v2 · HyperDHT · AGPL-3.0

Docker ops without
opening ports

Peer-to-peer Docker management on the Holepunch stack. Share a public key, then manage containers, stacks, and tunnels over encrypted P2P. Never open ports, expose Docker to the internet, or worry about remote access again. No SaaS. No VPN. No inbound firewall rules.

Install & download How it works Quick start
HyperDHT Transport
protomux-rpc RPC protocol
6 platforms Server + client
Holesail Port tunnels
PearDock desktop client
  • Peer online
  • Noise · E2E encrypted
  • No ports to open
HyperDHT
protomux-rpc
compact-encoding
dockerode
Holesail
Pear / Electron
Bare runtime
Features

Full Engine coverage.
Zero ports to open.

Containers, images, volumes, networks, stacks, Swarm, terminals, logs, GitOps, registry vault, roles, and Holesail tunnels in a desktop console built for real ops. Remote Docker without port forwards, public dockerd, or a permanent VPN.

⬡

No ports. No VPN.

Server identity is a HyperDHT keypair. Share the public key; peers holepunch. Nothing phones home, nothing listens on a public Docker port.

🔐

Noise encryption

Every control connection is end-to-end encrypted. Roles (viewer, operator, admin), allowlists, invites, and audit logging help multi-operator fleets stay safe.

🚢

Docker ops console

Deploy, recreate, prune, edit resources, browse volumes, manage stack env files, search Hub, handle secrets and configs, and run schedules. Built for real operators.

⇄

Holesail tunnels

Reach published services over hs:// keys with no inbound firewall rules. This is a separate data plane next to the RPC control plane.

🖥️

Desktop client

Pear and Electron shell with multi-peer fleet, job tray, connection health, live stats, terminals, and OTA-ready packaging.

📦

Standalone binaries

Cross-built server (Bare) and client (Electron) for linux, darwin, and win32 on x64 and arm64. Rolling releases come from CI.

664-bit host targets
v2HyperDHT + protomux-rpc
3ACL roles
0Ports to open
Architecture

Two planes. Still zero open ports.

Control traffic uses HyperDHT and protomux-rpc. Service access uses Holesail. Both are peer-to-peer. No inbound firewall rules. No public Docker API.

⌘

Desktop client

Pear / Electron · multi-peer · jobs · terminals

RPC
◈

peardock server

HyperDHT listen · ACL · handlers · vault

Socket
🐳

Docker Engine

dockerode · compose · swarm

Control plane

Handshake, list/start/stop containers, deploy stacks, logs, stats pushes, terminal streams, registry vault, and peer policy. Protocol version is negotiated on connect.

Data / tunnels

Holesail L4 proxy binds published container or host ports to hs:// capabilities. Opt out with ENABLE_HOLESAIL=0.

How PearDock works → Architecture reference →
Fleet

Multi-peer. Multi-host. One sidebar.

Connect to many servers at once. Tag environments (prod / staging / lab). Switch contexts without losing job history or health signals.

  • Peer disk cache under ~/.config/peardock
  • Connection health badge: latency, Docker status, role
  • Invites, revoke, allowlist for multi-operator setups
  • Registry credentials vault (AES-GCM from server seed)
Fleet and peers UI
Operations

Deploy like you mean it.

Compose stacks with env files and overrides. Recreate containers. Live resource editor. System prune. Scheduled maintenance. Volume file browser.

  • GitOps-friendly stack deploy paths
  • Swarm services, nodes, secrets, configs, scale
  • Job tray with step logs for long-running ops
  • Destructive confirms and role-gated methods
Deploy and operations UI
Tunnels

Share a service, never open a port.

Create a Holesail tunnel from a container or host port. Copy the hs:// URL. Remote peers bind locally. You never punch a firewall hole or expose Docker to the internet.

  • No inbound port forwards. P2P hole punching instead.
  • Secure mode by default (capability ≠ raw listen key)
  • SSRF guard: loopback / allowlisted hosts only
  • Max concurrent tunnels · audited create/close
Holesail guide →
Holesail tunnels UI
Product

See it in action

Dark, dense, operator-first UI. Built for long sessions, not demos. Click any shot for a full-size view.

PearDock overview: dashboard and containers
PearDock detail view
PearDock logs and terminal
PearDock deploy
PearDock peers
Quick start

Install in one line. Connect in three steps.

No public IP gymnastics, no open ports, no VPN checklist. Interactive installer pulls rolling binaries, wires Linux systemd + docker group for the server, or installs a desktop client. 

curl -fsSL https://install.peardock.boats | bash
# Non-interactive
curl -fsSL https://install.peardock.boats | bash -s -- --server --yes
curl -fsSL https://install.peardock.boats | bash -s -- --client --yes
01

Server online

Run systemctl status peardock, then check /opt/peardock/.env for SERVER_PUBLIC_KEY and SERVER_SEED.

02

Launch the client

Open peardock.app (macOS) or peardock-client (Linux). Or download from Download.

03

Connect

Add peer: public key (viewer), key + seed (admin), or a full pd1. invite. Peers auto-reconnect every 5s if the link drops.

Full quick start guide Install & download
Open source · AGPL-3.0

Remote Docker without remote-access drama.

Never open ports or expose your Engine again. Just keys and peers. Grab rolling binaries for six hosts, or build from source.

Download peardock Browse docs