Docker Commander is a self-hosted monitoring and control panel for Docker — live stats and logs, Compose, alerting and per-user permissions across every host you run. No external database, no agents, no cloud account.
brew install koduj-dev/tap/dockercmd
dockercmdPrefer Docker, a raw binary or go install? All four routes are here.
Why bother
There is no shortage of Docker dashboards. These are the four things that tend to decide it.
Download one CGO-free executable with the web UI compiled into it and run it. No database server to provision, no agent to install on each host, no reverse-proxy prerequisite. State goes in an embedded SQLite file inside the data directory. It listens on 127.0.0.1:8470 and that is the whole install.
Most dashboards stop at read-only. Here the container that just spiked is one click from its logs, a shell, its files, its limits and a restart — so diagnosing and acting are not two different tools.
Argon2id passwords, TOTP 2FA or passkeys, named roles that can be scoped to specific hosts, read-only accounts, an audit log, secrets encrypted at rest and automatic Let’s Encrypt HTTPS. Local-only by default, so exposing it is a deliberate step you take.
Self-hosted and MIT licensed. No account, no cloud tenant, no telemetry: the only request it makes on its own is the update check against GitHub Releases. Everything else it talks to is something you configured.
New in 1.7
A Compose deploy is now a loop rather than a leap: see the diff, let policy veto it, keep a revision, restore it if it goes wrong.
Features
Pick the one you came for. Nothing is reserved for a paid tier — there isn't one.
Screenshots
Captures of the running app. Click one to see it full size, next to the rest.
Who it is for
The same binary serves a single NAS and a small fleet — what changes is which half of the feature set you end up living in.
A dozen containers on a NAS or a mini-PC, plus a laptop that is offline half the time. Add hosts over SSH, disable the ones that sleep, and get an email when something crash-loops.
Staging and production on a few VPS boxes, with people who need different amounts of access. Preview every deploy, block the risky ones by policy, roll back the bad ones — and scope an operator to staging only.
When something is on fire at 03:00 you want aggregated logs with regex, live CPU and memory history, and a shell — from a phone-friendly UI rather than three SSH sessions.
Students meet real containers, images, networks, volumes and Compose projects through an interface that shows the Docker model rather than hiding it — so a lesson is spent on how Docker works, not on shell quoting and file permissions.
Let Claude Code, Claude Desktop or Cursor read your container state and perform safe restarts and deploys through an opt-in MCP server that reuses your own permissions.
Behind the project
Started by Filip Majerík to keep a handful of Docker hosts in one place, and to let university students learn Docker itself rather than fight the command line. Independent, MIT licensed, no paid tier — and openly about 95% written with AI under human review.
Read the storyWays to help
It is one binary and a named volume. If you do not like it, delete both — nothing on your Docker hosts was changed to accommodate it.
docker run -d --name dockercmd \
-p 127.0.0.1:8470:8470 \
--group-add "$(stat -c '%g' /var/run/docker.sock)" \
--read-only --tmpfs /tmp \
--security-opt no-new-privileges \
--cap-drop ALL \
-v /var/run/docker.sock:/var/run/docker.sock \
-v dockercmd-data:/data \
ghcr.io/koduj-dev/docker-commander:latestRead-only root filesystem, no added capabilities, no privilege escalation, bound to localhost. On rootless Docker or Docker Desktop, drop the --group-add line.
docker run -d --name dockercmd -p 127.0.0.1:8470:8470 \
-v /var/run/docker.sock:/var/run/docker.sock \
-v dockercmd-data:/data \
ghcr.io/koduj-dev/docker-commander:latestFewer flags, and correspondingly fewer guardrails. Fine for a throwaway look on a machine you do not mind losing; the hardened form above is what belongs on anything you keep.
MIT licensed · no account · no telemetry · Linux, macOS and Windows