How I embedded Docker into a binary: the story of BoxSurgery

Uy Telik — Thu, 30 Jul 2026 18:58:32 +0000

I'm self‑taught. And I built a tool that turns any Docker Compose project into a single executable file.

It's called BoxSurgery.

Why it matters
Sometimes you need to deploy software in an environment with no internet access and no Docker allowed. That's called an Air‑Gap. Banks, factories, government‑run systems — almost all of them are like that.

Usually, the solution is a messy workaround. It takes time, it's complicated, and you have to redo it from scratch every time. I tried a different approach: put everything into one binary. Docker, images, Compose — all inside.

What it does
BoxSurgery can:

Package a project into a .exe (or a native binary for Linux/macOS)

Run without Docker installed

Encrypt images (AES‑256‑GCM)

Bind licenses to hardware (HWID)

Update without internet (signed manifest)

It comes with a CLI and a desktop UI built with Svelte + Tailwind.

How it was built
The backend is Go. Frontend — SvelteKit. Desktop — Wails.

Docker is embedded into the binary via embed. On Windows it runs through WSL2, on Linux in rootless mode, on macOS via Virtualization.framework (still in progress).

The hardest part was making Wails display a window on Windows. WebView2, AssetServer, embed — it took a while to get it right.

Why I'm sharing it
The code is open on GitHub. I'm looking for help with:

Linux/macOS runtime

Integration tests

UI improvements

Feel free to fork, open issues, or submit PRs.

I'm self‑taught, and I'd really appreciate community support.

DEV Community: Uy Telik

How I embedded Docker into a binary: the story of BoxSurgery