Infrastructure
Docker, networking, and exposure
Host primitives, routing layers, and publishing workloads.
#Docker management
The Docker area manages host-level primitives per node: containers (create, operate, logs, stats, files), images (list, pull, build, push, tag, search, delete), networks, and volumes with prune. Single-node calls require an explicit ?node= target and fail closed without it; fleet calls fan out to every node and report partial failures as subsets, not errors, with total failure as 502.
GET /containers POST /containers POST .../:id/operate
GET /images POST /images/pull|/build POST .../:id/push|/tag
GET|POST /networks|/volumes DELETE .../:id POST /volumes/prune#Routing layers
| Layer | Does |
|---|---|
| Endpoints | Portainer-style node groupings with access policies and diagnostics. |
| Service discovery | Endpoint registry with status patching. |
| Load balancer | Weighted L4 target groups with per-client-IP picks; game range 30000–30100. |
| Traffic manager | L7 rules and policies synced to the gateway, with rollback that errors when there is no backup. |
| Failover | Per-node policies with failure and crash recording plus metrics. |
#Domains and certificates
Server domains verify ownership through a well-known token file with DNS fallback and a daily reverify ticker; only verified hostnames sync to the proxy. The gateway layer adds HTTPS, certificate types (none, letsencrypt, custom), path routing, auth forwarding, websockets, and rate limits. Certificates issue through configurable providers (wildcard requires DNS-01), install to the gateway mandatorily, renew on a daily sweep, and can be uploaded manually or exported with keys. DNS provider accounts and ACME accounts are managed separately.