I've been self-hosting stuff for about, what, 5 years now? It started with Kubernetes on the Raspberry Pi cluster. Eventually, that moved to pure docker on a used Lenovo mini PC. After that, it split up into several different machines over different networks. Some are local, some are remote. It's a whole mess now. Throughout all of my experimentation up until this point, the outcome has always been the goal. Fairly tunnel-visioned: set up a service to solve a problem and get it into the hands of users as soon as possible. Everything else falls to the wayside. You may consider this mentality the IT sector's equivalent of Development's "move fast and break things." I'd agree. But over the past few years, especially as I've grown in the sysadmin role, I've come to learn that the one-time lift for setup is the smallest part of the project. Ongoing maintenance—backups, monitoring, patching, devops, etc.—is where 99% of the work lies, and all of that is far more important in the long-term. I've implemented full rollouts of cronjob rsync backups, Azure RSVs, Azure Update Manager, Nagios, PRTG, and many other reliability solutions over the course of my career, but I'll be the first to admit that my homelab and own hosted services were always lacking. The classic "physician, heal thyself" shortcoming I think many home tinkerers can fall victim to. This is one of the reasons that I believe this site had gotten hacked earlier this year. I had mainly set it and forgot about it, which meant I was never alerted when the site was hit by an API exploit which allowed an attacker to upload a theme with embedded crypto mining scripts on it. ...Yeah, I own up to this. I took the site down for a week and remediated it; updated everything, spent days cleaning the database, moved to IaC & GitOps, made a brand new theme, provisioned brand new infrastructure. But all that doesn't negate that the event should not have happened in the first place. With good intentions, I had always planned to address the ongoing procedural shortfalls that led to that hack someday, but... At work I'm paid to deal with it. At home? Not so much. Ergo, it kept getting pushed to the back burner. ...That was until the other day. * * * I've long been a reluctant user of Portainer, the Docker management tool that allows you to spin up containers and compose stacks through the browser, so you didn't need to SSH in anymore. Its UI wasn't the best, and it had a tendency to error out on me a lot, but it had multi-node management and generally worked enough. And as the old southern saying goes: If it ain't broke, don't fix it. Well, that changed after their announcement on the 11th. Essentially, Portainer stated that Version 2.45 would be the last version with Docker support. They were abandoning it entirely and shifting all focus onto its newer and cooler cousin: Kubernetes. Use this Docker-to-K8S translation layer if you want to keep using our tool. Suck it up. One big problem with that announcement: I already tried the newer and cooler cousin. I hated it. I appreciated my time with it, but I hated it. I despised how every action in k8s required a YAML file, and that I had to learn thirty different schemas just to make network volumes work. I loathed spending half of my time debugging what went wrong with the network and took Ghost down again. (Hint: DNS.) I hated having to fix nodes that got overloaded and went down _constantly_. Kubernetes may be a solution that works well for enterprises, but I am one dude with a day job, and the technical time and knowledge needed to effectively maintain the system made me _miserable_. I had no desire to move on from Docker, which meant I needed something to replace Portainer, and while I was already in the mines, should probably touch up on all of the failures that had haunted me till this point. My reckoning had arrived. At the start, I just did what I do best: ...Keep putting it off because it was a bandaid that I really didn't want to rip off. I figured I'd keep using Portainer till the wheels fell off, and would keep kicking the can down the road as long I could. And then, one fateful morning, I stumbled upon this post from mariushosting on r/selfhosted: > Hey Portainer, Dockhand is my new home. > by u/mariushosting in selfhosted Like an angel sent from heaven, this post descended unto me and granted me the inspiration I so _desperately_ needed. Lots of upvotes from other former Portainer users? The UI looks good and is pretty easy to use. It has support for multiple nodes. Supports SSO. Has GitOps deployments... That checks about all the boxes. Sure, I'll consider giving this a shot. And then I kept reading. 0:00 /0:05 1× _Dude_. * * * I spent most of my Friday lunch break and evening migrating my resources over from Portainer over to Dockhand, and I don't think a single piece of software has ever won me over this fast. It took me about 2 hours to achieve same-state. Having bound the docker socket, it automatically recognized all of my existing containers. I set up Entra OIDC like I do with all my apps, took me about 5 minutes. Most of my time was spent transferring the compose files between platforms, but once that was done? I was off to the races. Rather than sit here for hours and go feature by feature, I think the best way to highlight how Dockhand has revolutionized the way I host software is to just walk through one of the cooler projects this tool has enabled: This site's CI/CD pipeline! Over the past few months the infra behind the scenes has matured significantly from just a single compose file, and its current iteration highlights a lot of what I want to show off. First off, let's talk about what it takes to make this site tick. Like most production-ready Docker applications nowadays, the solution rarely ends with a single container. The revamp a couple months ago required me to redo the compose definition and add several other services to the stack in order to get analytics and ActivityPub (i.e. Mastodon, Bluesky) federation to work. This site actually requires **five** different services to make it run smoothly, namely: * **Ghost** (ghost:6-alpine) – The core software that serves the blog and provides much of its features * **MySQL** (mysql:9) – The database that stores all of the persistent data behind Ghost * **Caddy** (caddy:2-alpine) – The proxy that routes traffic between the Ghost container, Analytics container, and Ghost's hosted ActivityPub servers. * **Analytics** (ghost/traffic-analytics:1.0) – The service that integrates with tinybird and powers Ghost's built-in analytics engine. * **TB-Deploy** (Dockerfile) – A custom oneshot container that dynamically fetches the tinybird schemas embedded in the main ghost image and deploys them before starting the analytics container. And that's not