DEV Community: Vasili Pascal

Docker Web UI Security in 2026: Who Actually Publishes a Threat Model

Vasili Pascal — Tue, 25 Aug 2026 15:52:27 +0000

Recently I posted a comparison of 10 Docker web UIs on r/selfhosted. A commenter asked a question I hadn't answered in the original article:

If I were selecting a Docker web UI, I think my first and highest concern would be security. If you're running rootful Docker, compromising the Docker web UI means achieving root access to the host.

Do any of these options support rootless Docker?

Do they publish any information about their security architecture and how they approach minimizing their attack surface?

Fair question. I went through the docs of all 10 tools and built a matrix. This is that writeup.

TL;DR:

Only Portainer explicitly documents rootless Docker support (with caveats)
Only Rancher and Portainer publish comprehensive security architecture
Dockhand and Arcane publish serious security-adjacent artifacts (hardened image / SBOM / disclosure policy)
Almost everyone else is silent on the topic
"Connect via TCP" is not a rootless workaround - it's a common misconception worth clearing up

First: a technical point nobody in my Reddit thread got right

Several commenters (including me, initially) reached for "you can expose Docker via TCP so it doesn't need root." That's wrong, and Docker's own documentation is explicit about it.

Docker's remote-access docs state:

If steps aren't taken to secure the connection, it's possible for remote non-root users to gain root access on the host.

Translation: the transport (Unix socket vs TCP) is orthogonal to whether the daemon runs as root. Exposing the API over TCP just changes how you connect - the daemon behind the socket is still rootful unless you specifically configured rootless mode. TLS on the TCP connection protects against network sniffing, not against "compromise the client = root on host."

Setup	Root on host if UI compromised?
Rootful daemon + Unix socket	Yes
Rootful daemon + TCP + TLS	Yes (TLS doesn't help here)
Rootless daemon + Unix socket	No
Rootless daemon + TCP + TLS	No

Rootless mode is a separate daemon configuration - different install script (dockerd-rootless-setuptool.sh), user-namespace based, with real functional limitations (some storage drivers, cgroups behavior, networking). It's the only meaningful mitigation for the "UI compromise = host root" risk.

That's the frame. Now the matrix.

The matrix

Fetched from each tool's official documentation. Where I couldn't find explicit documentation, I marked "not documented" rather than guessing.

Tool	Rootless Docker	Auth	Security docs	CVE process
Portainer	Partial - docs say "some limitations, requires additional configuration"	LDAP (CE), OIDC (BE)	Yes - security@portainer.io + GitHub advisories	Mature: regular CVE remediation in changelog
Dockge	Not documented	Basic (README shows no auth details)	SECURITY.md file exists in repo	Not disclosed publicly
Dockhand	Partial - v1.0.23 changelog: "Fix vulnerability scanning failing with rootless Docker"	OIDC/SSO (Free), LDAP/AD (Enterprise), TOTP MFA, API tokens	Hardened container (Wolfi from scratch), AES-256-GCM at rest, Trivy/Grype safe-pull	No explicit CVE page found
Arcane	Not documented in visible docs	OIDC (docs page exists at /docs/authentication/oidc)	SECURITY.md + AI_POLICY.md + published SBOM at getarcane.app/sbom	Disclosure to info@getarcane.app
Dokploy	Not documented	2FA + SSO (per docs nav)	"Security" nav section exists	Not visible
Coolify	Not documented	SSH key-based; separate "non-root user" guide referenced	SSH hardening advice only	Not visible
Komodo	Not documented	OAuth/OIDC providers per nav	Not found	Not visible
Runtipi	No - install script requires sudo, manages Docker itself	Local + optional OAuth	No prominent SECURITY.md	Not visible
Rancher	N/A - Kubernetes-focused; supports rootless K3s	OIDC, SAML, LDAP, AD, GitHub, Google, Keycloak, generic OIDC	Extensive: CIS Benchmark, kube-bench, SELinux, Pod Security Standards, Cure53 pentest reports	security-rancher@suse.com + public CVE list
Stacker (my project)	Not documented; CLI itself doesn't need root on the runner	Casbin RBAC + OIDC (managed tier); OSS CLI uses SSH keys	Just added SECURITY.md; extensive `tests/security_*.rs` suite	Coordinated disclosure via security@try.direct

What jumps out

Rancher is in a different league

Rancher publishes CIS Benchmark alignment, integrates kube-bench for automated compliance scanning, ships SELinux packages, supports Pod Security Standards, and has public pentest reports from Cure53. That's a mature enterprise-grade security posture. If you're running Kubernetes at any real scale and security is your primary lens, this is the only serious answer in the list.

