core files, so they survive updates and a broken extension is skipped instead of taking the panel down. This applies to self-hosted Pterodactyl installs; it is not a managed hosting product with its own security guarantees.

Access control: bcrypt, 2FA, and scoped tokens

The panel's stated design is "security first" at the door:

• bcrypt password hashing — account credentials are stored hashed rather than in plaintext, so a database leak does not directly expose passwords.
• Two-factor authentication (2FA) — an additional factor is required at login, which limits the value of a stolen password.
• Scoped tokens through Wings — the panel does not hand Wings (the daemon running on each node) unlimited authority. It issues tokens limited to the scope needed for the operation, so a compromised or misbehaving node process has a narrower blast radius.

The practical consequence for an admin: enabling 2FA on your own account and on staff accounts is the highest-value single step, because panel access is the path to every server on every connected node.

Isolation: one Docker container per server

Each game server is sealed in its own Docker container with hard CPU, memory, and disk limits. The site's own framing is that one server "can throw the loudest party on the node, and the rest of the street sleeps through it" — noisy neighbours are contained.

What this means in practice:

Limits are the mechanism, not a suggestion: a container that hits its memory ceiling is constrained rather than allowed to consume the node. When you size a plan, set memory and disk limits with headroom for the game's peak, because the limit is enforced.

Extensions: versioned APIs instead of core edits

The stated principle is "extend it without forking it." Extensions plug into versioned panel APIs and never touch core files. Three consequences follow:

1. They survive updates. Because nothing in the core is modified, upgrading the panel does not overwrite extension work.
2. A broken extension is skipped. A failing extension does not take the panel down; it is bypassed.
3. Versioning is the contract. Extensions target a specific API version, so compatibility depends on that version rather than on the panel's internal file layout.

The site's own example extension list — SSO, Announcements, Custom Buttons, Redirect, Dark Theme — shows the intended scope: authentication, messaging, navigation, and theming, all without forking. The panel reports "installed 0 / 5 · core files touched 0," which is the design goal stated as a metric.

What an Egg is, and why it matters for both topics

An Egg is a portable recipe for a game: its Docker image, startup command, and configurable variables. A Paper Minecraft egg, for example, specifies a Java Docker image, a startup command using {{SERVER_MEMORY}} and {{JARFILE}}, and variables like the server jar file and Minecraft version.

Eggs matter here because they are the unit that connects isolation to game support: the Docker image in the egg is what the server actually runs inside, and the variables are what the panel exposes to the user. You can install from the community library or author your own, and the same panel runs every one of them. The site lists Minecraft, Rust, ARK, Counter-Strike 2, Garry's Mod, Valheim, Terraria, Palworld, FiveM, Project Zomboid, Discord Bots, Teamspeak, SCP: SL, Factorio, and Satisfactory among supported games.

Choosing based on your situation

• If you run a small community server: the defaults already give you container isolation and per-server limits. Turn on 2FA for every admin account first.
• If you host for others: scoped Wings tokens and hard per-container limits are what keep one tenant from affecting others; verify limits per plan rather than assuming.
• If you need custom behaviour: prefer an extension against the versioned API over editing core files, so updates stay painless. If an extension breaks, expect it to be skipped rather than to break the panel.
• If you need a game not in the list: check whether an Egg exists in the community library or write one; the panel is not limited to the games shown.

Pterodactyl is described as free, open source, MIT licensed, with no seats, feature gates, or monthly bill, and in production since 2015. Those claims cover the software itself; hosting, nodes, and any third-party services are separate.

An open-source UI element library is a collection of individual, ready-made interface pieces—buttons, cards, inputs, toggles, loaders—that you copy into your own project and adapt. A UI framework, by contrast, is a structured system of components, conventions, and often a theming layer that governs how your whole interface is built. The practical difference: an element library gives you a snippet; a framework gives you a way of working. If you need a polished button in ten minutes, reach for the element library. If you're building a 40-screen product with a team, you probably want the framework.

What "open-source UI element library" actually means

The term gets used loosely, so it helps to separate the parts:

• Open-source: the code is publicly available, and the license tells you what you may do with it—copy, modify, redistribute, or use commercially.
• UI element: a single, self-contained piece of interface, usually small enough to read in one sitting. A button with hover states, a pricing card, a search field.
• Library: a browsable, searchable collection of those elements, typically contributed by many different people.

On a site like Uiverse, elements are shared by a community and written in plain CSS or Tailwind. You find one you like, copy the markup and styles, paste them into your project, and adjust colors, spacing, and text to fit. There's no package to install and no build step required—which is exactly the appeal, and also the source of most of the confusion.

