Tomáš Dvořák
0dc5857b5f
* refactor(db): port operations, settings, audit, activity, and misc service metadata to sqlc Covers the cross-cutting surface: operations board reads, app settings, notification producers, activity/audit inserts, builds upsert/cancel, git clone credential resolution, invites, environments, registry auth, project/service variables, HA resolver, boot sweeps, and admin user ops. Dynamic filtered lists and Better Auth table probes stay raw by design. Authored By: TDvorak <[email protected]> * refactor(db): port apwhy gateway handlers and proxy data plane to sqlc Final tranche — every static call site now uses generated queries. Raw SQL remains only where the statement is assembled at runtime (filtered lists, sparse updates, admin count closure) or probes Better Auth's auth_users table, which lives outside the local schema. Authored By: TDvorak <[email protected]>
Containr
Self-hosted platform for deploying and managing containerized services. Railway-style project canvases on your own hardware.
Quick Start • Screenshots • Features • Guides • Contributing
Containr is an open-source control plane for Docker. Create a project, drop services onto a visual canvas, wire them together with environment variables, and deploy — no Kubernetes, no cloud bill. Services appear as nodes with auto-inferred connections; logs, metrics, builds, and rollbacks are one click away.
The platform doubles as a public showcase: visitors browse approved projects and the template catalog without an account, while owners manage everything behind sign-in and a platform admin approves, curates, and moderates from a dedicated console.
Screenshots
| Projects dashboard | Project canvas |
|---|---|
 |
 |
| Service detail | Managed databases |
|---|---|
 |
 |
Features
- Project canvas — visual service topology, groups, drag/drop, auto-inferred connections, right-click lifecycle actions
- Public project catalog — approved projects are browsable anonymously; new projects stay private until an admin approves them
- Admin console (
/admin) — platform stats, project approval/edit/delete, user admin management - Private networking — every project gets an isolated Docker network; services reach each other by name (
web:3000) and share variables via${{service.KEY}}references - Deployments & builds — Docker deploys with history, image rollback, live build status; git-sourced services build directly on remote node agents (no registry required)
- Runtime — replicas, published ports, domains, health checks, restart policies; start/stop/restart/redeploy from canvas or service page
- Git integration — GitHub, GitLab, Bitbucket, Gitea; webhooks, GitHub App
- Managed databases — create PostgreSQL, MySQL, MariaDB, MongoDB, Redis, Dragonfly, or ClickHouse directly from
/databases, with backup/restore - Template catalog — 30 official templates (NocoDB, Plausible, MinIO, n8n, …) plus user-defined templates with JSON upload and owner-scoped edit/delete
- Metrics — per-service Docker stats plus host CPU/memory/disk telemetry
- HA & scaling — failover policies, node agents, autoscaling rules
- Auth & security — Better Auth sessions (email/password self-hosted), personal access tokens with
read/write/adminscopes for CLI and agents, audit logs, vulnerability scans - CLI —
containrcovers the full API: projects, services, deployments, logs, exec, variables, databases, cron, templates, nodes, scaling, HA, security, gateway, admin — with--json,--yes, named profiles, andcontainr upfor current-directory deploys - Integrated docs — searchable documentation rendered in-app on the landing page and
/docs; syncs from GitHub, falls back to a bundled snapshot offline - Networking — Traefik reverse proxy, optional Cloudflare Tunnel
Access model
| Audience | Can do |
|---|---|
| Anonymous | Browse approved projects, services, templates, databases, HA status, docs |
| Signed-in user | Create/manage own projects, services, databases, templates; view own logs, variables, builds, deployments |
| Admin | Everything above plus project approval/moderation, user admin flags, HA manager controls, agent tokens, platform settings |
Logs, variables, exec consoles, and database connection URLs are never public — they require owner, member, or admin access regardless of a project's public visibility.
Quick Start
Requires Docker with the Compose plugin, openssl, and curl:
curl -fsSL https://raw.githubusercontent.com/Dvorinka/Containr/main/install.sh | bash
Installs into ./containr, generates secrets, pulls the published :latest
images, and starts the stack — UI at http://localhost:3000, API at
http://localhost:8082. Non-interactive; re-runs never overwrite .env.
The platform admin is provisioned at startup from environment variables:
ADMIN_EMAIL=[email protected]
ADMIN_PASSWORD=<generated> # keep in a local untracked file
ADMIN_NAME=Your Name # optional
Both the local account and the Better Auth session account are created, so
either sign-in path works. Without ADMIN_*, the first registered account
becomes owner; registration then closes automatically. The owner can reopen
it and configure a Cloudflare Tunnel token under Settings → Platform —
in-app values override env vars.
Override install defaults with env vars:
curl -fsSL https://raw.githubusercontent.com/Dvorinka/Containr/main/install.sh | \
HTTP_PORT=8080 CONTAINR_DIR=/opt/containr bash
CONTAINR_VERSION pins a release tag, CONTAINR_REF selects the git ref for
downloaded files, CONTAINR_BUILD=1 builds from source. From a git checkout,
./install.sh installs in place; plain docker compose up -d pulls the same
images (--build to compile locally).
Local development and self-hosted deployment (Traefik + Cloudflare Tunnel):
see docs/guides/ and infra/docker-compose.yml.
Architecture
app/frontend/ React 19 + Vite + TypeScript + Tailwind + React Flow
app/backend/ Go API (Gin) · PostgreSQL · Dragonfly · Docker SDK · Better Auth sidecar
infra/ Self-hosted compose: Traefik + Cloudflare Tunnel
docs/ Guides, OpenAPI spec, design documents
All configuration is via environment variables — see .env.example. Never
commit .env or .env.prod; keep generated admin credentials in a local
untracked file (e.g. admin-credentials.local). If a secret was ever
committed, rotate it.
Documentation
- In-app: the landing page and
/docsrender searchable docs — synced from this repository, with a bundled snapshot so they are never blank offline - docs/guides/ — setup, deployment, Cloudflare, autoscaling
- docs/api/openapi.yaml — API contract
- docs/developers/onboarding.md — contributor onboarding
make help— common tasks
Contributing · Security · MIT License © 2026 Tomas Dvorak