docknest

Back up Docker sites. Verify recovery points. Restore a private copy.

Install · Using DockNest · Updating · Documentation · Latest release

What it does

DockNest is a self-hosted web app. It connects to your Linux servers over SSH, backs up each Docker or static nginx site to storage you own, and lets you restore any backup to a separate copy to check that it works.

• Discovers the Docker projects and static nginx sites on each server you connect.
• Backs up each site on its own schedule to encrypted SFTP or S3-compatible storage. Connect storage starts with a provider (own server or NAS, Hetzner, rsync.net, MinIO, Amazon S3, Cloudflare R2, Backblaze B2, Wasabi or another) and fills in its defaults.
• Verifies recovery points and restores them to a separate copy. The live site is not overwritten.
• Shows live progress, the steps of each job and the reason when one fails.

Note

DockNest is in beta. The support matrix states what has been tested and what has not. Automatic recovery after a server reboot is not ready for production use.

Features

Backup and restore

• Captures images, volumes, bind mounts, writable layers and databases. Database capture is handled for PostgreSQL, MySQL/MariaDB and Redis.
• Per-site schedules, retention, and pinned backups.
• Restore to a separate copy; DockNest does not replace a live site by itself.
• Download a backup as an encrypted file or as a ZIP. An increment downloads as a chain (encrypted packages plus an order file) from the backup library.
• Incremental backups (beta, off by default): a full backup, then increments that hold only the files that changed in your mounts. Every restore point still restores to a complete copy. Images are saved as before, so the saving comes from mount data. After a backup that contains folder renames, the next backup is full. See incremental backups.
• Optional maintenance page, designed in a visual editor, while a site is paused.

Operation

• Jobs page with transfer progress, a step timeline and plain-language error explanations.
• DockNest can back up its own data to your storage. See self-backup.
• Update Center with an opt-in update check and click-to-update through a host updater.
• Problem reports that open a pre-filled public GitHub issue with typed values only, after you review what is shared.
• Light and dark themes, and a layout for phones.

Map and moving sites

• A Map page shows your servers, their sites and your backup storage as connected nodes. Click any node for its details, such as the databases that move with a site.
• The "+" on a server lists sites DockNest found there that you have not added yet.
• Administrators move a site to another server by dragging it to that server and pressing Save changes. DockNest shows how long the move takes and how long the site is offline, then backs up the site, tests a copy on the new server and waits for your DNS change before switching.
• The old copy is kept stopped for 7 days, so you can switch back. Removing it is never automatic. See moving sites.
• When the new server is missing nginx, Docker, Docker Compose or certbot, DockNest can install it for you after you confirm, or show you the command to run yourself.

Alerts

• Get an alert in Telegram, email, WhatsApp, Discord, Slack, Microsoft Teams, Google Chat, Mattermost, ntfy, Gotify, Pushover, Matrix or a webhook when a backup fails or passes, a move finishes or needs you, a server is unreachable or low on disk, or a new version is out.
• Save the login once in Administration, Connections (encrypted, never shown again), then add an alert node on the Map, draw a line from DockNest, a server or a site, and pick the events. See alerts.

Security

• Backups are encrypted with AES-256-GCM.
• SSH host keys are pinned and checked before connecting.
• Every user signs in with a password and an authenticator app.
• The dashboard never uses the Docker socket.

Requirements

Install

Build from source (default)

git clone https://github.com/DahanItamar/DockNest.git
cd DockNest
npm ci
npm run setup

Setup creates .env, data/master.key and data/setup.token. Keep them private and keep a safe copy of data/master.key. Without it your backups cannot be decrypted, and resetting the password does not help.

Point a domain at the host, open ports 80 and 443, and set these in .env:

APP_DOMAIN=backup.example.com
APP_ORIGIN=https://backup.example.com
SECURE_COOKIES=true

Start everything. Caddy obtains the HTTPS certificate:

docker compose --profile https up -d --build

If you already run an HTTPS reverse proxy, leave out --profile https. See Deployment.

Published image (alternative)

Final releases are published as a signed linux/amd64 image, ghcr.io/dahanitamar/docknest. Set DOCKNEST_IMAGE in .env to a tag and use compose.override.example.yaml as your compose.override.yaml. The steps and the signature check are in Use the published image. On ARM hosts, build from source.

Try it locally

npm ci
npm run setup
npm run build
npm start

In a second terminal run npm run worker, then open http://127.0.0.1:3000. On Windows PowerShell, use npm.cmd if npm is blocked.

Using DockNest

1. Sign in. Use the setup token from data/setup.token, add your authenticator app and save the recovery codes.
2. Connect storage under Storage.
3. Add a server and confirm its SSH fingerprint. See server connection.
4. Add a site. DockNest discovers Docker projects and static nginx sites; review what it found. See site setup.
5. Check readiness. For Docker sites, set up the maintenance page first.
6. Run a backup, then watch it under Jobs.
7. Verify and restore. Restore a recovery point to a separate copy to confirm it works. See recovery verification.
8. Turn on the schedule for the site.

Notes:

• ZIP downloads are not encrypted and can contain passwords and keys. Keep them private.
• To set or change the password on Windows, run scripts\set-admin-password.ps1.

Updating

Version numbers and release notes are on the latest release page, and in the changelog.

From the app. Administrators have an Update Center page. Nothing contacts GitHub until an administrator agrees once; after that DockNest checks the public release list daily. An update starts only when an administrator confirms with the password and an authenticator code. It runs through a small root service on the host, the host updater, which you install once on the DockNest host (Linux with systemd and rootful Docker; not Docker Desktop or rootless Docker):

sudo scripts/install-updater.sh

From the command line. The updater is optional. Without it:

scripts/upgrade.sh              # newest final release
scripts/upgrade.sh --dry-run    # show the plan only

Before going back to 2.11 from 2.12, turn incremental backups off for every site, then make a backup. Details, rollback and exit codes: Upgrading and Host updater and Update Center. The in-app update path has not been validated on a real Linux Docker host yet; see that section for the current status.

Security and privacy

• Backups are encrypted, SSH host keys are pinned, and sign-in needs a password plus an authenticator app.
• Update checks are off until an administrator opts in, and send nothing about your servers, sites or users. See outbound requests.
• Problem reports contain typed values only (no names, addresses, paths or error text), you review them first, and the server sends nothing. See problem reports.

Full model: docs/security.md. Report vulnerabilities privately as described in SECURITY.md.

Documentation

Support and contributing

• Bug or problem: open an issue, or use Report a bug under Settings > About in the app.
• Questions and ideas: Discussions.
• Security issues: privately, see SECURITY.md.
• Contributing: CONTRIBUTING.md covers setup and the checks every pull request runs.

License

GNU AGPL-3.0. Bundled fonts and dependencies keep their own licenses.