Architecture - Dockhand

Overview

Dockhand is built with a modern, security-focused architecture that emphasizes performance, maintainability, and minimal dependencies. The application follows a server-side rendering (SSR) approach with progressive enhancement for optimal user experience.

Dockhand runs on a custom Wolfi-based OS built from scratch using apko, with every package explicitly declared for maximum security.

Architecture Diagram

┌─────────────────────────────────────────────────────────────┐
│                      Browser / Client                        │
│  ┌───────────────────────────────────────────────────────┐  │
│  │  Svelte 5 Components + SvelteKit 2 Frontend           │  │
│  │  - shadcn-svelte UI components                        │  │
│  │  - TailwindCSS styling                                │  │
│  │  - xterm.js for terminals                             │  │
│  │  - CodeMirror for editors                             │  │
│  │  - Cytoscape.js for graphs                            │  │
│  └───────────────────────────────────────────────────────┘  │
└──────────────────┬──────────────────────────────────────────┘
                   │ HTTP/WebSocket/SSE
┌──────────────────▼──────────────────────────────────────────┐
│              Dockhand Application Server                     │
│  ┌───────────────────────────────────────────────────────┐  │
│  │         SvelteKit API Routes (Backend)                │  │
│  │  - Request handling & validation                      │  │
│  │  - Authentication & authorization                     │  │
│  │  - Business logic orchestration                       │  │
│  └────┬────────────────────────────────────────────┬─────┘  │
│       │                                            │         │
│  ┌────▼─────────────┐                    ┌────────▼──────┐  │
│  │  Server Modules  │                    │  Bun Runtime  │  │
│  │  - docker.ts     │                    │  - Fast JS    │  │
│  │  - stacks.ts     │                    │  - Native TS  │  │
│  │  - db.ts         │                    │  - Built-in   │  │
│  │  - auth.ts       │                    │    fetch      │  │
│  │  - git.ts        │                    └───────────────┘  │
│  │  - scheduler.ts  │                                        │
│  └────┬─────────────┘                                        │
│       │                                                      │
│  ┌────▼──────────────────────────────────────────────────┐  │
│  │              Drizzle ORM Layer                        │  │
│  │  - Type-safe database queries                         │  │
│  │  - SQLite or PostgreSQL support                       │  │
│  └────┬──────────────────────────────────────────────────┘  │
│       │                                                      │
│  ┌────▼────────┐                                             │
│  │  SQLite DB  │  or  ┌──────────────────┐                  │
│  │  (default)  │      │  PostgreSQL DB   │                  │
│  └─────────────┘      └──────────────────┘                  │
└──────────────────┬──────────────────────────────────────────┘
                   │ Docker API (Unix socket / TCP)
┌──────────────────▼──────────────────────────────────────────┐
│                   Docker Engine(s)                           │
│  - Local Unix socket: /var/run/docker.sock                   │
│  - Remote TCP: https://remote-host:2376                      │
│  - Hawser agents: Edge or standard deployment                │
└──────────────────────────────────────────────────────────────┘

Frontend Architecture

The frontend is built with modern web technologies for maximum performance and developer experience.

SvelteKit 2 & Svelte 5

Core framework features:

Server-Side Rendering (SSR): Initial page loads are rendered on the server for fast first paint
Progressive Enhancement: Works without JavaScript, enhanced when available
File-based Routing: Routes defined by file structure in src/routes/
API Routes: Backend endpoints colocated with frontend pages
Type Safety: Full TypeScript support with generated types

// Example: SvelteKit load function with type safety
import type { PageLoad } from './$types';

export const load: PageLoad = async ({ fetch, params }) => {
  const response = await fetch(`/api/containers/${params.id}`);
  const container = await response.json();
  return { container };
};

Svelte 5 Runes

Dockhand uses Svelte 5’s new reactivity system:

<script lang="ts">
  // State management with runes
  let containers = $state<Container[]>([]);
  let loading = $state(true);
  let filter = $state('');
  
  // Derived state
  const filteredContainers = $derived.by(() => {
    return containers.filter(c => c.name.includes(filter));
  });
  
  // Effects for side effects
  $effect(() => {
    if (browser) {
      fetchContainers();
    }
  });
</script>

UI Components

Built with shadcn-svelte and TailwindCSS:

shadcn-svelte

Accessible component library with bits-ui primitives for modals, dropdowns, tooltips, etc.

