Skip to content

Users & access

Several people, one panel, real boundaries

Second factors on by default, named roles scoped to hosts, read-only accounts, directory login and an audit log that names the host — for a tool that holds the keys to your servers.

This page answers

  • Give a reviewer read-only access
  • Sign in with a passkey
  • Who stopped that container, and on which host?
  • Log in with our Active Directory account
  • Sign out the laptop I just lost

Second factors, self-served

TOTP or passkeys, enforced by default. Every account manages its own authenticators, changes its own password, and sees its live sessions by device and address — ending any one of them, or all the others at once.

127.0.0.1:8470
The profile security tab: second factors, passkeys and live sessions.

An audit log that says where

Who did what and when — with the detail of how it happened and the host the action actually reached, searchable. A reader limited to some hosts only sees those hosts’ entries.

127.0.0.1:8470
The audit log with user, action, detail and host columns.

The complete list

Everything in users & access

Multi-user with real boundaries.

  • Argon2id passwords with TOTP 2FA or passkeys (WebAuthn) — a verified passkey can sign in on its own, with the password kept as the recovery route. Rate limiting, strict headers and signed HttpOnly cookies.
  • An account can hold several authenticators, change its own password (ending its other sessions), and see and end its own live sessions.
  • Named RBAC roles bundle section grants (two ship built in, or duplicate and edit your own), and a role can be scoped to specific hosts. Read-only accounts see lists and metadata but cannot download raw content.
  • Optional LDAP / Active Directory login with auto-provisioning; a directory group can grant a named role, re-derived on every login.
  • An audit log of who did what, with the detail and the host the action reached — including actions taken over MCP.
  • Registry, SMTP and LDAP secrets, project secrets and host TLS private keys encrypted at rest with AES-256-GCM.
  • dockercmd --reset-password recovers a locked-out admin without stopping the server.

In the user manual

Try it on one host tonight

It is one binary and a named volume. If you do not like it, delete both — nothing on your Docker hosts was changed to accommodate it.

Docker Commander v1.7.2 — Docker, hardened
docker run -d --name dockercmd \
  -p 127.0.0.1:8470:8470 \
  --group-add "$(stat -c '%g' /var/run/docker.sock)" \
  --read-only --tmpfs /tmp \
  --security-opt no-new-privileges \
  --cap-drop ALL \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v dockercmd-data:/data \
  ghcr.io/koduj-dev/docker-commander:latest

Read-only root filesystem, no added capabilities, no privilege escalation, bound to localhost. On rootless Docker or Docker Desktop, drop the --group-add line.

Show the minimal command
Docker — minimal
docker run -d --name dockercmd -p 127.0.0.1:8470:8470 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v dockercmd-data:/data \
  ghcr.io/koduj-dev/docker-commander:latest

Fewer flags, and correspondingly fewer guardrails. Fine for a throwaway look on a machine you do not mind losing; the hardened form above is what belongs on anything you keep.

Download v1.7.2Star on GitHub

MIT licensed · no account · no telemetry · Linux, macOS and Windows