Finsys/hawser

What it solves

Managing Docker hosts remotely can be tricky when they live behind a NAT, have dynamic IPs, or are otherwise not directly reachable from a central management tool. Hawser solves this by acting as a small agent on each Docker host that lets Dockhand (a central management platform) talk to that host securely, no matter the network setup.

How it works

Hawser is a lightweight Go program that runs on the Docker host. It provides full access to the local Docker API and can also handle Docker Compose operations. It works in two modes:

• Standard mode: The agent listens for incoming connections from Dockhand. This works best on LANs or hosts with static IPs.
• Edge mode: The agent initiates an outbound WebSocket connection to Dockhand. This works for VPSs, NAT networks, or hosts with dynamic IPs, because the host doesn't need to be reachable from the internet.

In both modes, Hawser requires a token for authentication (unless you bind to localhost). It also supports optional TLS encryption to secure the connection. Hawser collects host metrics (CPU, memory, disk, network) and sends them to Dockhand every 30 seconds in Edge mode. It includes automatic reconnection with exponential backoff and random jitter, so multiple agents don't overwhelm the server after a restart.

Who it's for

Administrators and developers who use Dockhand to manage multiple Docker hosts—whether that's a home lab, cloud VPS, NAS, or edge devices—and need a reliable, secure way to access them remotely, especially when the hosts are behind NAT or have changing IPs.

Highlights

• Two modes to cover different network setups: Standard (listen) and Edge (outbound WebSocket).
• Full Docker API proxy: manage containers, images, volumes, networks, logs, and interactive exec sessions.
• Docker Compose support for stack operations like up, down, pull, ps, and logs.
• Host metrics collection (CPU, memory, disk, network) reported to Dockhand.
• Auto-reconnect with exponential backoff and jitter for robust connections.
• Token authentication and optional TLS for security.
• Built-in health check endpoint to verify Docker connectivity.
• Can be deployed as a systemd service or a Docker container, with multi-arch support (amd64 and arm64).