TailwindCSS v4

Utility-first CSS with Vite plugin for optimal performance

Lucide Icons

Consistent iconography with lucide-svelte

Mode Watcher

Dark/light theme with system preference detection

Specialized Components

Terminal Emulator (xterm.js):

import { Terminal } from '@xterm/xterm';
import { FitAddon } from '@xterm/addon-fit';
import { WebLinksAddon } from '@xterm/addon-web-links';

const term = new Terminal({ theme, cursorBlink: true });
const fitAddon = new FitAddon();
term.loadAddon(fitAddon);
term.loadAddon(new WebLinksAddon());

Code Editor (CodeMirror 6):

import { EditorView } from '@codemirror/view';
import { yaml } from '@codemirror/lang-yaml';
import { oneDark } from '@codemirror/theme-one-dark';

const editor = new EditorView({
  extensions: [
    yaml(),
    oneDark,
    // ... other extensions
  ]
});

Dependency Graph (Cytoscape.js):

import cytoscape from 'cytoscape';

const cy = cytoscape({
  container: element,
  elements: [
    { data: { id: 'web', label: 'web' } },
    { data: { id: 'db', label: 'postgres' } },
    { data: { source: 'web', target: 'db' } }
  ],
  layout: { name: 'cose' }
});

Backend Architecture

The backend is built with SvelteKit API routes and modular server-side code.

Bun Runtime

Dockhand uses Bun as the JavaScript runtime:

Fast execution: Optimized JavaScript and TypeScript engine
Native TypeScript: No transpilation required
Built-in fetch: Node.js fetch API for HTTP requests
WebSocket support: Native WebSocket implementation
Compatibility: Node.js API compatibility layer

The production Dockerfile uses Node.js 24 instead of Bun to avoid BoringSSL memory leaks on mTLS connections. Development can use either.

Server Module Structure

src/lib/server/
├── auth.ts              # Authentication (Argon2id, OIDC, LDAP)
├── authorize.ts         # RBAC authorization checks
├── docker.ts            # Direct Docker API client
├── stacks.ts            # Compose stack management
├── git.ts               # Git repository operations
├── db.ts                # Database operations wrapper
├── encryption.ts        # AES-256-GCM credential encryption
├── scheduler/           # Croner-based job scheduling
├── audit.ts             # Audit logging
├── notifications.ts     # Email/webhook/MQTT notifications
├── scanner.ts           # Trivy/Grype integration
├── hawser.ts            # Hawser remote agent protocol
└── subprocess-manager.ts # Go collector process management

Docker API Integration

Direct API calls without dockerode:

// src/lib/server/docker.ts
export async function listContainers(
  all: boolean = false,
  envId?: number
): Promise<ContainerInfo[]> {
  const env = await getEnvironment(envId);
  const endpoint = buildEndpoint(env, '/containers/json');
  
  const response = await fetch(endpoint, {
    method: 'GET',
    agent: getAgent(env), // Unix socket or HTTP agent
    headers: { 'Content-Type': 'application/json' }
  });
  
  if (!response.ok) {
    throw new DockerConnectionError('Failed to list containers', response);
  }
  
  return response.json();
}

Connection Types:

Unix Socket

Local Docker socket at /var/run/docker.sock using custom agent

TCP/TLS

Remote Docker daemon via HTTPS with optional mTLS client certificates

Hawser

WebSocket-based protocol for edge deployments and NAT traversal

Compose Stack Management

All stack operations use docker compose commands:

