Comparison
How it differs from the usual suspects
All five are good tools and they overlap more every release — this is where Docker Commander is deliberately different, and where another tool does more. Checked against each project's documentation and source in October 2026.
| Capability | Docker Commander | Portainer CE | Dozzle | Arcane | Lazydocker |
|---|---|---|---|---|---|
| Interface | Web UI | Web UI | Web UI | Web UI + mobile apps | Terminal UI |
| Scope | Monitor + full control | Monitor + full control | Logs + optional controlStart/stop/restart/remove/update are opt-in and role-gated, off by default | Monitor + full control | Monitor + control |
| Runtime dependencies | One binary, embedded SQLite | Container with embedded DB | One container image | One container image | One CLI binary |
| Multi-host | YesAgentless — TCP+TLS or SSH | YesAgent / Edge agent, or direct Docker API (TCP+TLS, legacy) | YesAgent per host (or legacy remote TCP+TLS) | YesAgent per host (direct or outbound edge, mTLS) | Not built inOne daemon at a time — local or via DOCKER_HOST / docker context |
| Two-factor / passwordless login | YesTOTP or WebAuthn passkeys, enforced by default | Not built inPassword, LDAP/AD or OAuth — MFA only via the identity provider | Not built inLogin optional; GitHub/OIDC sign-in can delegate MFA | YesPasskeys and recovery codes; no TOTP | Not built inNo login of its own — relies on Docker / SSH access |
| Aggregated logs across containers | YesLevel detection, regex, parse rules | Not built inPer container | YesIts whole purpose | PartiallyPer container and per project | Not built inPer container |
| Built-in alert rules → webhook / email | YesState, resource, network, log-pattern, crash-loop → webhook & e-mail, with retry | Not built inAlerting is Business Edition only | PartiallyLog, metric & event alerts → webhook/Slack/Discord/ntfy; e-mail only via hosted Dozzle Cloud | PartiallyEvent notifications for updates, CVEs and auto-heal via SMTP, chat and webhooks; no general threshold/log-rule engine | Not built in |
| Maintenance windows / alert silencing | YesScoped, one-off or weekly; auto-silence after a deploy | Not built inSilences are Business Edition only | Not built inPer-rule on/off and cooldown | Not built in | Not built in |
| Prometheus exporter | Yes | Not built in | Not built in | Not built in | Not built in |
| Compose editing in the UI | YesValidated editor + templates | YesSchema-validated editor, templates, Git-backed stacks | Not built in | YesCompose and .env editors, templates, Git sync | Not built in |
| Deploy preview & rollback | YesDiff before deploy, drift detection, a revision per deploy, validated atomic restore | PartiallyOne step back to the previous stack file | Not built inNo general deployment preview/history; failed image updates are automatically reverted | Not built in | Not built in |
| Policy checks before deploy | YesPrivileged, host namespaces, socket, :latest, limits, healthcheck — off / warn / block | PartiallyRestricts privileged, bind mounts, host PID… for non-admins only | Not built in | Not built in | Not built in |
| Automatic HTTPS (Let’s Encrypt) | YesFor the panel, and per container via the opt-in proxy | Not built inOwn or self-signed certificate | Not built inTLS at a reverse proxy | Not built inOwn certificate or a reverse proxy | n/aNo network listener |
| Backups | YesSelf-backup, recovery bundle, volume jobs wrapping your restic/borg | PartiallyManual config download; scheduled & S3 are Business Edition | Not built in | YesBuilt-in Rustic volume backups, local or S3, scheduled | Not built in |
| Image updates | PartiallyDetects a new digest and alerts; does not apply it yet | Not built inUpdate indicator is Business Edition only | YesManual, bulk and scheduled auto-update; failed updates restore the previous container | YesScheduled auto-update | Not built in |
| MCP server for AI assistants | YesOff by default, RBAC-scoped, read + safe control | PartiallySeparate, unsupported portainer-mcp server | YesRead-only, built-in, with OAuth/session-token auth; inherits roles and container filters | Not built in | Not built in |
| Image vulnerability scanning | YesTrivy, in-app, with CVE triage | Not built in | Not built in | YesTrivy, with ignore and CSV export | Not built in |
Sources
- Docker Commander — README & docs
- Portainer CE — docs.portainer.io
- Dozzle — Dozzle docs
- Arcane — getarcane.app/docs
- Lazydocker — GitHub README
A cross has one meaning here: not documented as a built-in feature in the source above. Several of these projects cover the same ground through plugins, agents or a paid edition.