Element library vs. UI framework: the core differences

The table isn't a verdict. It's a map of trade-offs. Element libraries win on speed and freedom; frameworks win on consistency and maintenance.

Licensing and attribution: what to check before you paste

This is where people get into trouble, and it's worth slowing down for.

1. Find the license. Every element or collection should state one. Common open-source licenses include MIT, Apache-2.0, and BSD. Some projects use copyleft licenses like GPL, which can impose obligations if you redistribute your code.
2. Understand what the license permits. MIT and Apache-2.0 are permissive: you can typically use the code in commercial and closed-source projects. Copyleft licenses may require you to release derivative source under the same terms.
3. Check attribution requirements. Permissive licenses usually require you to keep the copyright notice and license text somewhere in your project. That's a real obligation, not a formality.
4. Look for per-element terms. On community sites, the site's overall terms and the individual contributor's stated wishes may differ. If a contributor asks for credit, honor it.
5. When in doubt, ask or avoid. If a snippet has no license at all, you don't have clear permission to reuse it. Treat "no license" as "not open source," even if the code is publicly visible.

This article is general information, not legal advice. For commercial products with real exposure, have someone qualified review the licenses you're relying on.

How to use a community element in your project: a practical workflow

Here's a repeatable process that avoids most of the usual mess.

1. Start from a real need, not a browsing session

Decide what you need first—"a compact primary button with a loading state"—then search. Browsing aimlessly produces a pile of pretty snippets that don't fit together.

2. Copy the smallest version that works

Take the markup and the styles. Strip anything you don't need: demo wrappers, extra animations, decorative layers. Less code means fewer surprises.

3. Convert it to your conventions

If your project uses design tokens or CSS variables, replace hard-coded values:

/* Before: hard-coded */
.button { background: #4f46e5; border-radius: 8px; }

/* After: token-based */
.button { background: var(--color-primary); border-radius: var(--radius-md); }

This one step is what keeps a copied element from looking like a foreign object in your UI.

4. Check accessibility before you ship

Community elements vary widely here. Verify at minimum:

• Keyboard focus is visible and the element is reachable by Tab.
• Color contrast meets WCAG AA (4.5:1 for normal text).
• Interactive elements use semantic HTML (<button>, not a clickable <div>).
• Form inputs have associated labels.
• Motion respects prefers-reduced-motion.

5. Test in context

Paste it into a real page with real content. Long labels, small screens, and dark mode break more copied elements than anything else.

6. Note where it came from

Keep a short comment or an internal credits file: source, license, date. Future you—and your legal reviewer—will be grateful.

Where element libraries genuinely shine

• Prototypes and demos: you need something clickable today, not a design system.
• Landing pages and marketing sites: a handful of distinctive elements, each custom.
• Filling gaps: your framework lacks one specific component, and you don't want to build it from scratch.
• Learning: reading well-made CSS is one of the fastest ways to improve.
• Small projects: a personal site doesn't need a theming architecture.

Where they fall short

• Consistency at scale: ten elements from ten contributors rarely look like one product.
• Maintenance: you own every copy. When your design changes, you edit each one.
• Accessibility debt: you inherit whatever the contributor did or didn't do.
• No upstream fixes: a bug fixed in the original won't reach your copy.
• Integration friction: different naming conventions, different units, different assumptions about resets.

When to choose which

Choose an element library when the scope is small, the timeline is short, or you need a few distinctive pieces rather than a whole system.

Choose a framework or design system when multiple people build multiple screens over months, when consistency is a product requirement, or when accessibility and theming need to be guaranteed rather than checked.

A hybrid works well for many teams: adopt a framework for the structural components—forms, navigation, layout—and borrow individual elements for the places where you want personality. Just route every borrowed element through the same token and accessibility checks, so it lands as part of your system rather than beside it.

The short version: open-source UI element libraries are a fast, flexible way to get good-looking interface pieces into a project. They are not a substitute for a design system, and the license and accessibility details are the part worth reading carefully.

An Egg is Pterodactyl's portable recipe for a game server: it bundles the Docker image the server runs in, the startup command, and the configurable variables a user fills in when creating the server. You use one by installing it from the community library or writing your own, then the panel runs that game inside an isolated Docker container. This matters if you want to host multiple different games on one panel without hand-building each environment.

What an Egg actually contains

An Egg is a JSON definition. The panel reads it to know how to launch and configure a server. The core fields are:

• Docker image — the container the server runs in, so the runtime (Java, a game binary, etc.) is reproducible.
• Startup command — the exact command the panel executes to boot the server.
• Variables — configurable inputs like memory, jar file, or version, which the panel substitutes into the startup command.