// src/lib/server/stacks.ts
export async function deployStack(
  options: DeployStackOptions
): Promise<StackOperationResult> {
  const { name, compose, envId, envVars } = options;
  
  // Write compose.yaml to disk
  const stackDir = getStackDir(name);
  writeFileSync(join(stackDir, 'compose.yaml'), compose);
  
  // Prepare environment variables
  const env = { ...process.env, ...envVars };
  
  // Execute docker compose up
  const result = await executeCompose(
    ['up', '-d', '--remove-orphans'],
    { cwd: stackDir, env, envId }
  );
  
  return result;
}

Stack Storage:

Internal: ~/.dockhand/stacks/{stackName}/compose.yaml
Git: ~/.dockhand/git/{repoId}/{stackName}/compose.yaml
External: Detected via Docker labels, not stored

Authentication System

Multi-provider authentication with security best practices:

// src/lib/server/auth.ts
import argon2 from 'argon2';

export async function hashPassword(password: string): Promise<string> {
  return argon2.hash(password, {
    type: argon2.argon2id,  // Memory-hard, timing-attack resistant
    memoryCost: 65536,      // 64 MB
    timeCost: 3,            // 3 iterations
    parallelism: 4          // 4 threads
  });
}

export async function verifyPassword(
  hash: string,
  password: string
): Promise<boolean> {
  return argon2.verify(hash, password);
}

export async function createSession(userId: number): Promise<string> {
  // Generate cryptographically secure 32-byte token
  const token = Buffer.from(secureRandomBytes(32)).toString('hex');
  
  await dbCreateSession({
    userId,
    token,
    expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000) // 30 days
  });
  
  return token;
}

Cookie Configuration:

const cookieOptions = {
  httpOnly: true,           // Prevents XSS
  secure: isProduction,     // HTTPS only in production
  sameSite: 'strict',       // CSRF protection
  path: '/',
  maxAge: 30 * 24 * 60 * 60 // 30 days
};

Authorization (RBAC)

Role-Based Access Control for Enterprise edition:

// src/lib/server/authorize.ts
export interface AuthContext {
  user?: User;
  roles: Role[];
  permissions: Permissions;
  authEnabled: boolean;
  isEnterprise: boolean;
  
  can(resource: string, action: string, envId?: number): Promise<boolean>;
  canAccessEnvironment(envId: number): Promise<boolean>;
}

export async function authorize(cookies: Cookies): Promise<AuthContext> {
  const sessionToken = cookies.get(SESSION_COOKIE_NAME);
  if (!sessionToken) {
    return createGuestContext();
  }
  
  const session = await getSession(sessionToken);
  if (!session) {
    return createGuestContext();
  }
  
  const user = await getUser(session.userId);
  const roles = await getUserRoles(user.id);
  const permissions = mergePermissions(roles);
  
  return createAuthContext(user, roles, permissions);
}

Database Layer

Type-safe database operations with Drizzle ORM.

Drizzle ORM

Modern TypeScript ORM with zero-runtime overhead:

// src/lib/server/db/drizzle.ts
import { drizzle } from 'drizzle-orm/better-sqlite3';
import Database from 'better-sqlite3';
import * as schema from './schema';

const sqlite = new Database(dbPath);
export const db = drizzle(sqlite, { schema });

// Type-safe queries
export async function getEnvironment(id: number) {
  return db.query.environments.findFirst({
    where: eq(schema.environments.id, id)
  });
}

export async function listContainers(envId: number) {
  return db.query.containerEvents.findMany({
    where: eq(schema.containerEvents.environmentId, envId),
    orderBy: desc(schema.containerEvents.timestamp)
  });
}

Schema Design

Database tables are defined using Drizzle’s schema builder:

