Features
Every feature ships
in the free binary.
16+ features covering the full Docker fleet management lifecycle — without tiers, feature gates, or trial limits.
Deep dive · Fleet
One pane of glass across every Docker host you run.
Remote agents connect outbound over mTLS — no inbound ports, no VPN jumpbox, no reverse tunnel. dockmesh gives you a live, filtered view of every container across every host, and lets you deploy, scale, migrate, and exec as if they were all local.
- Outbound-only mTLS agent protocol
- Fan-out lists with host tag filter
- Auto-agent upgrade on server update
- Revocable per-host certificates
Deep dive · Security
Enterprise-grade controls, without the enterprise price tag.
Every feature Portainer Business charges for — custom RBAC roles, SSO group mapping, TOTP 2FA, tamper-proof audit log — ships in the free binary. Scope roles by host tag for per-team isolation.
- Custom RBAC roles with granular permissions
- OIDC SSO — Azure AD, Google, Keycloak, Okta, Authentik
- TOTP 2FA with single-use recovery codes
- SHA-256 hash-chained audit log
Deep dive · Backups
Air-tight backups to anywhere you have space.
Schedule encrypted backups of stack volumes and optional database dumps to local disk, NAS (SMB), SFTP, WebDAV, or S3. Pre-backup hooks guarantee consistency for databases. One-click restore to any host — including across the fleet.
- Five target types: Local · SMB · SFTP · WebDAV · S3
- age-encrypted archives, passphrase never leaves the server
- Preset hooks for Postgres, MySQL, Redis · custom shell supported
- Grandfather-Father-Son retention or simple keep-last-N
The full list
Everything in the binary.
No paid add-ons, no separate modules, no plugins to install. What you see is what you get.