Every feature ships in the free binary.
16+ features covering the full Docker fleet management lifecycle — without tiers, feature gates, or trial limits.
One pane of glass across every Docker host you run.
Remote agents connect outbound over mTLS — no inbound ports, no VPN jumpbox, no reverse tunnel. dockmesh gives you a live, filtered view of every container across every host, and lets you deploy, scale, migrate, and exec as if they were all local.
- 01 Outbound-only mTLS agent protocol
- 02 Fan-out lists with host tag filter
- 03 Auto-agent upgrade on server update
- 04 Revocable per-host certificates
Enterprise-grade controls, without the enterprise price tag.
Every feature Portainer Business charges for — custom RBAC roles, SSO group mapping, TOTP 2FA, tamper-proof audit log — ships in the free binary. Scope roles by host tag for per-team isolation.
- 01 Custom RBAC roles with granular permissions
- 02 OIDC SSO — Azure AD, Google, Keycloak, Okta, Authentik
- 03 TOTP 2FA with single-use recovery codes
- 04 SHA-256 hash-chained audit log
Air-tight backups to anywhere you have space.
Schedule encrypted backups of stack volumes and optional database dumps to local disk, NAS (SMB), SFTP, WebDAV, or S3. Pre-backup hooks guarantee consistency for databases. One-click restore to any host — including across the fleet.
- 01 Five target types: Local · SMB · SFTP · WebDAV · S3
- 02 age-encrypted archives, passphrase never leaves the server
- 03 Preset hooks for Postgres, MySQL, Redis · custom shell supported
- 04 Grandfather-Father-Son retention or simple keep-last-N
Everything in the binary.
No paid add-ons, no separate modules, no plugins to install. What you see is what you get.