// Example: environments table
export const environments = sqliteTable('environments', {
  id: integer('id').primaryKey({ autoIncrement: true }),
  name: text('name').notNull(),
  connectionType: text('connection_type').notNull(),
  socketPath: text('socket_path'),
  host: text('host'),
  port: integer('port'),
  tls: integer('tls', { mode: 'boolean' }).default(false),
  tlsCert: text('tls_cert'),        // PEM format
  tlsKey: text('tls_key'),          // PEM format (encrypted)
  tlsCa: text('tls_ca'),            // PEM format
  tlsSkipVerify: integer('tls_skip_verify', { mode: 'boolean' }),
  collectActivity: integer('collect_activity', { mode: 'boolean' }).default(true),
  collectMetrics: integer('collect_metrics', { mode: 'boolean' }).default(true),
  icon: text('icon').default('globe'),
  labels: text('labels', { mode: 'json' }).$type<string[]>(),
  createdAt: text('created_at').notNull(),
  updatedAt: text('updated_at').notNull()
});

Migration System

Database migrations managed by Drizzle Kit:

# Generate migration from schema changes
bun drizzle-kit generate:sqlite

# Apply migrations
bun drizzle-kit push:sqlite

Migrations are stored in:

drizzle/ for SQLite
drizzle-pg/ for PostgreSQL

Migrations run automatically on application startup via hooks.server.ts.

Database Support

SQLite (Default)

Using better-sqlite3 for synchronous API and performance. Stored at $DATA_DIR/dockhand.db.

PostgreSQL

Using postgres package for production deployments. Configured via DATABASE_URL environment variable.

Base Operating System

Custom Wolfi-based OS built with apko for security and minimalism.

Wolfi OS

Wolfi is a Linux distribution designed for containers:

Minimal attack surface: Only necessary packages included
CVE-free: Packages rebuilt to eliminate known vulnerabilities
No shell required: Distroless by default
APK packages: Fast package management
Regular updates: Chainguard maintains the repository

apko Build Process

The Dockerfile uses apko to generate a custom OS:

# Stage 1: OS Generator
FROM alpine:3.21 AS os-builder

# Generate apko.yaml with explicit packages
RUN printf '%s\n' \
  "contents:" \
  "  repositories:" \
  "    - https://packages.wolfi.dev/os" \
  "  keyring:" \
  "    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub" \
  "  packages:" \
  "    - wolfi-base" \
  "    - ca-certificates" \
  "    - busybox" \
  "    - docker-cli" \
  "    - docker-compose" \
  "    - git" \
  "    - openssh-client" \
  "    - postgresql-client" \
  "    - sqlite" \
  > apko.yaml

# Build OS tarball
RUN apko build apko.yaml dockhand-base:latest output.tar

Packages Included:

wolfi-base: Core system files
ca-certificates: TLS certificate trust store
busybox: Essential Unix utilities
docker-cli, docker-compose: Docker management
git, openssh-client: Git operations
postgresql-client, sqlite: Database clients
tini: Init system for proper signal handling
su-exec: User switching for PUID/PGID support

Multi-Stage Build

# Stage 2: Application Builder
FROM node:24-slim AS app-builder
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
RUN npm run build
RUN npm ci --omit=dev  # Production dependencies only

# Stage 3: Final Image
FROM scratch
COPY --from=os-builder /work/rootfs/ /
COPY --from=app-builder /usr/local/bin/node /usr/local/bin/node
COPY --from=app-builder /app/build ./build
COPY --from=app-builder /app/node_modules ./node_modules

The final image is built from scratch with only the custom OS and application files. No base image vulnerabilities.

Real-Time Communication

Dockhand uses multiple protocols for real-time updates.