Because the recipe is declarative, the same panel can run any game that has an Egg, without changing panel code.

The Paper Minecraft Egg, step by step

The site's example Egg shows how the pieces fit together:

{
  "name": "Paper Minecraft",
  "docker_image": "ghcr.io/pterodactyl/yolks:java_21",
  "startup": "java -Xmx{{SERVER_MEMORY}}M -jar {{JARFILE}}",
  "variables.SERVER_JARFILE": "server.jar",
  "variables.MINECRAFT_VERSION": "latest",
  "features": ["eula", "java_version", "pid_limit"]
}

Reading it:

1. Input — the Docker image ghcr.io/pterodactyl/yolks:java_21 provides a Java 21 runtime.
2. Action — the startup command launches Java with -Xmx{{SERVER_MEMORY}}M, where {{SERVER_MEMORY}} is filled from the server's allocated memory, and -jar {{JARFILE}} points at the jar named by the SERVER_JARFILE variable.
3. Expected result — the panel starts a Paper Minecraft server inside its own container, with memory and jar file controlled by the variables you set.

The features list (eula, java_version, pid_limit) tells the panel to apply those standard behaviors during setup.

Getting an Egg vs. writing your own

The panel lists many games that run this way, including Minecraft, Rust, ARK: Survival, Counter-Strike 2, Garry's Mod, Valheim, Terraria, Palworld, FiveM, Project Zomboid, Discord Bots, Teamspeak, SCP: SL, Factorio, and Satisfactory.

Why the container matters

Every server an Egg defines is sealed in its own Docker container with hard CPU, memory, and disk limits. The site's framing: one server can "throw the loudest party on the node, and the rest of the street sleeps through it." In practice this means a misbehaving or overloaded game server can't starve the others on the same machine.

Extending without forking

If you need to add behavior, Pterodactyl's Extensions SDK plugs into versioned panel APIs rather than core files. Extensions survive updates, and a broken one is skipped instead of taking the panel down. This is separate from Eggs — Eggs define how a game runs, extensions change panel behavior.

Practical notes before you start

• Pterodactyl is described as free, open-source, and MIT licensed, with no seats, no feature gates, and no monthly bill. That covers the panel software itself; it does not mean hosting, hardware, or bandwidth are free.
• In production since 2015, used by both small realms and large game hosts.
• Security features include bcrypt and 2FA at login, scoped tokens through Wings, and the locked-down Docker container.

To begin, install the panel, then either import an Egg from the community library or author your own JSON with the image, startup command, and variables your game needs.

Pterodactyl runs each game server inside its own Docker container with hard CPU, memory, and disk limits, so a single overloaded server can't drag down the others sharing the same node. This applies to any game installed through the panel — Minecraft, Rust, ARK, CS2, Valheim, and others — as long as the server is launched from an Egg that defines its Docker image and startup command.

The isolation model

The panel's own framing is "Noisy neighbours, contained." Every server is sealed in its own container with enforced resource ceilings. The practical effect: one server can "throw the loudest party on the node, and the rest of the street sleeps through it."

Two layers do the work:

• Docker containers separate each server's processes, filesystem, and network namespace from its neighbours.
• Hard limits on CPU, memory, and disk cap what any single container can consume, so a runaway process hits its own ceiling instead of the node's.

What you can see and control

The panel surfaces per-server resource usage directly in its interface. In the homepage demo, a server card shows:

A node-level view lists each server with its own load figure (for example mc-survival asleep · 12%, rust-eu-1 asleep · 12%), which makes it possible to spot one container consuming disproportionate resources. The demo also shows a "Click a house to move the party" interaction, illustrating that workloads can be relocated between nodes.

Why an Egg matters for isolation

An Egg is a portable recipe for a game: its Docker image, startup command, and configurable variables. Isolation depends on the Egg specifying the correct image and startup, because that's what determines the container the server actually runs in.

A representative Egg looks like this:

{
  "name": "Paper Minecraft",
  "docker_image": "ghcr.io/pterodactyl/yolks:java_21",
  "startup": "java -Xmx{{SERVER_MEMORY}}M -jar {{JARFILE}}",
  "variables.SERVER_JARFILE": "server.jar",
  "variables.MINECRAFT_VERSION": "latest",
  "features": ["eula", "java_version", "pid_limit"]
}

Note how {{SERVER_MEMORY}} feeds the allocated memory into the Java heap flag — the container limit and the application's own memory setting are tied to the same value. You can install from the community Egg library or write your own; the same panel runs all of them.

