Dockhand - a simple web UI for managing Docker

#

If you’re tired of constantly working in the terminal, you’re not satisfied with Portainer, and you want to quickly manage containers through a browser — Dockhand could be a great solution.

I’ve seen plenty of Portainer replacements come and go. But none of them ever quite lived up to its feature set.

In fact, there aren’t that many real competitors to Portainer:

• Komodo - a fully open source solution, but the developers are clearly aiming straight at the enterprise sector.

• Arcane - I personally haven’t tried it, so I have no opinion.

• Dockge - but of course this isn’t a full replacement. Its target audience is strictly homelabbers, and its feature set is somewhat simplified, but only compared to solutions built for a professional environment.

And the hero of today’s review

Dockhand is a lightweight and minimalist web UI for Docker that fits nicely into any homelab and works especially well paired with the Traefik reverse proxy.

Dockhand’s capabilities

#

Dockhand isn’t just a web UI for Docker — it’s a full-fledged container infrastructure management tool focused on convenience, automation, and security.

Below is an overview of just some of its capabilities.

Container management

#

Dockhand gives you full control over containers without needing the CLI:

• Start, stop, restart, and remove containers

• Create containers with advanced configuration

• View processes inside a container

• Access environment variables (env vars)

• A built-in web terminal (no SSH required)

• View and transfer files inside a container

This makes Dockhand a great replacement for basic CLI operations.

Docker Compose and Stacks

#

Working with multi-container apps is implemented as conveniently as possible:

• Support for Docker Compose and stacks. You can even manage stacks created outside the app (I explain how to achieve this in the video)

• Visual Compose editor (no need to write YAML by hand)

• Deploy stacks directly from Git repositories

• Automatic sync on push (via webhooks)

• Re-pulling images and forced redeploys

• Importing projects from other container managers

• A scheduler for updates and deployments

A great option for a GitOps approach in a homelab.

Observability capabilities

#

Dockhand gives you full real-time control over container state:

• Live CPU and memory metrics for each container

• Real-time streaming logs (with ANSI colors)

• A container activity log

• Disk usage monitoring

• Notifications via email and webhooks

All of this without needing to set up Prometheus and Grafana.

Security

#

Dockhand offers powerful built-in security mechanisms:

• OIDC / SSO support (any provider)

• LDAP / Active Directory integration (paid feature)

• Role-Based Access Control (RBAC) (paid feature)

• Vulnerability scanning (Grype / Trivy)

Easy to plug into an existing IAM infrastructure.

Multi-host management

#

Dockhand isn’t limited to a single Docker host:

• Connect via a local Docker socket

• Support for remote Docker hosts (TCP + TLS)

• A Hawser agent for bypassing NAT and firewalls

• Fast switching between environments

• Separate dashboard tiles for each environment

Convenient for managing multiple servers from a single interface.

UI customization

#

Dockhand can be adapted to your liking:

• Light and dark themes

• Adjustable font size

• Column management (hide, show, reorder)

• Resizable dashboard tiles

• Saved user preferences

The interface is genuinely flexible, not just “take it or leave it.”

Transparency and license

#

Dockhand is committed to openness:

• Full source code available on GitHub

• The code is fully open for inspection

• A move to the Apache 2.0 license is planned for 2029

Approach: “Trust, but verify” — and here that’s actually possible

System requirements

#

System requirements

#

Important before installing

#

/var/run/docker.sock

This means that:

• the container gets full access to Docker
• effectively, root access to the system

Recommendations:

• only use it on a trusted network
• lock down access via a reverse proxy (for example Traefik + auth)

The docker compose file used in the video

#

services:  # Секция описания сервисов (контейнеров)

  dockhand:  # Имя сервиса (используется внутри compose)

    image: fnsys/dockhand:latest  # Docker-образ (берётся из Docker Hub, тег latest = последняя версия)

    container_name: dockhand  # Явное имя контейнера (удобно для управления и логов)

    restart: unless-stopped  # Политика перезапуска (перезапускать всегда, кроме ручной остановки)

    #ports:  # Проброс портов (сейчас отключён)

    #  - 3000:3000  # Хост:контейнер (если включить - доступ напрямую без Traefik)

    volumes:  # Монтирование томов (данные и сокеты)

      - /var/run/docker.sock:/var/run/docker.sock  # Доступ к Docker API (контейнер управляет Docker ⚠️)

      - /home/stilicho/docker/dockhand/data:/app/data  # Локальная папка для хранения данных приложения

    networks:

      proxy:  # Подключение к сети proxy (используется Traefik)

    labels:

      - "traefik.enable=true"  # Включаем Traefik для этого контейнера

      # =========================

      # HTTP ROUTER (порт 80)

      # =========================

      - "traefik.http.routers.dockhand.entrypoints=web"