even to mention the many custom scripts, Dockerfiles, plugins, and other embedded tools that go into making this site function, which necessitated converting the project from two containers to a full on IaC repo. But once this lift had been done, it meant that the _sweet nectar of deployment pipelines_ was ripe for the taking. I host this site on a VPS for reliability purposes. My home internet is spotty at best and goes down frequently, so keeping my "production" services on a host with at least 99.9% uptime and platform-level backups was a must. I had done some work shortly after the hack to set up a Wireguard VPN tunnel to facilitate unidirectional connections from my Homelab to the VPC's network. This groundwork meant that Dockhand was in the perfect spot to be able to manage my entire fleet from one page. I deployed Hawser (Dockhand's agent) on the prod server and—using the tunnel and self-signed TLS—connected it back to Dockhand's main pane of glass. Here, I can see all of my production services alongside all of the ones I have running at home, and I can see when any one of those containers has updates pending or resource issues. Sweet! 1 update pending! This also meant that my VPS, in effect, now also had all of the same features that my internal network had, including GitOps! I was able to wire my local Gitea instance straight into Dockhand and get it to automate deployments for me. This was achieved through the implementation of two integrations: 1. **The Git Deploy Key** needed to allow the Dockhand to ssh into Gitea and fetch changes from the repo as needed. 2. **Webhooks** , which Gitea uses to call back to Dockhand. This tells it to fetch the latest version and redeploy as soon as a push event is detected on `main`. All combined, this means that from now on, I am able to go from commit to deploy in _just under 3 minutes,_ with full resource monitoring. Sick. And I'll admit, this isn't entirely new. I had a similar situation set up with Portainer, but I could never get it to work with Gitea properly and had to use Gitea's mirroring functionality to push changes up to a private GitHub repo, which the Portainer agent on production would then use to pull down changes. Being able to eliminate GitHub from the entire equation elates me, as it means that the CI/CD pipeline _is now 100% self-hosted_. 🎉 The similarities between Portainer and Dockhand end here, though. The first major feature Dockhand added that I am absolutely ecstatic over is container auto-updates. On defined schedules, Dockhand will check and see if a new version has been published under the labels that you're using, and if so, give you the option to automatically update them. Every time that I wanted to push an update in Portainer, I had to to log in and try re-pulling and re-deploying whole stacks, which almost always timed out and made each update an absolute nightmare. No more! With Dockhand, it's all automated. And I already hear some of the advanced Docker sysadmins complaining that using auto-updates with generic tags is a bad idea, and you should always use explicitly versioned tags in case a vulnerability is pushed into the latest version. Well, Dockhand addresses this too, with built-in vulnerability scanning using Grype and Trivy. In the default security scan configuration, Dockhand pulls all auto-updates to temporary tags, scans them, and if it contains any vulnerability types you told it to look out for, it will halt the update and delete the bad image. Super sick. Dockhand even gives you a tab where you can see all of the vulnerabilities its detected and learn more about them, not to dissimilar to the reports that Docker themselves provide in Docker hub or the Docker desktop app. Combine this with Gitea's built-in container registry, which I can use to host any of my homebrewed images, and that means that all code on my infra—whether it be borrowed or created—can be scanned for supply chain vulnerabilities. Again, _100% self-hosted_. Absolutely astounding. Don't try any of these I'm behind a WAF Between the automated scanning and a weekly update cycle long enough to let the dust settle between release and deploy, this is a robust enough deploy methodology that I can mostly be hands off nowadays and let it maintain itself. Manual intervention is only needed for major changes and configuration tweaks from now on. Disk space management and image cleanup is pretty simple with Dockhand's automated image pruning. Similar to the auto-updates, we can define a schedule and Dockhand will facilitate cleaning up old unneeded layers from your machine, making sure you never run out of space due to old unused image layers. Everything is now monitored through good 'ol Discord Webhooks. Though, I should point out that that I could use any number of communications protocols, thanks to Dockhand's use of the Apprise SDK in their notifications system. Apprise supports over 100 different services, so I could easily move these to Signal or Fluxer or Ntfy if I wanted to. I connected both Gitea and Dockhand to the same #CI-CD channel in my personal Discord server, so I can get push notifications on my phone whenever either service has an event. This helps me assemble full timelines of releases and updates as they happen. And the final feature that I haven't fully gotten around to implementing yet is support for secrets managers to handle your secrets instead of your env files. Dockhand has support for Bitwarden, Doppler, Hashicorp, Proton Pass, Azure Key Vault, KeePassXC, and 1Password. I test-drove Doppler during my capstone project in college and really liked it, so considering I already use Bitwarden at home, the potential to utilize it to do some similar secrets management is admittedly really enticing. EDIT: I ended up implementing it later, super simple. * * * Game changer. That's the only way that I can describe it, really. I thought Portainer was good for what it did, but Dockhand blows it out of the water on almost all fronts. Of the concerns Portainer left me with at the start, Dockhand tackles all but one of them (Backups!) and even then I'm not too concerned because that feature is A.) already in testing behind a feature flag, and B.) I'm already taking weekly disk backups through my VPS provider anyways. It's great, it's free, it's open source. Way more robust than Dockge, and no license needed like Portainer does. I think Dockhand would meet the needs of just about any Docker sysadmin, whether you're a power user like myself or someone just getting into homelabbing. Seriously. If you're looking for a single piece of software to help you maintain it all, Dockhand is it.

A powerful, intuitive Docker platform for everyone. Real-time container management, Compose stacks, Git deployments, and SSO - all free.

Alt: Jingling Keys