Portainer is the mature Docker-native option

Every recent release note includes explicit CVE remediation entries (upgrading containerd, oras-go, grpc, go-git, etc. to address specific CVEs). They publish a security email, run GitHub Security Advisories, and their rootless docs at least exist even if they say "some limitations." That's more than 7 of the other 9 tools can claim.

Dockhand and Arcane are punching above their weight

Both are much smaller projects than Portainer or Rancher but ship real security artifacts:

Dockhand: hardened container image built from Wolfi packages (rather than Alpine), AES-256-GCM at rest, Grype+Trivy scanning with "safe-pull protection" (new images scanned before deployment)
Arcane: published SBOM, formal SECURITY.md disclosure process, an explicit AI_POLICY.md for security reports (they've clearly been hit by AI CVE farming - refreshingly honest about it)

Neither has full architecture documentation, but they've done the meaningful work.

Almost nobody explicitly documents rootless

This surprised me. Rootless Docker has been GA for years. It has real limitations (some storage drivers, cgroup v2 requirements, no --privileged, no host network mode) - but the fact that even security-focused UIs don't clearly say "we support it" or "we don't" is a gap the category as a whole should fix.

"Connect via TCP" is not a mitigation

I already covered this above, but it bears repeating because I've seen it as commentary in multiple threads: exposing the Docker API over TCP does not reduce root privilege risk. Rootless mode is the only real answer here.

What "rootless" actually costs you

Rootless Docker isn't free. If you're evaluating it, the trade-offs are:

Storage drivers: overlay2 requires kernel ≥ 5.11 with fuse-overlayfs fallback. Some setups end up on the slower vfs driver.
Networking: no host network mode. Port publishing < 1024 requires additional capability setup. Some overlay networks behave differently.
--privileged containers: don't work.
cgroup v2 required for full functionality (fine on modern distros, painful on older ones).
Some Docker features unavailable: no docker run --sysctl, limited access to certain namespaces.

For most self-hosted workloads (web apps, databases, background workers), these limitations are fine. For workloads that need privileged containers, host networking, or specialised kernel features, rootless will be too restrictive.

Docker's rootless docs list the current known limitations - worth reading before committing.

Recommendations by risk profile

"I run 5 self-hosted apps at home and my threat model is 'don't get pwned by a drive-by'"

Portainer or Dockge are both fine. Put them behind a reverse proxy with auth, don't expose them to the internet, and you're covered against 95% of what actually gets you in a home setup.

"I run this at a small company and someone will eventually run an audit"

Portainer CE at minimum, Portainer BE if you can afford it. The published CVE remediation trail is what an auditor will actually check. Enable rootless mode if your workloads support it.

"I'm hosting client workloads and my liability is real"

Rancher if you're on Kubernetes. If you're on plain Docker, no tool in this category really meets a "clients pay us to protect their data" bar - you'll be layering on your own controls (Falco, Sysdig, network policies) regardless.

"I care about supply chain and provenance"

Dockhand (Wolfi-from-scratch image) or Arcane (published SBOM) are the standouts. Both are much less established than Portainer, so you're trading feature depth for a better security artifact.

"I want infrastructure-as-code and no web UI at all"

This is where Stacker (my project) fits - config-file-first, one YAML per stack, no dashboard by default. But the "no dashboard" position is a security posture choice, not a rootless-Docker feature. Stacker itself doesn't currently document rootless mode either - fixing that is on my list.

What I updated after doing this research

Two things worth mentioning honestly:

1. Added a SECURITY.md to the Stacker repo. I was calling out other tools for not publishing one - felt fair to close my own gap first. It's at github.com/trydirect/stacker/blob/main/SECURITY.md - includes disclosure contact, response SLA, in/out-of-scope definitions, and coordinated disclosure timing.

