Features
Dockup is one of your stacks
It sits in the stacks folder with everything it manages, so it shows up in its own list like any other container. Open it, read its compose file, press Update. No special case, no terminal.
Everything in one window
Every stack, its logs, its editor and its terminal on a single page. No hunting through tabs.
A login that means it
Server-side sessions, rate-limited sign-in, optional 2FA, encrypted settings. One secret to set, ever.
Adopts what you run today
Dockup scans your system and pulls existing compose projects and plain containers under management - nothing gets restarted.
Errors you can't miss
Live log streaming with errors in red, a persistent activity log, and optional email alerts when something breaks.
Backups that restore
Daily automatic backups, one-click restore that's itself reversible, and a download-everything zip. No lock-in, ever.
Prune with confidence
Clean unused images, containers, networks and build cache one-by-one or together. Volumes always show exactly what goes first.
Redeploy a stuck container
Recreates a stack from its compose file and whatever image's already pulled - fixes a wedged container without a full re-pull.
Archive, don't just delete
A stack with nothing running can be archived - config kept, out of the way - or deleted for good along with every image it used.
One click to the real thing
Open a stack's actual web UI in a new tab - its Tailscale Serve address if set up, otherwise whatever address got you to Dockup.
Install
# paste straight into Dockge, Portainer, or any compose tool - change
# the SECRET_KEY line below to your own random string, then deploy
services:
dockup:
image: ghcr.io/gh-lm/dockup:latest
container_name: dockup
restart: unless-stopped
cap_drop: [ALL]
cap_add: [CHOWN, SETUID, SETGID, DAC_OVERRIDE]
security_opt: [no-new-privileges:true]
ports:
- "127.0.0.1:4000:5001"
environment:
SECRET_KEY: change-this-to-your-own-long-random-string
TZ: Europe/London
# real host path of the data/ folder above - only matters for
# per-stack backups; skip if you don't use that feature
DOCKUP_DATA_HOST_PATH: /opt/dockup/data
volumes:
- ./data:/app/data
- /var/run/docker.sock:/var/run/docker.sock
- /opt/stacks:/opt/stacksThen
Open http://your-server:4000,
create the admin account, and adopt what's already running. Updating later is a plain
docker compose pull && docker compose up -d, or Dockup's own card in
its stack list. Prefer a terminal, or the full file with its comments? The
real compose.yaml and the runbook have both.
Optional: the dockup-companion
Adds host OS update checks and per-stack Tailscale Serve toggles - the only two things Dockup can't do through the Docker socket alone. It's the sole part of Dockup that needs root on the actual server rather than just Docker access, which is why it's a separate step you opt into, not something bundled in by default. Skip it entirely and everything else works exactly the same.
# one click in Settings does the whole thing - installs and reconnects
# or, manually (its files live in the repo, not the image):
cid=$(docker create ghcr.io/gh-lm/dockup:latest)
docker cp "$cid:/app/companion" /tmp/dockup-companion && docker rm "$cid"
cd /tmp/dockup-src/companion && sudo sh install.shCommon questions
Does updating Dockup mean rebuilding it?
No. Dockup ships as a pre-built image, and it sits in the stacks folder with everything it manages, so it appears in its own list. Open it and press Update, exactly as you would for any other stack. No git, no local build, ever.
Does Dockup need root on my server?
Only for two things Docker access alone can't reach - host OS update checks and Tailscale Serve - and only if you opt into the small companion service. Everything else runs through the same Docker socket any container manager needs.
What happens to my stacks if I stop using Dockup?
Nothing. Every stack stays a plain folder with a real compose file, unchanged by Dockup managing it - docker compose or any other tool works on it at any time.
Can I run Dockup on a public VPS?
Not yet recommended. Dockup is built and hardened for a machine on your own network, reached over Tailscale or your LAN - it hasn't been hardened for direct internet exposure.
Do I have to install the companion?
No. It is entirely optional and separate. Without it you lose only host OS update checks and the per-stack Tailscale Serve switches; everything else works.
What does it back up?
Its own settings, registry details and history, every day, kept for as long as you choose. A stack's own data is a separate, deliberate job you ask for per stack.
Can it adopt what I already run?
Yes. Dockup looks over your machine for compose projects and loose containers it isn't managing and offers to take them on. Nothing is restarted to do it.
What happens when Dockup updates itself?
The same as any other stack: open it, press Update. The page goes quiet for a few seconds while its container is replaced, then comes back on the new version.
Where do passwords and keys live?
In Dockup's own settings page, stored encrypted. The only exception is the key that signs your login, which has to exist before there is a page to sign in to, so it sits in the compose file or a .env beside it.