      # Traefik слушает входящий трафик на entrypoint "web" (обычно :80)

      # сюда попадает http://dockhand.stilicho.ru

      - "traefik.http.routers.dockhand.rule=Host(`dockhand.stilicho.ru`)"

      # Правило: если Host совпадает - используем этот router

      # Traefik сравнивает заголовок Host

      - "traefik.http.routers.dockhand.middlewares=dockhand-https-redirect"

      # Применяем middleware (редирект на HTTPS)

      # ДО проксирования в контейнер

      - "traefik.http.middlewares.dockhand-https-redirect.redirectscheme.scheme=https"

      # Сам middleware:

      # Traefik НЕ отправляет запрос в контейнер

      # он сразу отвечает клиенту:

      # 301 Redirect → https://dockhand.stilicho.ru

      # =========================

      # HTTPS ROUTER (порт 443)

      # =========================

      - "traefik.http.routers.dockhand-secure.entrypoints=websecure"

      # Входящий HTTPS трафик (обычно порт 443)

      - "traefik.http.routers.dockhand-secure.rule=Host(`dockhand.stilicho.ru`)"

      # То же правило по домену

      - "traefik.http.routers.dockhand-secure.tls=true"

      # Включаем TLS:

      # Traefik завершает SSL (TLS termination)

      # расшифровывает HTTPS → дальше работает как HTTP

      - "traefik.http.routers.dockhand-secure.service=dockhand"

      # Указываем, в какой service отправлять трафик

      # router → service связка

      # =========================

      # SERVICE (куда идёт трафик)

      # =========================

      - "traefik.http.services.dockhand.loadbalancer.server.port=3000"

      # Ключевая строка:

      # Traefik берёт IP контейнера в сети proxy

      # и делает запрос:

      # http://dockhand:3000 (внутри Docker-сети)

      # НЕ через localhost и НЕ через ports

      # =========================

      # СЕТЬ

      # =========================

      - "traefik.docker.network=proxy"

      # Указываем, в какой сети искать контейнер

      # важно, если контейнер в нескольких сетях

      # Traefik возьмёт IP именно из сети proxy

# Описание сетей

networks:

  proxy:

    external: true  # Сеть уже существует (создана отдельно, например для Traefik)

I’m using the built-in SQLite3 database, but the app can also work with Postgres.

You can find more details on the various installation options on the official website

First launch

#

After starting the container and navigating to the subdomain, I was unpleasantly surprised by the lack of an initial user registration screen. From my point of view, this isn’t the most optimal solution. It would still be better to force careless users to create an initial user. Let’s hope the developers implement this feature in the future.

As a result, we’re greeted by an empty panel, because we haven’t connected our first environment yet.

Dashboard

#

The Dockhand dashboard gives you a clear, real-time overview of all your Docker environments. The interface is built around tiles, each representing a separate environment.

Tiles can be:

• resized
• moved around the screen
• customized to fit your workflow

This lets you adapt the interface to specific tasks and priorities.

Environment Tiles

#

Each Docker environment is displayed as a separate tile with key information:

Environments

#

• Environment name
• Icon
• Connection status

This lets you immediately see whether an environment is available, which I find very convenient.

Containers

#

• Number of running containers
• Number of stopped containers
• Total number of containers

Lets you quickly keep track of the state of your infrastructure.

In the containers section you can instantly assess the number of containers, their state, health, and the amount of resources they’re consuming. This lets you instantly gauge the load on the system, which is also very useful.

Health Status

#

• Warnings about problems
• Containers in the following states:
  • unhealthy
  • restarting

Helps you quickly spot failures and unstable services.

Dockhand lets you check for container updates in their repositories, which, in my opinion, is a “killer feature” that, for example, lets me replace the Diun app. You can even set up automatic container updates. That last one, in my view, is a rather unsafe feature, since it can lead to installing containers with bugs that could make the system stop working. It’s still better to read the changelog first. So, as I see it, being notified that updates are available is very convenient, while auto-updating is more for enthusiasts.

Vulnerability scanning.

#

Dockhand has a built-in container vulnerability scanning feature. On paper this sounds very appealing, but in practice this feature is completely useless. Built-in tools will always find vulnerabilities (that could be the subject of a separate article), which, first, will cause panic among newcomers, and second, will lead the system to block the container from running. Even though, in fact, it’ll be a perfectly healthy corpse container.

Status indicators are shown in the header of each tile:

App screenshots

#

Conclusion

#

The Dockhand dashboard gives you:

• A full overview of all your environments in one place
• Fast problem diagnosis
• Convenient visualization of load and activity
• Flexible interface customization

And as a result — Dockhand is a great replacement for Portainer in a home environment, and a great choice if you want a balance between simplicity and functionality.