Container Tools

Dive54.7k★

Dive is a tool for inspecting Docker images layer by layer. It's a terminal UI that lets you browse every file in every layer of a Docker image, see what was added/modified/removed, and spot wasted space. MIT license, written in Go. Run dive your-image:tag and get an interactive view: layers on the left, filesystem on the right. It highlights files that exist in one layer but get deleted in a later one (wasted space). Shows you the efficiency score of your image. Works in CI too. Set a threshold and fail the build if the image is too bloated. Fully free. Single binary, no paid tier, no service component. Every developer who builds Docker images should have this installed. The insight is immediate. You'll find multi-megabyte temp files, package manager caches, and build artifacts sitting in intermediate layers that you thought your RUN rm cleaned up (it didn't; each layer is immutable). The catch: Dive shows you the problem but doesn't fix it. You still need to restructure your Dockerfile: multi-stage builds, combined RUN commands, a proper .dockerignore. And the TUI can be slow on very large images (5GB+). But for diagnosing bloat, nothing else comes close.

Portainer38.8k★

Portainer is a web dashboard for your containers. Instead of typing Docker commands, you click through containers, images, volumes, networks and compose stacks, read logs and open a shell, across Docker, Swarm, Podman and Kubernetes. The Community Edition is zlib licensed, free, and installs as a single container. Setup takes a minute: run the container, open port 9443, create an admin account. Remote machines connect through a small agent. CE manages as many environments as you want and has admin and standard users, teams, LDAP and custom OAuth login. Business Edition adds granular RBAC, audit logs, registry management, container and stack webhooks, one-click Microsoft, Google and GitHub login, and edge device management. Business Edition starts at $1,045 a year for 5 nodes on the Starter plan (community support only), or $2,095 on Scale with next-business-day support. Portainer also gives each organization one free 3-node Business license (you request a new key when it expires) and sells a $155-a-year home and student license for up to 15 nodes. Homelab: CE, or take the free 3 nodes. Small businesses: the free 3-node key. Bigger fleets: budget for Scale, or look at Komodo, an open source manager with no server limit. The catch: in September Portainer rewrote its CE README to say CE is for homelabs and learning, not business or production, with no support and no release schedule, and only the latest version gets security fixes. Its published docs for the upcoming 3.0 release, due in October, go further and say CE releases stopped at 2.45. Treat CE as a hobby tool from here on.

Colima31.5k★

Colima runs Docker containers on a Mac without Docker Desktop. It boots a small Linux VM through Lima and points your normal docker CLI and Compose files at it, so daily commands don't change. It also runs containerd, Kubernetes via k3s and Incus, and now works on Linux too. MIT licensed and free. Setup is brew install colima docker, then colima start. The default VM gets 2 CPUs, 2GiB of RAM and 100GiB of disk, so raise --cpu and --memory for real workloads. Version 0.10 added GPU-accelerated AI model runs on Apple Silicon. This matters because Docker Desktop is only free for companies under 250 employees and under $10 million in revenue, and never for government. Past that line it's $9, $15 or $24 per user per month billed yearly ($11, $16 or $24 monthly). Colima has no such terms. Solo: free. Small through large teams: free, and a clean way to drop those seats. The catch: it's command-line only, with no GUI, no Extensions and no central admin controls, and it lives on one developer's personal account. The last release shipped in June. Podman Desktop and Rancher Desktop are the free GUI options.

Harbor29.7k★

Harbor is an enterprise-grade container registry you host yourself. Harbor does what Docker Hub does, but on your infrastructure. Push images, pull images, scan them for CVEs (Trivy integration), sign them (Cosign/Notary), replicate them across registries, and control who can access what with RBAC. It's a CNCF graduated project used by serious Kubernetes operations. This is production infrastructure, not a toy. Completely free. Apache 2.0 license. No paid tier. Small teams running Kubernetes in production who need image security (vulnerability scanning, access control) should seriously consider Harbor. The alternative is trusting Docker Hub or paying for a cloud registry. The catch: Harbor is not lightweight. It runs PostgreSQL, Redis, and several microservices. Minimum recommended is 4 GB RAM and 2 CPUs. Setup is doable with Docker Compose or Helm, but maintaining it (backups, upgrades, storage management) is real ops work.