Server-Sent Events (SSE)

One-way server-to-client streaming:

// src/lib/server/sse.ts
export function createSSEStream(
  request: Request,
  listener: (send: (data: any) => void) => () => void
): Response {
  const stream = new ReadableStream({
    start(controller) {
      const send = (data: any) => {
        const message = `data: ${JSON.stringify(data)}\n\n`;
        controller.enqueue(new TextEncoder().encode(message));
      };
      
      const cleanup = listener(send);
      
      // Cleanup on close
      request.signal.addEventListener('abort', () => {
        cleanup();
        controller.close();
      });
    }
  });
  
  return new Response(stream, {
    headers: {
      'Content-Type': 'text/event-stream',
      'Cache-Control': 'no-cache',
      'Connection': 'keep-alive'
    }
  });
}

Use Cases:

Dashboard real-time stats
Log streaming
Deployment progress
Event notifications

WebSocket

Bi-directional communication for interactive features:

// Example: Terminal WebSocket endpoint
import { WebSocketServer } from 'ws';

export const websocket = {
  handler: (ws: WebSocket, request: Request) => {
    const { containerId } = parseUrl(request.url);
    
    // Exec into container
    const exec = await dockerExec(containerId, {
      Cmd: ['/bin/sh'],
      AttachStdin: true,
      AttachStdout: true,
      AttachStderr: true,
      Tty: true
    });
    
    // Pipe exec stream to WebSocket
    exec.stdout.on('data', data => ws.send(data));
    ws.on('message', data => exec.stdin.write(data));
    
    ws.on('close', () => exec.kill());
  }
};

Use Cases:

Interactive terminals
Container exec sessions
Real-time collaborative editing (future)

Monitoring & Metrics

Optional metrics collection using a separate Go process.

Collection Worker

Written in Go for performance:

// collector/main.go
package main

func collectMetrics(ctx context.Context, envId int) {
    client := createDockerClient()
    
    for {
        select {
        case <-ctx.Done():
            return
        case <-time.After(5 * time.Second):
            containers := listContainers(client)
            
            for _, container := range containers {
                stats := getContainerStats(client, container.ID)
                storeMetrics(envId, container.ID, stats)
            }
        }
    }
}

Collected Metrics:

CPU percentage (calculated from CPU delta)
Memory usage (with cache separation)
Network RX/TX bytes
Block I/O read/write bytes

Metrics Storage

In-memory storage with configurable retention:

// src/lib/server/metrics-store.ts
interface MetricsStore {
  [envId: number]: {
    [containerId: string]: ContainerStats[];
  };
}

const metrics: MetricsStore = {};
const MAX_POINTS = 360; // 30 minutes at 5-second intervals

export function storeMetric(envId: number, containerId: string, stats: ContainerStats) {
  if (!metrics[envId]) metrics[envId] = {};
  if (!metrics[envId][containerId]) metrics[envId][containerId] = [];
  
  metrics[envId][containerId].push(stats);
  
  // Keep only last MAX_POINTS
  if (metrics[envId][containerId].length > MAX_POINTS) {
    metrics[envId][containerId].shift();
  }
}

Security Architecture

Security is built into every layer of Dockhand.

Threat Model

Authentication

Prevent unauthorized access with Argon2id hashing, secure session tokens, and MFA support

Authorization

Enforce least privilege with RBAC, environment-level permissions, and resource-level checks

Data Protection

Encrypt sensitive data (credentials, certificates) with AES-256-GCM

Network Security

Use TLS for all remote connections, validate certificates, support mTLS

Container Isolation

Run as non-root user, drop capabilities, use read-only filesystem where possible

Encryption

Credentials and secrets are encrypted at rest:

// src/lib/server/encryption.ts
import { randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';

const ALGORITHM = 'aes-256-gcm';
const KEY_LENGTH = 32;
const IV_LENGTH = 16;
const AUTH_TAG_LENGTH = 16;

export function encrypt(plaintext: string, key: Buffer): string {
  const iv = randomBytes(IV_LENGTH);
  const cipher = createCipheriv(ALGORITHM, key, iv);
  
  let ciphertext = cipher.update(plaintext, 'utf8', 'hex');
  ciphertext += cipher.final('hex');
  
  const authTag = cipher.getAuthTag();
  
