Laravel SaaS Starter Kit (Container Edition)

Engineering & Development

A containerised edition of a Laravel SaaS starter framework: authentication, the skeleton for subscription billing, roles and permissions, a blog and an admin area; Docker Compose builds it and brings it up, with SQLite as the database.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-02

In practice

Readiness4 / 5

What you need

Few changes needed4 / 5

Who it is for

PHP/Laravel solo developers and small teams who want a subscription SaaS up quickly: authentication, subscription billing, roles and permissions, an admin area and a blog are all there already; our containerisation also removes the first mile of Herd or of installing the toolchain by hand.

How to start

$ docker compose up -d --build

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview728 paths

▸app59

Console/
Filament/
Http/
Listeners/
Models/
Notifications/
Providers/

▸bootstrap3

app.php
cache/
providers.php

▸config33

.gitkeep
activity.php
app.php
auth.php
database.php
devdojo/
discussions.php
features.php
filament-google-analytics.php
filament.php
…

▸database29

.gitignore
factories/
migrations/
seeders/

▸docker1

entrypoint.sh

▸lang16

ar/
fa/
it/
pl/

▸public245

.htaccess
auth/
billing/
build/
composer/
css/
favicon.ico
fonts/
index.php
js/
…

▸resources133

css/
plugins/
themes/
views/

▸routes3

api.php
console.php
web.php

▸storage25

app/
database.sqlite
dump.sql
framework/
logs/
pail/
test/
wave-logo.png
wave-svg.sketch

▸tests27

Datasets/
Feature/
Pest.php
TestCase.php
Unit/

▸wave120

composer.json
database/
resources/
routes/
src/
wave.json

▫ATTRIBUTION.md

▫CLAUDE.md

▫CODE_OF_CONDUCT.md

▫CONTRIBUTING.md

▫Dockerfile

▫LICENSE-99LL.md

▫LICENSE.md

▫PRODUCT.md

▫QUICKSTART.md

▫README.md

▫SECURITY.md

▫SECURITY.upstream.md

▫artisan

▫composer.json

▫delivery-manifest.txt

▫docker-compose.yml

▫package-lock.json

▫package.json

▫phpunit.xml

▫pint.json

▫postcss.config.js

▫tailwind.config.js

▫theme.json

▫vite.config.js

▫Config and hidden files 10

Latest passing run

Clone → Checkout → Toolchain → Container up

Pre-purchase Disclosure

What you are buying

A containerised Laravel SaaS starter kit: unzip the file and Docker Compose builds it and brings it up, with a marketing home page, sign-up and sign-in, the skeleton for subscription billing, roles and permissions, a blog and an admin area; the first start generates the application key, creates the SQLite database and seeds demo data.

A derivative build on top of an MIT-licensed open-source SaaS framework, not the original project itself.

Delivery is a frozen snapshot: one zip file, taken from the product repository at revision 3e1f6b8.

Known limitations

The quickstart configuration is for development and evaluation: debug mode on, a single-machine development server and SQLite — it is not a production deployment configuration
The payment (Stripe/Paddle) keys are placeholder values and mail is written to the log rather than sent out; it only works once you connect your own keys and SMTP
The default administrator account and password for the admin area are fixed public values, the same in every delivery
The first start fetches from Docker Hub, Packagist and npm to build the images; a fully offline first start cannot complete
The delivered configuration listens on port 8080 over plain HTTP (artisan serve), with no TLS and no reverse proxy
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit d5f7ed2. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

4 PASS1 WARN0 FAIL

Source ReviewPASS

A targeted scan of the execution surface of the delivery tree (in 2026; all the PHP under app/ and wave/src, excluding vendor and tests): zero occurrences of shell_exec/proc_open/passthru/eval/exec; base64_decode appears once, at wave/src/Http/Middleware/VerifyWebhook.php:33, used for webhook signature verification (a reasonable use). Upstream is a public project. The source was not read line by line in full (a whole Laravel application, tens of thousands of lines); the scope and method of the scan are recorded here as they were.

Script SafetyPASS

The composer.json scripts were read one by one: post-autoload-dump only runs Laravel's own ComposerScripts and artisan package:discover / storage:link / filament:upgrade / livewire:publish; post-create-project-cmd only runs key:generate / touch sqlite / migrate / db:seed; the package.json scripts are only vite / vite build. The docker/entrypoint.sh we added is a product of this work: key and JWT generation, migrate, and seeding only on the first start, with no outbound connections.

RecencyPASS

At the time of vetting (2026) upstream was not archived and still had new commits that year (checked directly with gh api). The pinned commit d5f7ed2 was the main HEAD on the day of that check.

LicensePASS

SPDX:LicenseRef-99LL-Product

Upstream's LICENSE was read word for word (the evidence URL points at the file itself at the pinned commit, not at GitHub's licence field): LICENSE.md is the standard MIT text, Copyright (c) DevDojo — commercial use, modification, derivative works, redistribution and sale are permitted, and the obligation is to keep the copyright notice and the full licence text (LICENSE.md and ATTRIBUTION.md are delivered with the zip). For the product as a whole, the 99LL product licence template is attached: upstream's LICENSE.md is kept verbatim, and LICENSE-99LL.md is added (at the root of the delivery tree, tag v0.1.0-99ll.3) as the sale and liability terms for the part we built; spdx is recorded as LicenseRef-99LL-Product.

Dependency LicensesWARN

The required composer dependencies were checked package by package (in 2026): laravel/framework, filament/filament, livewire/livewire, spatie/laravel-permission, stripe/stripe-php, tymon/jwt-auth and devdojo/auth are all MIT; ⚠️ devdojo/app 0.11.0 and devdojo/themes 0.0.11 carry no licence declaration (the packagist licence field is an empty [], the repository master has no LICENSE file, and composer.json has no licence field — all checked directly) — both are first-party packages published for Wave by the same house as upstream, DevDojo, and the intent that they be distributed together with Wave (MIT) is clear, but express terms are missing, so the licence status is flagged as uncertain.