Dockge24.8k★

Dockge is a web UI for Docker Compose stacks: create, edit, start, stop and update them from a browser instead of the terminal. It comes from the developer behind Uptime Kuma, and the UI shows it: fast, clean, obvious. Your compose files stay as normal files on disk, it converts docker run commands into compose files, and it can manage stacks across several Docker hosts from one screen. MIT, free. Setup is a folder, one downloaded compose file, and docker compose up -d. Existing stacks have to move into its stacks directory (/opt/stacks by default). Like Portainer, it mounts the Docker socket, which is root-level access to the host, so keep it off the public internet. There's no paid tier. Homelab and solo: still pleasant for a handful of stacks. Small teams: fine for a shared dev box, with the caveat below. Anything bigger: Portainer (portainer/portainer), whose free Community Edition is now officially for homelabs only and whose Business Edition is free for 3 nodes, then $1,045/yr for 5. The catch: the project has stalled. The last stable release was 1.5.0 in March 2025, newer features only ship in nightly builds, and users in the repo are openly asking whether it's dead. Several security reports sit in the tracker with no visible response. It's also compose-only: no Swarm, no Kubernetes, no network management. Fine for a homelab. For anything you care about, pick something maintained.

public-image-mirror15.3k★

Pulling container images from Google's registry or GitHub from inside China is slow to the point of useless. public-image-mirror fixes that. It's a free public mirror, run by DaoCloud, that caches images from gcr.io, ghcr.io, Docker Hub and others on fast domestic servers. (A container image is the packaged-up bundle your app and its dependencies ship in.) You change one thing: put m.daocloud.io/ in front of the image name, and the pull comes from China instead of crawling across the Pacific. There is nothing to run. No container to maintain, no server to stand up. You edit your image references, or point your Kubernetes, containerd, or Ollama config at the mirror, and you are done. That also means there is nothing you control. It is somebody else's infrastructure, free of charge, with the limits that implies: images are cached for 30 days, peak hours get congested, and the maintainers flat-out recommend scheduling big pulls for 1 to 7 AM Beijing time. If you are building from behind the Great Firewall, this is close to essential and costs nothing. Solo or enterprise, the call is the same: use it. If you are outside China with normal access to the upstream registries, you do not need it, and you probably do not want a third-party mirror in your supply chain when the real thing is already fast. The catch is trust. Every image you pull through a mirror is an image you are trusting the mirror to serve unchanged. DaoCloud keeps hash consistency with the source, which is the right call, but you are still routing your supply chain through someone else's servers. Fine for dev and CI pulls. Think harder before you bake it into a production base image.

podman-desktop8.1k★

Podman Desktop is the open source answer to Docker Desktop. Apache 2.0, no license fee, no user-count tripwire that converts your free install into an invoice once your company hits 250 employees. It manages containers, pods, images, and volumes from a GUI, and it can drive Podman, Docker, Lima, and CRC engines all from the same dashboard. Setup is a regular installer on macOS, Windows, or Linux. You don't run a service. The container engine sits behind it the same way Docker Desktop does, and the extensions marketplace lets you bolt on things like Kubernetes integration, Compose support, or registry tools as you need them. For solo developers and small teams Docker Desktop's free tier still works, but the moment your company crosses Docker's commercial threshold the calculus changes fast. Large teams: this is the free way out, and Red Hat keeps it well maintained. Worth installing on a new machine even if you're still on Docker Desktop, just to see if it sticks. The catch: a few corners feel less polished than Docker Desktop, especially around Compose workflows and some Windows-specific edges. If your team lives in docker-compose all day, expect a brief adjustment period.