2. Rootless documentation is a real gap for the entire category. I'm going to actually test Stacker + rootless Docker on the target server, document the result, and publish either "supported" or "here's what breaks and why" - because right now I don't know for certain and neither do most of the tools in this list.

What I'd like to hear from readers

Anyone running any of these tools successfully against a rootless daemon? What broke, what worked?
If you use Portainer BE at work, does the "rootless with some limitations" story hold up in practice?
Anyone at Coolify / Dokploy / Komodo / Runtipi able to say officially where their teams stand on rootless support?

Drop it in the comments. I'll update this article as answers come in.

This article was assisted by an AI in drafting and structuring; every technical claim above was verified against a source I fetched from the tool's official documentation, GitHub repository, or docs.docker.com. Links are all verified working as of publication. If something's wrong, tell me and I'll correct it.

Docker Web UIs Compared in 2026: Portainer is No Longer the Only Answer

Vasili Pascal — Mon, 10 Aug 2026 16:57:56 +0000

For years the answer to "what web UI should I use for Docker?" was Portainer, full stop. In 2026 that answer is more nuanced. A new generation of tools has emerged - full self-hosted PaaS platforms (Dokploy, Coolify), cluster-aware orchestrators (Komodo), minimalist compose viewers (Dockge), homelab app stores (Runtipi) - and the right pick genuinely depends on what you're doing.

I run an OSS deployment tool (Stacker, MIT-licensed) so I spend a lot of time thinking about this space. Here's an honest 2026 comparison of the eight tools I'd actually recommend, with a job-to-be-done matrix at the end so you don't have to read all eight sections.

TL;DR - jump to How to choose.

1. Portainer - the default single-server dashboard

Still the most-installed Docker UI in the world. For a single server, hard to beat. Manages containers, images, networks, volumes, and Compose stacks. Works with Docker and Docker Swarm. Free CE is enough for most teams; Business Edition adds multi-cluster + RBAC.

Best if: you have one server and want a general-purpose dashboard to inspect, restart, and update containers.

Skip if: you want a full deploy pipeline (git → build → SSL → live). Portainer stops at compose deployment.

🔗 portainer.io

2. Dokploy - self-hosted Vercel-style deploy platform

One of the fastest-growing entries in this space. Not just a container UI - a full deployment platform. Push to GitHub, Dokploy pulls, builds, deploys, and issues an SSL cert. Managed databases (Postgres, MySQL, Redis, MongoDB) are first-class objects rather than raw containers. Traefik-based reverse proxy configured for you.

Best if: you want the Heroku or Vercel workflow - git-push, auto-deploy, SSL - on your own server.

🔗 dokploy.com

3. Coolify - the popular open-source alternative to Heroku

Same "self-hosted PaaS" niche as Dokploy, more mature and more widely deployed. Multi-server support out of the box. Handles docker-compose applications, static sites, plain Docker services, and one-click databases. Very active development, large Discord community for troubleshooting.

Best if: you like Dokploy's approach but need multi-server or a larger community.

🔗 coolify.io

4. Komodo - cluster-aware Rust-based orchestrator

Previously "Monitor". Written in Rust, built around fleets of servers, not a single host. Ships with strong monitoring baked in - CPU / RAM / disk metrics, log aggregation, alerting - so you don't need to bolt on Prometheus. Config lives in TOML files you can commit to git.

Best if: you have 3+ servers and want unified management + monitoring without stitching multiple tools together.

🔗 komo.do

5. Dockge - a minimalist compose viewer

From the maker of Uptime Kuma. Deliberately narrow scope: a clean web UI over your existing compose files. No build pipeline, no CI hooks, no monitoring bells - just start, stop, view logs, edit the compose file inline.

Best if: you already run compose files on a single server and want a "docker ps but pretty" tool without adopting a whole PaaS.

