- One-line install (
curl … | sh) on a fresh Ubuntu 22.04+ / Debian 12+ server - Docker and a per-server Traefik proxy are installed automatically
- Outbound WebSocket only: no inbound ports, no SSH keys, no firewall holes
- Live CPU, memory, disk and network per server, container list per project
- Agents update themselves from the panel build they connect to
- Private servers: no DNS record, no free subdomains, IP never leaks
How a server joins the panel
Open Servers → Add server, copy the install command and paste it on a fresh box as root. That is the whole process. The script installs Docker if it is missing, starts the dockxo-agent container and a dockxo-traefik container, and the agent opens a WebSocket from the server to the panel. Enrollment tokens expire after 15 minutes until first use, and every server keeps its own long-lived token after that.
Because the connection is outbound, the panel never needs SSH access, your server never needs an open management port, and a server behind NAT or a strict firewall works just as well as one with a public IP.
What the agent does
The agent is the only thing that touches your server. It talks to docker.sock directly, so everything you see in the panel is a real Docker object you could inspect yourself:
- builds images from GitHub, a registry or an inline Dockerfile
- creates a private network per project and a
dockxo-proxynetwork for Traefik - rewrites Traefik’s dynamic configuration on every container start and stop
- streams
docker logs -fanddocker exec -it … shback to the panel - collects metrics and parses Traefik’s access log for the Traffic tab
- packs and streams volumes to another server when you migrate a service
Agents update themselves: when the panel is upgraded, each connected agent pulls the build that matches and restarts in place.
Private servers
A server can be marked private. It gets no wildcard DNS record, no free subdomains and no public agent name, so its IP never appears in DNS or in certificate-transparency logs. Private servers are ideal as load-balancer members or database replicas: their containers are reached through the balancer or the project network, and uploads and migrations to them go through the panel.
Server page
Each server page shows live CPU, RAM, disk and network, every container grouped by project, the wildcard DNS record it expects (or created, with a Cloudflare token), and controls to restart the agent or disconnect the server. Any published host port can be restricted to IPv4 or CIDR sources; the allowlist editor marks which sources are your own servers and offers the missing ones in one click.