smolvm7.0k★

smolvm boots a Linux microVM on your laptop in under a second and throws it away when you are done. Pull any OCI image from Docker Hub or ghcr.io with no Docker daemon involved, boot it as a real VM with its own kernel, run untrusted code inside it. The pitch is the boundary: containers share your kernel, this does not. Apache 2.0, single-binary CLI. Platform coverage has grown past the original macOS and Linux story: Apple Silicon and Intel Macs, Linux on x86_64 and aarch64, and Windows through the Windows Hypervisor Platform. Network is off by default, with per-host egress allowlists once you enable it, which is the correct default for a sandbox. GPU work runs through virtio-gpu with Vulkan, plus CUDA remoting for NVIDIA. Configured machines pack into portable .smolmachine artifacts, and snapshots push to an OCI registry. This is the tool for running agent-generated code, untrusted builds, or anything you would rather not hand your kernel. Solo and small teams: the sub-second start makes it practical per task rather than per session. Medium and large teams get the same thing with one caveat: there is no orchestration story. It is a local CLI, not a fleet manager. The catch is uneven platform parity. macOS needs code signing, Windows has neither GPU support nor snapshots, and volumes mount directories only. The docs also reference a "smolmachines cloud control plane" with nothing behind it yet, which usually signals a hosted tier coming. Nothing is gated today.

docker-php-extension-installer5.0k★

docker-php-extension-installer fixes one of the most annoying parts of PHP in Docker: getting extensions like GD, Xdebug, Redis or Imagick into the official php images. Instead of hunting down system libraries and compiling by hand, you run install-php-extensions gd xdebug. It installs the build packages, compiles, enables the extension and removes what it no longer needs so the image stays small. MIT, free. Usage is one Dockerfile line: ADD the script from the latest GitHub release, or COPY --from the maintainer's image on Docker Hub or GHCR. It supports Debian images back to Debian 8 and Alpine back to 3.9, pins extension versions (xdebug-^3), and installs Composer too. Nothing to run, nothing to buy. Solo, small and larger teams: free. It replaces hand-written docker-php-ext-install and pecl lines. The catch: every README example pulls the latest release, and releases go out almost daily, so today's build may run a different script than yesterday's. Some libraries are fetched at their newest upstream version, and some extensions default to non-stable PECL builds. Pin a release tag in production. It's also essentially a one-maintainer project, though a steady one since 2018.

lxd4.8k★

LXD is Canonical's system container and VM manager. Unlike Docker, which runs single-process application containers, LXD runs full Linux system containers that behave like lightweight VMs. The same tool also manages real KVM virtual machines through the same API. Apt-installable on Ubuntu, available everywhere else through snaps. Day-to-day, LXD is solid. Profile-based configuration, storage pools (ZFS, LVM, btrfs, dir), software-defined networking via OVN, snapshots, and live migration. The CLI is consistent and the REST API is well-documented. Clustering is built in for multi-host setups. Solo developers and homelabs run LXD without thinking about it. Teams should pause: in 2023 Canonical relicensed LXD to AGPL-3.0 and pulled it under a contributor license agreement, which prompted the original maintainers to fork the project as Incus under the Linux Containers umbrella. Incus is Apache 2.0, accepts external contributions on equal terms, and tracks LXD feature-for-feature. The catch is the governance, not the code. If you are picking a system container manager in 2026, look at Incus first. LXD still works fine, but the license posture and the loss of the original maintainer team are reasons most production deployments are migrating off it.

podman-tui1.3k★

podman-tui is a terminal dashboard for Podman. Containers, pods, images, volumes, and networks, all managed from a keyboard-driven UI instead of memorizing podman subcommands. It connects to a local Podman or a remote one over SSH, so you can drive a server's containers without a browser or a heavy desktop app. It comes from the containers org, the same upstream community behind Podman itself, and it is free under Apache-2.0. Setup is about as light as it gets. It is a single Go binary, no daemon of its own, no Electron, no login. If you already run Podman, you are a download away from a working TUI. Because it talks to Podman's API directly, it inherits Podman's rootless, daemonless model, which is the whole reason a lot of people moved off Docker in the first place. For anyone living in the terminal who manages containers on servers, this is an easy yes. It is the free, lightweight counterpart to Docker Desktop's GUI, minus the licensing questions Docker Desktop raises for bigger companies. Solo, small team, or large: same answer, it is free and it stays out of your way. The catch is scope. It manages Podman and only Podman. If your shop runs Docker or a mix, this is not your tool; look at lazydocker for the Docker side. And a TUI is still a TUI, great for triage and quick edits, not a replacement for proper orchestration once you are on Kubernetes.