Dockhand: A Smarter, Safer Docker Manager

In this video, I’m taking a look at Dockhand, a Docker management platform focused on safer remote Docker management, smart updates, and vulnerability-aware update workflows.

We’ll install Dockhand, connect a Docker environment, look at the main dashboard, test update handling, check security scanning, and see how remote environments can be managed without exposing a risky Docker admin surface.

If you manage Docker containers across multiple hosts, the hard part is not only starting containers or editing Compose files. The hard part is keeping updates, security, logs, remote access, and day-to-day operations under control without exposing a risky Docker admin surface.

Install Dockhand

You can follow the official Dockhand documentation, or use the Boilerplates setup if you are using my template workflow.

Links:

In my setup, I generated the Dockhand Compose stack with Boilerplates:

boilerplates repo update

boilerplates compose list
boilerplates compose show dockhand
boilerplates compose generate dockhand

Then deploy it on the Docker host:

ssh srv-test-1

cd ~/dockhand
docker compose up -d

After the containers are running, open the Dockhand web interface and finish the initial setup.

Add Your First Docker Environment

Inside Dockhand, go to:

Environments -> Add -> Local

This connects Dockhand to the local Docker environment. Once connected, you can inspect the running containers and stacks.

Connect Remote Environments with Hawser

Dockhand can also manage remote Docker environments through Hawser.

Hawser is the remote agent used to connect Docker hosts back to Dockhand. This is useful when the Docker host is behind NAT, behind a firewall, or does not have a stable public IP.

Links:

Install Hawser on the remote Docker host:

curl -fsSL https://raw.githubusercontent.com/Finsys/hawser/main/scripts/install.sh | bash

Then configure the Hawser token:

sudo vim /etc/hawser/config

Restart the service:

sudo systemctl stop hawser
sudo systemctl start hawser

Then add the remote environment in Dockhand:

Environments -> Add -> Hawser Agent

This allows Dockhand to manage another Docker host without exposing the Docker socket or admin UI directly to the internet.