🔗 dockge.kuma.pet

6. Arcane - gitops-native dashboard for many nodes

One of the fastest-moving newcomers of the last year. Fits somewhere between Portainer and Coolify: proper multi-node support, deploy stacks from a git repo instead of the UI, per-node and cross-node secret management. Feedback I keep hearing from homelab folks running it at real scale (8+ nodes, 100+ containers) is that it holds up.
Best if: you’ve outgrown Portainer’s single-host feel but don’t want a full self-hosted PaaS, and you want your stack definitions to live in git.
🔗 Arcane on GitHub

7. Dockhand - focused single-host Docker manager

Docker-only (no Swarm support, on purpose). Very focused on the single-host operator: view stacks, restart services, browse logs, adjust configuration - without the surface area of Portainer or the deploy pipeline of Coolify. Community momentum has been strong in 2026, especially for the “more than Dockge, less than Coolify” crowd.
Best if: you run Docker on one host, don’t need Swarm, and want a slightly richer UI than Dockge without moving to a PaaS.
Skip if: you’re running Docker Swarm - Dockhand doesn’t cover it. Portainer or Komodo do.
🔗 Dockhand

8. Runtipi - homelab-focused app store

Trades the “raw docker-compose” interface for a curated app store. Two-click installs for 200+ common self-hosted apps (Nextcloud, Jellyfin, Vaultwarden, Immich, Home Assistant, Bitwarden, Grafana…). Perfect for a home server that non-technical family members will use.
Best if: you’re running a home server for family/friends and want approachable UX first, customization second.
Best if: you're running a home server for family/friends and want approachable UX first, customization second.

🔗 runtipi.io

9. Rancher - enterprise Kubernetes + Docker

Now owned by SUSE. In 2026 its focus is squarely on Kubernetes. Docker Compose support remains but is no longer the primary use case. If you're running K8s at enterprise scale, Rancher is the mature choice.

Best if: your team is committed to Kubernetes and needs enterprise-scale multi-cluster management.

Skip if: you're on plain Docker Compose - most tools above are a better fit today.

🔗 rancher.com

10. Stacker - config-as-code alternative to a web UI

Full disclosure: this is my project. Different niche from the seven above - instead of a web dashboard over your Docker setup, Stacker treats each stack as a single stacker.yml file you commit to git.

name: umami
app:
  type: custom
  image: ghcr.io/umami-software/umami:postgresql-latest
  ports:
    - "3000:3000"
proxy:
  type: nginx-proxy-manager
  auto_detect: true
  domains:
    - domain: analytics.example.com
      ssl: auto
      upstream: umami:3000

Then:

stacker deploy

One command: provisions a server (or reuses one you have), generates the compose file, wires an Nginx reverse proxy with auto-SSL, sets up backups and healthchecks, starts everything. Same YAML deploys locally, to a Linux server you own, or to Hetzner / DO / AWS / Linode / Vultr.

MIT-licensed. Ships with 67+ ready-to-deploy templates (Nextcloud, Ghost, Vaultwarden, Dify, Open WebUI, etc.).

Best if: you like your infrastructure as code more than as clicks - and value reproducibility across dev / staging / prod.

🔗 github.com/trydirect/stacker

How to choose the right tool

Match the tool to the job - not to whatever's most-starred on GitHub this month.

If you want to…	Use
Poke at containers on one server	Portainer , Dockge or Dockhand
Deploy web apps from GitHub with auto-SSL	Dokploy or Coolify
Manage Docker across 3+ servers	Komodo, Portainer BE or Arcane
Run a home server for family / friends	Runtipi
Run Kubernetes at enterprise scale	Rancher
Version-control your infrastructure	Stacker (config-as-code)

Wrapping up

There's no single "best" Docker web UI in 2026 - the right tool depends on how many servers you have, whether you want a dashboard or a full deploy pipeline, and how much you care about reproducibility. The good news: the ecosystem is richer than it's ever been, and every tool here is free and open source.

If you're just starting: Portainer or Dockge get you visibility fast. If you want a proper deploy workflow: Dokploy or Coolify. If you're operating a fleet: Komodo. If you want your infrastructure in git rather than a dashboard, take a look at Stacker - I'd love your feedback.

What did I miss? If you're running something not on this list - Yacht, CasaOS, LazyDocker, Docui, or a homegrown thing - drop it in the comments. Always looking to add to the list.

P.S. - the joke isn't lost on me. Yes, you can use Stacker to deploy Coolify. There's a stacker-projects/coolify template, so stacker deploy gets you a fresh box with Coolify running on it, ready for its own web UI to take over deploying your other stuff. Turtles all the way down. 🐢

Templates for Portainer and Dockge aren't in the catalog yet - PRs enthusiastically welcomed if you'd like to make the joke fully true.