  // Format: iv:authTag:ciphertext
  return `${iv.toString('hex')}:${authTag.toString('hex')}:${ciphertext}`;
}

export function decrypt(encrypted: string, key: Buffer): string {
  const [ivHex, authTagHex, ciphertext] = encrypted.split(':');
  
  const iv = Buffer.from(ivHex, 'hex');
  const authTag = Buffer.from(authTagHex, 'hex');
  
  const decipher = createDecipheriv(ALGORITHM, key, iv);
  decipher.setAuthTag(authTag);
  
  let plaintext = decipher.update(ciphertext, 'hex', 'utf8');
  plaintext += decipher.final('utf8');
  
  return plaintext;
}

Encrypted Fields:

Docker registry passwords
Git SSH keys and tokens
LDAP bind passwords
OIDC client secrets
TLS private keys
Environment variables marked as secrets

Session Security

// Session token generation
function generateSessionToken(): string {
  const bytes = secureRandomBytes(32);  // 32 bytes = 256 bits
  return Buffer.from(bytes).toString('hex');  // 64 hex characters
}

// Session validation
async function validateSession(token: string): Promise<Session | null> {
  const session = await getSession(token);
  
  if (!session) return null;
  if (new Date() > new Date(session.expiresAt)) {
    await deleteSession(session.id);
    return null;
  }
  
  return session;
}

Audit Logging

All privileged actions are logged:

// src/lib/server/audit.ts
export async function auditContainer(
  userId: number,
  action: string,
  containerId: string,
  envId: number,
  details?: object
) {
  await createAuditLog({
    userId,
    action: `container.${action}`,
    resourceType: 'container',
    resourceId: containerId,
    environmentId: envId,
    details,
    timestamp: new Date().toISOString(),
    success: true
  });
}

Performance Optimizations

Response Compression

Automatic gzip compression for responses:

// src/hooks.server.ts
function shouldCompress(request: Request, response: Response): boolean {
  const acceptEncoding = request.headers.get('accept-encoding') || '';
  if (!acceptEncoding.includes('gzip')) return false;
  
  const contentType = response.headers.get('content-type') || '';
  const isCompressible = COMPRESSIBLE_TYPES.some(type => 
    contentType.includes(type)
  );
  
  return isCompressible;
}

async function compressResponse(response: Response): Promise<Response> {
  const body = await response.arrayBuffer();
  const compressed = gzipSync(new Uint8Array(body));
  
  const headers = new Headers(response.headers);
  headers.set('content-encoding', 'gzip');
  headers.delete('content-length');
  
  return new Response(compressed, { headers });
}

Database Indexing

Optimized indexes for common queries:

CREATE INDEX idx_container_events_env_time 
  ON container_events(environment_id, timestamp DESC);

CREATE INDEX idx_audit_logs_user_time 
  ON audit_logs(user_id, timestamp DESC);

CREATE INDEX idx_sessions_token 
  ON sessions(token);

Caching Strategy

In-memory caching: Environment list, user permissions
Conditional requests: ETags for static resources
Stale-while-revalidate: Background data refresh

Deployment Architecture

Single Container Deployment

Simplest deployment with SQLite:

version: '3.8'
services:
  dockhand:
    image: dockhand/dockhand:latest
    ports:
      - "3000:3000"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - dockhand-data:/app/data
    environment:
      PUID: 1001
      PGID: 1001

volumes:
  dockhand-data:

PostgreSQL Deployment

For production with external database:

version: '3.8'
services:
  dockhand:
    image: dockhand/dockhand:latest
    ports:
      - "3000:3000"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      DATABASE_URL: postgresql://user:pass@postgres:5432/dockhand
      PUID: 1001
      PGID: 1001
    depends_on:
      - postgres
  
  postgres:
    image: postgres:16-alpine
    volumes:
      - postgres-data:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: dockhand
      POSTGRES_USER: user
      POSTGRES_PASSWORD: pass

volumes:
  postgres-data:

High Availability

For enterprise deployments:

Load balancer: Nginx/Traefik in front of multiple Dockhand instances
Shared PostgreSQL: Managed database (RDS, CloudSQL, etc.)
Session affinity: Sticky sessions for WebSocket connections
Health checks: /api/health endpoint for load balancer

Dockhand is designed to be stateless except for the database, making horizontal scaling straightforward.

