Dockplane 0.1.0

Dockplane 0.1.0

The first stable release.

A self-hosted control plane for managing Docker across multiple hosts. You
run it yourself, on your own machine, and it reaches your Docker hosts through
an agent that connects outward. Nothing about your infrastructure leaves your
network, and there is no account to create anywhere.

Highlights

Multi-host inventory. Every connected Docker host in one place, with its
operating system, Docker version, metrics and connectivity — and with what is
stale marked as stale rather than presented as current.

One-command host onboarding. Hosts → Add host produces a single command.
Run it on the new machine and it works out what the machine is, downloads the
agent matching this control plane, verifies it against the checksums published
with that release, installs it, enrolls the host and starts the service. Docker
Engine has to be there already; nothing else is installed.

Container lifecycle. Start, stop and restart, each behind its own
permission, confirmed before it runs, recorded as an action and in the audit
trail, and answered with the state actually observed on the host afterwards.

Historical and live logs. What a container has printed, and a stream that
follows it, with stdout and stderr kept apart. Closing the view stops the read
on the host rather than leaving it running.

Compose visibility. Projects discovered on each host, with their membership
and aggregated state, and inspected on request.

Operators and access. Local accounts, TOTP second factors with single-use
recovery codes, server-side sessions you can list and revoke, and roles whose
permissions are enforced by the control server rather than by what the
interface chooses to show.

Audit history. Who did what, to what, with what result, and the request it
belongs to.

Backup and restore. The database, the application encryption key, the agent
certificate authority and Caddy's certificates, with a manifest and checksums.
A restore validates the whole backup before touching anything.

Upgrades that migrate. The installer recognises what is installed, takes a
backup and reads it back before it changes anything, replaces the deployment's
files, migrates the schema before the containers change, and records the new
version only once the result is serving.

Security

Remote control without a remote shell. The agent exposes a fixed catalog of
typed capabilities decided when it was built. A request names a container and
an operation from that list; nothing carries a command, a script or input for a
container. There is no exec, no attach and no shell — not disabled, absent.

That is a limit on Dockplane as much as on an attacker: Dockplane cannot do
things to your hosts that are not on that list, and neither can anyone who
takes over the control plane.

• Agent identity is a certificate. Each host generates its own key pair,
  which never leaves it, and connects outward over mutual TLS. Identity comes
  from the client certificate, not from anything the agent claims.
• Enrollment is one-time and short-lived. The token is stored only as a
  digest, spent once, and never appears in the visible command, in an argument
  list or on disk. The command's ticket travels in the request body, not the
  address, so no proxy log records it.
• Credentials are revoked individually. A revoked agent is refused, its
  connection dropped and its streams ended, without touching any other host.
• Sessions are server-side. The database holds only a digest, so a database
  copy contains nothing replayable, and revocation takes effect on the next
  request.
• State-changing requests are protected by both an origin check and a
  per-session token.
• Secrets stay out of the record. No password, token, second-factor secret
  or recovery code reaches a log or the audit trail. Container output is never
  stored, and never audited — that somebody read a container's logs is
  recorded; what those logs said is not.

See Security Model,
Agent Security and
Authentication. Findings from the release
scans, and the assessment of each one, are in the
Vulnerability Assessment.

Installation

Ubuntu 24.04, Ubuntu 22.04 or Debian 12, with Docker Engine and the Compose
plugin:

VERSION=0.1.0

sha256sum -c SHA256SUMS
tar xzf "dockplane-$VERSION.tar.gz"
cd "dockplane-$VERSION"
sudo ./install-control-plane.sh --domain dockplane.example.com

Then sign in and add your first host. See
Installation and
Add a Host.

Upgrading

The installer is the upgrade: download the release, check it, unpack it, run
it. It takes a backup and validates it before anything changes, and stops if
either fails. Pulling images and editing .env is not an upgrade path.

Upgrading from any 0.1.0 release candidate works the same way. See
Upgrading.

Supported platforms

Control plane	Ubuntu 24.04, Ubuntu 22.04 or Debian 12, amd64
Managed hosts	Debian 12, Ubuntu 24.04 or Ubuntu 22.04 with systemd

Ports: 80 and 443 for browsers, 9443 for agents. The API and PostgreSQL are not
published. See Supported Platforms.

ARM64

experimental — built and inspected, not runtime-tested

Packages, binaries and images are produced for arm64 and inspected, and no
arm64 machine has run them. Use amd64 in production.

Known limitations

Read Known Limitations before deploying.
In short: re-enrolling a machine creates a new host record and the old one
remains, backups are not encrypted by Dockplane, images are not signed, Compose
projects are read-only, container removal and volume and image management are
not implemented, and there is no automatic updater and no APT repository.

License

AGPL-3.0-only. See LICENSE.

Running a modified Dockplane as a network service means offering its users the
corresponding source.