Dockhand

Product Introduction

1. Definition: Dockhand is a self-hosted, enterprise-grade Docker container management platform. It is a comprehensive web-based GUI and API designed for managing Docker hosts, containers, and Compose stacks across local, remote, and firewalled environments.
2. Core Value Proposition: Dockhand exists to simplify and secure Docker operations for individuals and teams, offering a powerful, unified interface for container orchestration, security scanning, GitOps workflows, and multi-host management without the complexity or cost of traditional enterprise tools.

Main Features

1. Multi-Host Docker Management: Dockhand provides a single pane of glass for managing Docker engines across diverse infrastructures. It supports local Docker sockets, remote TCP connections with TLS, and can manage hosts behind NAT or firewalls using its open-source Hawser agent, which establishes secure, outbound-only connections.
2. Visual Compose Stack & GitOps Deployment: Users can deploy, manage, and update Docker Compose stacks through a visual editor, eliminating YAML syntax headaches. It features deep Git integration, allowing stacks to be deployed directly from Git repositories (via SSH or HTTPS) with support for webhook triggers and scheduled syncs for automated GitOps workflows.
3. Integrated Security & Vulnerability Scanning: Security is built-in. Dockhand performs pre-deployment vulnerability scanning on container images using Grype and Trivy engines, with a dedicated CVE dashboard. It integrates with external secrets managers (1Password, HashiCorp Vault, Infisical, Doppler) to inject secrets at runtime. The platform itself is hardened, built from scratch using Wolfi packages via apko for a minimal, transparent base image.
4. Comprehensive Observability & Operations: The platform offers real-time monitoring including live CPU/memory metrics, ANSI-color log streaming with filtering, and an interactive web-based container terminal. It maintains a full container activity log for audit trails and provides a Prometheus /metrics endpoint for integration with external monitoring tools like Grafana.
5. Enterprise Authentication & Access Control: Dockhand includes robust identity management. The Free edition offers OIDC/SSO and multi-factor authentication (TOTP) at no cost. The Enterprise edition adds LDAP/Active Directory integration, granular Role-Based Access Control (RBAC), and environment-scoped permissions for compliance-ready access management.
6. Encrypted Backup & Restore: A built-in backup system, powered by restic, enables encrypted, deduplicated backups of container volumes, bind mounts, and stack files. Backups can be scheduled and sent to destinations including local storage, S3, Google Cloud Storage, Azure, and Backblaze B2, with policies for retention and restoration.

Problems Solved

1. Pain Point: Fragmented and insecure Docker management. Users often juggle command-line tools, separate dashboards for different hosts, and lack integrated security scanning and secret management, leading to operational overhead and security risks.
2. Target Audience: Homelab enthusiasts, DevOps engineers, SREs, and IT administrators in small to medium businesses and enterprises who need to manage Docker containers reliably and securely across one or many hosts.
3. Use Cases: Centralized management of a hybrid Docker fleet (local lab, cloud VPS); implementing secure GitOps pipelines for application deployment; enforcing pre-production security scans and compliance; providing developers with controlled, audited access to container management without full shell access.

Unique Advantages

1. Differentiation: Unlike some popular tools, Dockhand offers enterprise features like free SSO/OIDC and vulnerability scanning in its $0 tier. It is more security-focused out-of-the-box, with a hardened, self-built container image and safe-pull protection. Its pricing is transparent and host-based, not user-based, avoiding "SSO tax."
2. Key Innovation: The "Hawser" agent for managing firewalled hosts is a significant technical innovation, allowing secure management of Docker hosts without requiring inbound firewall rules or exposed ports. Its commitment to zero telemetry and a fully open-source core (BSL 1.1, converting to Apache 2.0) also sets it apart in terms of trust and transparency.

Frequently Asked Questions (FAQ)

1. Is Dockhand really free for commercial use? No, the Free edition is for personal, non-commercial use. Commercial usage requires a paid SMB ($499/host/year) or Enterprise ($1,499/host/year) license, which includes a commercial license, premium support, and priority bug fixes.
2. How does Dockhand compare to Portainer? Dockhand positions itself as a modern alternative with a stronger emphasis on built-in security (vulnerability scanning, secret injection), a more intuitive GitOps workflow, and transparent pricing that includes core enterprise features like SSO in its free tier. It also differentiates with its Hawser agent for NAT traversal.
3. Can Dockhand manage Docker Swarm or Kubernetes? No, Dockhand is specifically designed for managing Docker containers and Compose stacks on individual Docker hosts or fleets of hosts. It does not manage Docker Swarm clusters or Kubernetes pods; it focuses on being the best tool for Docker Engine management.
4. Where is my data stored when using Dockhand? All data is stored on your infrastructure. Dockhand is self-hosted only; it has zero telemetry and no cloud dependencies. Your configuration, logs, and secrets never leave your network, ensuring complete data sovereignty.
5. How does the vulnerability scanning work? Dockhand integrates the Grype and Trivy scanners. During automated updates, it can be configured to use "safe-pull protection," where a new image is pulled to a temporary tag, scanned, and only promoted if it passes your defined CVE thresholds. This prevents vulnerable images from automatically replacing running containers.