Manage Your Containers.
The simple way.

One image, and it does the things you actually reach for.

Nothing runs on the host except Docker, which is already there. DockLite reads and drives the socket, then renders what it finds into a page worth keeping open.

• Compose aware

  Containers roll up under the project that owns them, with a live running / total count on every group header.

• Stack control

  Flip a single container, or start and stop an entire Compose project in one move.

• Live logs

  Open a container and watch its logs stream in real time — no docker logs -f, no second terminal.

• One-click update

  Re-pulls the image tag and recreates the container with its exact config: name, env, volumes, networks, restart policy.

• Per-container metrics

  CPU, memory, network and block I/O on a dedicated monitoring page.

• Self contained

  No external services, no sidecars. One container talking to the Docker socket.

One port, and the whole host is on the page.

Open :3000 and every project on the machine is right there. Health is readable at a glance, and the one thing that is broken is the hardest thing on screen to miss.

docklite.local

Three variables, and you're logged in.

There is no user store, because there is only one admin, configured entirely through the environment. Nothing to migrate, and nothing to back up.

1. Mount the socket, set three variables

   That's the compose file on the left, in full. No extra services, no volumes for state.

2. Hash your password

   Run the image once with hash-pwd and paste the salt:hash it prints into AUTH_PASSWORD_HASH.

   $ docker run --rm a2coder/docklite hash-pwd <password>

3. Bring it up

   docker compose up, open port 3000. About a minute, start to finish.

One more key, and CI can deploy for you.

Set WEBHOOK_API_KEY to unlock two authenticated POST endpoints. Your pipeline triggers the exact same recreate-with-new-image the update button does, either per container or per whole project.

# update every container in a project
curl -fsSL -X POST \
  -H "Authorization: Bearer $WEBHOOK_API_KEY" \
  https://docklite.example.com/api/webhook/project/my-project

{ "ok": true, "updated": 3, "project": "my-project" }

• Bearer-token authenticated, returning 401 on a bad token
• Disabled, returning 503, until you set the key
• Pulls from private registries, credentials picked per registry
• Clean JSON responses

One more file, and every registry has its own login.

Credentials are chosen per pull, from the registry the image came from — GHCR for one container, a host of your own for the next, Docker Hub for the rest. You list them once, in a file DockLite re-reads on every pull.

registries:
  - host: ghcr.io
    username: acme-ci
    password_b64: Z2hwX3h4eHh4eHh4eHh4eA==

  - host: registry.internal.acme.com:5000
    username: deploy
    password_b64: c3VwZXItc2VjcmV0

  - host: docker.io
    username: acmebot
    password_b64: ZGNrcl9wYXRfeHl6

1. Encode each password

   Base64 the token or password, and paste what it prints into password_b64.

   $ printf %s 'your-token' | base64

2. Mount the file, and point DockLite at it

   Both steps, or neither works: the mount puts the file inside the container, and REGISTRY_CONFIG_PATH tells DockLite where it landed.

   docker-compose.yml Copy

   # two more lines under docklite:, in the file on the left
       environment:
         REGISTRY_CONFIG_PATH: /config/registries.yml
       volumes:
         - ./registries.yml:/config/registries.yml:ro

How hosts are matched

The host comes off the image reference by Docker's own rule: the text before the first / is a registry host only if it contains a . or a :, or is exactly localhost.

So acme/api is a Docker Hub namespace rather than a host, and matches the docker.io entry. docker.io, index.docker.io and registry-1.docker.io are all the same host, and a port is part of the host.

• Registries you leave out are pulled anonymously, so public images need no entry
• Edits land on the next pull — nothing to restart
• A file that is present but unreadable or invalid fails the pull with a specific error
• DockLite pulls before it stops anything, so a failed pull leaves the running container untouched

One socket, and nothing else.

That single mount is DockLite's entire reach into your machine. It is also the reason to be careful about where you put it, so here is the honest version.