Security boundaries around the isolation

Isolation isn't only about performance. The panel describes bcrypt and 2FA at login, scoped tokens through Wings (the node daemon), and a locked-down Docker container at the end of the chain. Extensions run against versioned panel APIs rather than core files, so a broken extension is skipped instead of taking the panel down — a separate failure-isolation principle applied to the panel itself.

What this means in practice

• Shared nodes stay stable. A memory-hungry modpack or a DDoS-adjacent traffic spike is capped at its container limit rather than starving co-located servers.
• You can verify impact from the panel. Compare per-server CPU, memory, and network readings on the node view to confirm one server isn't affecting others.
• Limits are set per server, not per node. The ceiling you assign to a server is what it gets; the rest of the node's capacity remains available to its neighbours.
• The project is free and open source — MIT licensed, in production since 2015, with no seats, feature gates, or monthly bill mentioned on the site.

If you want to try it, the site points to installing the panel or joining the Discord community.

Pterodactyl is a free, open-source game server management panel built with PHP, React, and Go. It runs each game server inside its own isolated Docker container with hard CPU, memory, and disk limits, so one busy server can't drag down the others on the same machine. If you want to host one game or many, manage them from a single web interface, and avoid per-seat licensing fees, it's built for that job. It has been in production since 2015 and is MIT licensed.

What Pterodactyl actually does

At its core, Pterodactyl is a control panel that sits in front of your servers. You use it to:

• Create and manage game servers from a browser instead of juggling SSH sessions and manual config files.
• Start, restart, and stop individual servers, and watch live stats like CPU load, memory, disk usage, and network traffic.
• Isolate every server in a Docker container with enforced resource limits, so a single server can't consume the whole node.
• Install games from Eggs — portable recipes that bundle a Docker image, a startup command, and configurable variables.
• Extend the panel through an Extensions SDK that plugs into versioned panel APIs rather than modifying core files.

The panel itself is the front end; a separate component called Wings runs on each node and handles the actual container work.

Isolation: the "noisy neighbours" problem

The site frames this with a simple idea: every server is sealed in its own Docker container with hard CPU, memory, and disk limits. One server can "throw the loudest party on the node" and the rest keep running normally. In the panel's own demo, several servers sit at around 12% load while others sleep, and the counters for "noise complaints" and "evictions" stay at zero.

Practically, this means you can pack multiple game servers onto one machine without one misbehaving server starving the others of resources.

Eggs: how games get installed

An Egg is a portable recipe for a game. It defines:

You can grab an Egg from the community library or write your own. The same panel runs every one of them, and the site lists support across a wide range of games and services, including Minecraft, Rust, ARK: Survival, Counter-Strike 2, Garry's Mod, Valheim, Terraria, Palworld, FiveM, Project Zomboid, Discord bots, Teamspeak, SCP: SL, Factorio, and Satisfactory.

A sample Egg for Paper Minecraft shows the structure:

{
  "name": "Paper Minecraft",
  "docker_image": "ghcr.io/pterodactyl/yolks:java_21",
  "startup": "java -Xmx{{SERVER_MEMORY}}M -jar {{JARFILE}}",
  "variables.SERVER_JARFILE": "server.jar",
  "variables.MINECRAFT_VERSION": "latest",
  "features": ["eula", "java_version", "pid_limit"]
}

Security and extensions

• Authentication: bcrypt password hashing and two-factor authentication (2FA) at login.
• Scoped tokens: access through Wings is token-scoped rather than open.
• Container lockdown: servers run in a locked-down Docker container.
• Extensions: the Extensions SDK lets you add features (SSO, announcements, custom buttons, redirects, dark theme, and more) without forking the panel. Extensions use versioned panel APIs, survive updates, and a broken extension is skipped instead of taking the whole panel down. The demo shows a limit of 5 extensions with "core files touched: 0."

Licensing and cost

Pterodactyl describes itself as truly open source: 100% free, MIT licensed, and developed in the open, with no seats, no feature gates, and no monthly bill. The site does not list any paid tiers or pricing links, so there is no paid edition described in the available material.

Who it's for

• Weekend realms and small communities that want a clean panel without paying per-seat fees.
• Larger game hosts running many servers on shared hardware who need isolation between them.
• Developers who want to extend the panel through APIs rather than patching core files.

If you only ever run a single server and never need a web interface, a panel may be more than you need. If you're managing several servers, or expect to, the container isolation and Egg system are the main reasons to use it.

To get started, the site points to two entry points: install the panel, or join the Discord community.