DockNest

What it does

DockNest is a self-hosted web app. It connects to your Linux servers over SSH, backs up each Docker or static nginx site to storage you own, and lets you restore any backup to a separate copy to check that it works.

• Discovers the Docker projects and static nginx sites on each server you connect.
• Backs up each site on its own schedule to encrypted SFTP or S3-compatible storage. Connect storage starts with a provider (own server or NAS, Hetzner, rsync.net, MinIO, Amazon S3, Cloudflare R2, Backblaze B2, Wasabi or another) and fills in its defaults.
• Verifies recovery points and restores them to a separate copy. The live site is not overwritten.
• Shows live progress, the steps of each job and the reason when one fails.

[!NOTE] DockNest runs real Docker and static sites in production, and every release passes real Linux Docker tests. The support matrix lists the tested configurations. Incremental backups are still in beta.

Features

Backup and restore

• Captures images, volumes, bind mounts, writable layers and databases. Database capture is handled for PostgreSQL, MySQL/MariaDB and Redis.
• Per-site schedules, retention, and pinned backups.
• Restore to a separate copy; DockNest does not replace a live site by itself.
• Restore copies, restore tests and moves keep the original's protections (read-only root, dropped capabilities, no-new-privileges, seccomp and AppArmor), or refuse with a clear reason.
• Automatic restore tests: on a schedule, DockNest restores the latest verified backup onto a test server, starts it in isolation, checks it and removes it. See restore tests.
• Keep up to three extra copies of each backup on other storage, for example SFTP plus S3, each with its own retention.
• Download a backup as an encrypted file or as a ZIP. An increment downloads as a chain (encrypted packages plus an order file) from the backup library.
• Incremental backups (beta, off by default): a full backup, then increments that hold only the files that changed in your mounts. Every restore point still restores to a complete copy. Images are saved as before, so the saving comes from mount data. After a backup that contains folder renames, the next backup is full. See incremental backups.
• Optional maintenance page, designed in a visual editor, while a site is paused. For sites behind nginx on the server, DockNest sets it up, tests it on your domain and undoes it if anything fails.

Operation

• Jobs page with transfer progress, a step timeline and plain-language error explanations.
• DockNest can back up its own data to your storage. See self-backup.
• A recovery kit restores DockNest and rebuilds backups without it. See independent recovery.
• Storage page with space per site and per destination, and growth over time.
• Server cleanup: preview the space unused Docker images, stopped containers, anonymous volumes and old build cache take, then clean after you confirm. Anything a site, backup, restore test or move still needs is kept. See server cleanup.
• Hardening score: each site gets a grade from A to F with a plain fix for each finding, such as a mounted Docker socket or a database port open to the network. Read-only; it never changes the site. See hardening score.
• Update Center with an opt-in update check and click-to-update through a host updater.
• Problem reports that open a pre-filled public GitHub issue with typed values only, after you review what is shared.
• Light and dark themes, and a layout for phones.

Map and moving sites

• A Map page shows your servers, their sites and your backup storage as connected nodes. Click any node for its details, such as the databases that move with a site.
• The "+" on a server lists sites DockNest found there that you have not added yet.
• Administrators can launch a new Docker site from a server on the Map from a Compose file or Git repository, with backups from the first day (beta). See launch a site.
• Administrators move a site to another server by dragging it to that server and pressing Save changes. DockNest shows how long the move takes and how long the site is offline, then backs up the site, tests a copy on the new server and waits for your DNS change before switching.
• The old copy is kept stopped for 7 days, so you can switch back. Removing it is never automatic. See moving sites.
• When the new server is missing nginx, Docker, Docker Compose or certbot, DockNest can install it for you after you confirm, or show you the command to run yourself.

Safe changes (beta)

• Administrators change a site's Compose file, environment values, published ports or image tag from DockNest. Each change takes a backup first, shows the maintenance page, checks the site comes up and undoes the change by itself when it does not. Environment values are write-only (they can be replaced or removed), a finished Compose change can be undone, and a change can never add privileges the site did not have. See Safe Edit.
• Self-heal (off by default): when Docker marks a container of a site unhealthy, DockNest restarts it a few times per hour at most and tells you through your alert lines. It never restarts during a backup, restore, move or change of that site, and works while DockNest is running. See self-heal.

This is the beginning of the README. Read the rest at the original. Read the full README ↗