Modern Docker Management UI
Website • Documentation • License
--- ## About Dockhand is a modern, efficient Docker management application providing real-time container management, Compose stack orchestration, and multi-environment support. All in a lightweight, secure and privacy-focused package. ### Features - **Container Management**: Start, stop, restart, and monitor containers in real-time - **Compose Stacks**: Visual editor for Docker Compose deployments - **Git Integration**: Deploy stacks from Git repositories with webhooks and auto-sync - **Multi-Environment**: Manage local and remote Docker hosts - **Terminal & Logs**: Interactive shell access and real-time log streaming - **File Browser**: Browse, upload, and download files from containers - **Authentication**: SSO via OIDC, local users, and optional RBAC (Enterprise) ## Tech Stack - **Base**: own OS layer built from scratch using Wolfi packages via apko. Every package is explicitly declared in the Dockerfile. - **Frontend**: SvelteKit 2, Svelte 5, shadcn-svelte, TailwindCSS - **Backend**: Bun runtime with SvelteKit API routes - **Database**: SQLite or PostgreSQL via Drizzle ORM - **Docker**: direct docker API calls. ## Bitwarden Secrets Manager The Bitwarden Secrets Manager provider requires an official `bws` client supplied by the operator. Dockhand does not include, download, or redistribute `bws`. By default the provider executes `/usr/local/bin/bws`; the process-level `DOCKHAND_BWS_PATH` setting may override this with another absolute path. Configure the Machine Account access token in Dockhand's secret-provider settings and set the stack's `DOCKHAND_SECRET_SELECTOR` to the Bitwarden Project UUID. For Bitwarden EU or a self-hosted instance, also configure the optional server URL. Dockhand applies its provider URL-safety checks and uses `bws config server-base` in an isolated temporary profile. For the official Dockhand container, mount the operator-managed executable read-only: ```yaml volumes: - /opt/dockhand-tools/bws:/usr/local/bin/bws:ro ``` Obtaining, verifying, updating, and licensing `bws` remains the operator's responsibility. ## Screenshots
Environments overview — manage every Docker host from one place |
Environment dashboard — live CPU, memory and disk metrics per host |
Containers — real-time status, resources and port mappings |
Compose stacks — deploy and orchestrate multi-container apps |
Compose editor — edit YAML side-by-side with env variables |
Images — track tags, sizes, updates and clean up unused |
Logs & terminal — stream logs with a shell next to them |
Interactive shell — exec straight into any container |
Add environment — connect via socket, agent or direct TCP |
Settings & theming — themes, fonts, scanners and schedules |
Network graph — visualize how services connect across stacks |
Container files — browse, edit, upload and download in-place |
Image layers — inspect every layer, its size and contents |
Vulnerability scans — Grype & Trivy CVE results per image |
Volume browser — explore and edit files inside any volume |
Stack graph editor — visual editor for services, networks and secrets |
Deploy from Git — pull stacks from repos with webhooks & auto-sync |
Schedules — cron-style automation for prune, updates and cleanup |
Activity log — audit every action across all environments |