v2 · HyperDHT · AGPL-3.0

Docker ops without
opening ports

Peer-to-peer Docker management on the Holepunch stack. Share a public key, then manage containers, stacks, and tunnels over encrypted P2P. Never open ports, expose Docker to the internet, or worry about remote access again. No SaaS. No VPN. No inbound firewall rules.

Install & download How it works Quick start
HyperDHT Transport
protomux-rpc RPC protocol
6 platforms Server + client
Holesail Port tunnels
PearDock desktop client
  • Peer online
  • Noise · E2E encrypted
  • No ports to open
HyperDHT
protomux-rpc
compact-encoding
dockerode
Holesail
Pear / Electron
Bare runtime
Features

Full Engine coverage.
Zero ports to open.

Containers, images, volumes, networks, stacks, Swarm, terminals, logs, GitOps, registry browser + vault, image update checks, Portainer-style templates, roles, and Holesail tunnels in a desktop console built for real ops. Remote Docker without port forwards, public dockerd, or a permanent VPN.

⬡

No ports. No VPN.

Server identity is a HyperDHT keypair. Share the public key; peers holepunch. Nothing phones home, nothing listens on a public Docker port.

🔐

Noise encryption

Every control connection is end-to-end encrypted. Roles (viewer, operator, admin), allowlists, pd1 invites, and audit logging help multi-operator fleets stay safe.

🚢

Docker ops console

Deploy templates, add containers, recreate, prune, stack env files, image update indicators, secrets/configs, and schedules. Built for real operators.

⇄

Holesail tunnels

Reach published services over hs:// keys with no inbound firewall rules. This is a separate data plane next to the RPC control plane.

🖥️

Desktop client

Electron (or Pear) with multi-peer fleet, multi-step job tray and hybrid pull progress, live stats, terminals, and OTA-ready packaging.

📦

Standalone binaries

Cross-built server (Bare) and client (Electron) for linux, darwin, and win32 on x64 and arm64. Rolling releases come from CI.

664-bit host targets
v2HyperDHT + protomux-rpc
3ACL roles
0Ports to open
Architecture

Two planes. Still zero open ports.

Control traffic uses HyperDHT and protomux-rpc. Service access uses Holesail. Both are peer-to-peer. No inbound firewall rules. No public Docker API.

⌘

Desktop client

Electron / Pear · multi-peer · job tray · registry

RPC
◈

peardock server

HyperDHT listen · ACL · handlers · vault · registry

Socket
🐳

Docker Engine

dockerode · compose · swarm

Control plane

Handshake, containers (including image update checks), deploy stacks and templates, logs, stats pushes, terminal streams, registry vault + remote browser, and peer policy. Protocol version is negotiated on connect.

Data / tunnels

Holesail L4 proxy binds published container or host ports to hs:// capabilities. Opt out with ENABLE_HOLESAIL=0.

How PearDock works → Architecture reference →
Fleet

Multi-peer. Multi-host. One client.

Connect to many servers at once. Tag environments (prod / staging / lab). Switch contexts without losing job history or health signals. Manage saved hosts under Settings → Peers; server ACL under Access.

  • Peer disk cache under ~/.config/peardock
  • Connection health badge: latency, Docker status, role
  • pd1 invites, revoke, allowlist for multi-operator setups
  • Full Registry view: encrypted vault, Hub search, remote catalog/tags/manifests
PearDock multi-host fleet and connection UI
Operations

Deploy like you mean it.

Portainer-style templates and blank Add container. Compose stacks with env files and overrides. Image update indicators. System prune. Volume file browser. Multi-step job tray with hybrid pull progress.

  • Container and stack templates; always-pull on create / duplicate
  • GitOps-friendly stack deploy; remove cleans project networks
  • Swarm services, nodes, secrets, configs, scale
  • Job tray steps + layer pull/push progress; role-gated destructive actions
PearDock deploy templates and operations UI
Tunnels

Share a service, never open a port.

Create a Holesail tunnel from a container or host port. Copy the hs:// URL. Remote peers bind locally. You never punch a firewall hole or expose Docker to the internet.

  • No inbound port forwards. P2P hole punching instead.
  • Secure mode by default (capability ≠ raw listen key)
  • SSRF guard: loopback / allowlisted hosts only
  • Max concurrent tunnels · audited create/close
Holesail guide →
Holesail tunnels UI
Product

See it in action

Dark, dense, operator-first UI. Built for long sessions, not demos. Click any shot for a full-size view.

PearDock containers overview with image update indicators
PearDock container detail view
PearDock logs and interactive terminal
PearDock deploy templates and stack forms
PearDock multi-host fleet, registry, and settings UI
Quick start

Install in one line. Connect in three steps.

No public IP gymnastics, no open ports, no VPN checklist. Interactive installer pulls rolling binaries, wires Linux systemd + docker group for the server, or installs a desktop client. 

curl -fsSL https://install.peardock.boats | bash
# Non-interactive
curl -fsSL https://install.peardock.boats | bash -s -- --server --yes
curl -fsSL https://install.peardock.boats | bash -s -- --client --yes
01

Server online

Run systemctl status peardock, then check /opt/peardock/.env for SERVER_PUBLIC_KEY and SERVER_SEED.

02

Launch the client

Open peardock.app (macOS) or peardock-client (Linux). Or download from Download.

03

Connect

Add peer: public key (viewer), key + seed (admin), or a full pd1. invite. Peers auto-reconnect every 5s if the link drops.

Full quick start guide Install & download
Open source · AGPL-3.0

Remote Docker without remote-access drama.

Never open ports or expose your Engine again. Just keys and peers. Grab rolling binaries for six hosts, or build from source.

Download peardock Browse docs