Extension Points

Dockhand provides several extension points for customization.

Webhooks

Outgoing webhooks for notifications:

interface WebhookPayload {
  event: string;          // e.g., 'container.started'
  timestamp: string;
  environment: { id: number; name: string };
  resource: object;       // Container, image, stack, etc.
  user?: { id: number; username: string };
}

// POST to webhook URL with custom headers
await fetch(webhookUrl, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-Dockhand-Signature': signature,
    ...customHeaders
  },
  body: JSON.stringify(payload)
});

MQTT Integration

Publish events to MQTT broker:

import mqtt from 'mqtt';

const client = mqtt.connect(brokerUrl, {
  username,
  password,
  clientId: 'dockhand'
});

client.publish(
  `dockhand/${envName}/containers/${containerId}/state`,
  JSON.stringify({ state: 'running', timestamp: new Date() }),
  { qos: 1, retain: true }
);

Custom Themes

Extend Tailwind configuration:

// src/lib/themes.ts
export const customTheme = {
  colors: {
    primary: { /* ... */ },
    secondary: { /* ... */ },
  },
  borderRadius: { /* ... */ },
  fontFamily: { /* ... */ }
};

Future Architecture Plans

Plugin System

Extensibility framework for custom integrations and UI components

GraphQL API

Alternative API layer for complex queries and subscriptions

Message Queue

Redis/NATS for distributed job processing

Kubernetes Support

Manage Kubernetes clusters alongside Docker

Overview

Getting Started

Core Features

Advanced Features

Authentication & Security

Deployment

Integrations

​Overview

​Architecture Diagram

​Frontend Architecture

​SvelteKit 2 & Svelte 5

​Svelte 5 Runes

​UI Components

shadcn-svelte

TailwindCSS v4

Lucide Icons

Mode Watcher

​Specialized Components

​Backend Architecture

​Bun Runtime

​Server Module Structure

​Docker API Integration

​Compose Stack Management

​Authentication System

​Authorization (RBAC)

​Database Layer

​Drizzle ORM

​Schema Design

​Migration System

​Database Support

​Base Operating System

​Wolfi OS

​apko Build Process

​Multi-Stage Build

​Real-Time Communication

​Server-Sent Events (SSE)

​WebSocket

​Monitoring & Metrics

​Collection Worker

​Metrics Storage

​Security Architecture

​Threat Model

​Encryption

​Session Security

​Audit Logging

​Performance Optimizations

​Response Compression

​Database Indexing

​Caching Strategy

​Deployment Architecture

​Single Container Deployment

​PostgreSQL Deployment

​High Availability

​Extension Points

​Webhooks

​MQTT Integration

​Custom Themes

​Future Architecture Plans

Plugin System

GraphQL API

Message Queue

Kubernetes Support

Build docs developers (and LLMs) love

Overview

Architecture Diagram

Frontend Architecture

SvelteKit 2 & Svelte 5

Svelte 5 Runes

UI Components

Specialized Components

Backend Architecture

Bun Runtime

Server Module Structure

Docker API Integration

Compose Stack Management

Authentication System

Authorization (RBAC)

Database Layer

Drizzle ORM

Schema Design

Migration System

Database Support

Base Operating System

Wolfi OS

apko Build Process

Multi-Stage Build

Real-Time Communication

Server-Sent Events (SSE)

WebSocket

Monitoring & Metrics

Collection Worker

Metrics Storage

Security Architecture

Threat Model

Encryption

Session Security

Audit Logging

Performance Optimizations

Response Compression

Database Indexing

Caching Strategy

Deployment Architecture

Single Container Deployment

PostgreSQL Deployment

High Availability

Extension Points

Webhooks

MQTT Integration

Custom Themes

Future Architecture Plans