DietPi Software | Dockhand: modern docker management platform with built-in vulnerability scanning

[lukasMega]

Creating a software request

Formal software information

• Software title | Dockhand
• Short description | Dockhand is a modern, self-hosted Docker management web UI with built-in vulnerability scanning, Compose stack orchestration, Git integration, multi-host support, and free OIDC/SSO — written in Node.js and Go
• Official URL | https://dockhand.pro
• GitHub URL | https://github.com/Finsys/dockhand
• (Official) install documentation | https://dockhand.pro/manual/

TL;DR:

Dockhand replaces several standalone tools with one container. Its core feature set covers:

• container start/stop/restart/remove with real-time CPU, memory, and network metrics visible inline;
• A visual Compose editor with syntax validation and stack adoption from Portainer or Dockge;
• scheduled auto-updates that pull images to a temporary tag, scan for CVEs via Grype or Trivy, and only apply the update if the vulnerability threshold passes Virtualization Howto (a feature no competitor offers);
• GitOps deployment from Git repos with webhook-triggered sync;
• a built-in file browser for containers and volumes (Homeserver);
• interactive web terminals via xterm.js;
• and multi-host management through the open-source Hawser agent written in Go (GitHub/Finsys/hawser ).

---

Are there similar/alternative software titles available with DietPi-Software?

• Portainer (ID 185) — the most widely used Docker management UI, already available in DietPi-Software

What makes your requested software better than the above solutions, if available?

Comparison of hardware requirements:

	Dockhand	Portainer CE	Komodo
Min. RAM	512 MB	~256 MB (no formal spec)	1 GB
Idle RAM usage	~60–72 MB RSS	~25–50 MB RSS	~150–300 MB (Core + MongoDB/FerretDB)
Docker image size	~150 MB	~90 MB (compressed)	~80 MB Core + ~400 MB MongoDB or FerretDB+Postgres
ARM64	✅	✅	✅
ARMv7	❌	✅	❌
Database required	SQLite (built-in) / PostgreSQL optional	Embedded BoltDB	MongoDB or FerretDB+PostgreSQL (mandatory)
Default port	3000	9443 (HTTPS) / 9000 (HTTP)	9120

How Dockhand compares to Portainer in DietPi

Portainer CE (DietPi software ID 185) is currently the only Docker management UI in the DietPi catalog. The table below highlights the key differences relevant to DietPi users:

Capability	Portainer CE (in DietPi)	Dockhand Free
Container management UI	✅	✅
Compose stack editor	✅ Basic	✅ Visual graph + YAML
Auto-updates with scheduling	❌ (needs Watchtower)	✅ Built-in
Vulnerability scanning before updates	❌	✅ Grype + Trivy
SSO / OIDC	❌ Paid only	✅ Free
MFA / TOTP	❌ Paid only	✅ Free
GitOps deployment	❌ Paid only	✅ Free
Real-time inline metrics	❌ Click per container	✅ Grid-level CPU/mem/net
Container file browser	❌	✅
Web terminal (xterm.js)	✅	✅
Zero telemetry	❌ (analytics)	✅
Self-update from UI	❌	✅
Multi-host management	✅ Built-in	✅ Via Hawser agent
Default database	Internal BoltDB	SQLite
ARM64 (RPi 4+)	✅	✅
ARMv7 (32-bit)	✅	❌
License	zlib (FOSS)	BSL 1.1 (source-available, Apache 2.0 in 2029)

Other tools that DietPi users commonly install separately — Watchtower for auto-updates, Dozzle for log streaming, Diun for update notifications — are effectively consolidated into Dockhand. Dockge, another popular alternative (~22k GitHub stars), only handles Compose stacks and lacks container management, scanning, or auto-updates.

Why Dockhand over Portainer CE:

• Dockhand provides free OIDC/SSO and MFA — Portainer CE requires upgrading to the paid Business Edition ($$$) for these features.
• Built-in vulnerability scanning (Grype + Trivy) integrated into the auto-update pipeline with configurable severity thresholds — Portainer CE has no equivalent.
• Zero telemetry and no analytics opt-out required — Portainer collects anonymous usage data via Matomo by default.
• Hardened Wolfi-based container image with near-zero base CVEs, versus Portainer's Alpine base.
• Cleaner, more modern SvelteKit UI — widely described as faster and more intuitive than Portainer's aging Angular frontend.
• Hawser Edge agent: manages remote Docker hosts behind NAT via outbound-only WebSocket — no open inbound ports required.

NOTE: You can obtain Portainer Business Edition for free for max. 3 devices / nodes: https://www.portainer.io/take-3

Why Dockhand over Komodo:

• Komodo is a full build-and-deployment system that requires a mandatory external database (MongoDB, or FerretDB+PostgreSQL) making it significantly heavier in RAM and disk — unsuitable for constrained devices like the Pi Zero 2W.
• Dockhand's SQLite default means zero extra containers and ~60 MB idle RAM vs. Komodo's ~150–300 MB for Core + database combined.
• Dockhand focuses on Docker/Compose management with a polished UI; Komodo is more of a GitOps CI/CD platform and has a steeper learning curve for users who just want to manage containers.

Additional Dockhand highlights relevant for DietPi users:

• Official multi-arch Docker image (linux/amd64 + linux/arm64) with active ARM64 testing — a recent release specifically fixed an ARM64 regression on Raspberry Pi devices.
• Confirmed running on Raspberry Pi 4 with 20+ containers by community users.
• Volume file browser built-in — browse, upload, and download files from Docker volumes without CLI access, useful for headless SBC setups.
• NVIDIA and AMD GPU monitoring out of the box — useful for Pi 5 users experimenting with AI inference containers.
• Completely free for personal use (BSL 1.1 license, converts to Apache 2.0 in January 2029).

How can DietPi make the installation easier or compatible, than following the install instructions or do APT installation, if available?

• The official install method is a docker run or Docker Compose command, which works but does not integrate with DietPi conventions.
• DietPi integration would place persistent data at /mnt/dietpi_userdata/dockhand/ (consistent with other DietPi services), register the container with dietpi-services for unified management, and cover it under DietPi's backup system.
• Since DietPi already manages Docker (ID 162), Dockhand can be installed as a Docker container under DietPi's existing Docker setup — no separate runtime installation is needed.
• A dietpi-software install command would replace the multi-step manual Docker setup with a single, tested, reproducible installation.

Can you provide the installation steps that you would suggest DietPi-Software to do?

1. Verify Docker is installed (DietPi Software ID 162); prompt to install it if missing, as Dockhand requires Docker.
2. Create the persistent data directory at /mnt/dietpi_userdata/dockhand/ with appropriate ownership.
3. Pull the official multi-arch image: docker pull fnsys/dockhand:latest — the image auto-selects linux/arm64 or linux/amd64 based on the host.
4. Create and start the container via docker run (or write a Compose file to /mnt/dietpi_userdata/dockhand/docker-compose.yml):

---

Screenshots / GIF

• https://dockhand.pro/#screenshots

screenshots	screenshots
Dashboard	Container Management
Compose Stack Editor	Vulnerability Scanning