How to Deploy a Flask App to Production (Gunicorn + PostgreSQL, 2026)

Flask's development server prints a warning for a reason: it's for your laptop. In production you want a real WSGI server, configuration from the environment, and a database that isn't SQLite on a disk that disappears. Here's the whole path to a live HTTPS URL.

1. Structure the app#

# app.py
import os
from flask import Flask, jsonify
from flask_sqlalchemy import SQLAlchemy
 
app = Flask(__name__)
app.config["SECRET_KEY"] = os.environ["SECRET_KEY"]
app.config["SQLALCHEMY_DATABASE_URI"] = os.environ["DATABASE_URL"].replace(
    "postgresql://", "postgresql+psycopg://", 1
)
db = SQLAlchemy(app)
 
class Note(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    text = db.Column(db.String(500), nullable=False)
 
@app.get("/health")
def health():
    return {"status": "ok"}
 
@app.get("/notes")
def notes():
    return jsonify([{"id": n.id, "text": n.text} for n in Note.query.all()])

The replace call selects the psycopg 3 driver for SQLAlchemy.

# requirements.txt
flask
flask-sqlalchemy
flask-migrate
gunicorn
psycopg[binary]

2. Gunicorn, configured for you#

DockHosting detects Flask from flask in your requirements and runs it under Gunicorn:

gunicorn app:app

That's module:variable. If you use an application factory, point Gunicorn at it by overriding the start command in the project settings:

gunicorn "myapp:create_app()" --workers 2 --bind 0.0.0.0:$PORT

Two workers per 512 MB is a safe start. Each worker is a full copy of your app in memory.

3. Migrations with Flask-Migrate#

flask --app app db init       # once, locally
flask --app app db migrate -m "notes table"

Commit the migrations/ folder, and apply migrations on each release as part of the start command:

flask --app app db upgrade && gunicorn app:app

4. Deploy#

curl -fsSL https://cli.dockhosting.dev/install.sh | sh   # Windows: irm https://cli.dockhosting.dev/install.ps1 | iex
dock login
dock deploy

Then:

1. Create a managed PostgreSQL database and attach it. DATABASE_URL is injected over the private network.
2. Set SECRET_KEY in the environment variables (python -c "import secrets; print(secrets.token_hex(32))").
3. dock restart, then open https://<project>.dockhosting.cloud/health.

5. Production checklist#

• SECRET_KEY comes from the environment, never from the code.
• Debug is off, and app.run() isn't called at import time.
• Gunicorn workers are sized to your plan's memory (512 MB on Free, 1 GB on Hobby).
• Static files are served from static/ or a CDN for heavy assets.
• A /health route makes failed deploys obvious.

Seeing 502s? Work through the 8 causes of a 502. Building a larger app? Compare with the Django and FastAPI guides.