Dockhand vs Drydock
Dockhand and Drydock are both container update tools with web UIs and security scanning. Drydock adds automatic rollback, maintenance windows, lifecycle hooks, and broader registry and notification coverage — all free and open source.
Feature Comparison
Here's how we compare on the features that matter most.
| Feature | Dockhand | Drydock |
|---|---|---|
| Project status | Actively maintained | Actively maintained |
| Language | Svelte + TypeScript (Bun) | TypeScript |
| Web UI | Yes | Yes |
| Image update detection | Yes | Yes |
| Auto-update containers | Yes | Yes (monitor-first) |
| Vulnerability scanning | Yes (Safe-Pull Protection) | Yes (Trivy + SBOM + cosign) |
| Automatic rollback | No | Yes, on health check failure |
| Maintenance windows | No | Yes |
| Lifecycle hooks (pre/post) | No | Yes, with timeout & abort |
| Image backup | No | Pre-update backup with retention |
| Dry-run preview | No | Yes |
| Registry providers | Major registries | 23 dedicated integrations |
| Notifications | SMTP, Gotify, ntfy, Pushover, Telegram, Mattermost, Teams, Bark, Signal, Apprise passthrough (80+ services) | 20 native trigger integrations |
| MQTT / Home Assistant | No | Yes |
| Distributed agents | Yes (headless agents) | Yes (SSE-based agents) |
| OIDC / SSO | Yes | Yes (Authelia, Auth0, Authentik) |
| Prometheus metrics | Planned | Full /metrics endpoint + Grafana template |
| Audit log | Activity log (free); compliance audit log (Enterprise only) | Yes, free (REST API) |
| Git-based stack deployment | Yes | Planned |
| Web terminal / shell | Yes | Planned |
| File browser | Yes | Planned |
| Secret management | Planned | Planned (free) |
| License | BSL 1.1 (source-available; converts to Apache 2.0 in 2029) | AGPL-3.0 |
Key Differentiators
What we built that Dockhand doesn't cover.
Update Safety Controls
Automatic rollback on health check failure, maintenance windows, lifecycle hooks, and dry-run preview. Dockhand's safe-pull protection rolls back if a new container fails to start, but doesn't support proactive health-check rollback, maintenance windows, or lifecycle hooks.
23 Registry Providers
Dedicated integrations for Docker Hub, GHCR, ECR, GCR, GAR, GitLab, Quay, Harbor, Artifactory, Nexus, and more — broader registry support than Dockhand.
20 Trigger Integrations
Slack, Discord, Telegram, Teams, Matrix, SMTP, MQTT, Kafka, Gotify, NTFY, and more. Dockhand offers SMTP, Gotify, ntfy, Telegram, and several others, plus Apprise passthrough. Drydock's 20 native integrations include Kafka, MQTT/Home Assistant, and Matrix out of the box without needing an Apprise server.
Free Audit Log
Full audit trail with REST API and Prometheus counter — included free. Dockhand includes a basic activity log in the free tier, but compliance-grade audit logging requires the Enterprise edition.
SSE-Based Agents
Both tools support distributed monitoring. Drydock uses SSE-based agents for real-time communication with a centralized dashboard.
Fully Open Source
Every Drydock feature is free and open source. Dockhand gates audit logs, secret management, and some features behind an Enterprise tier.
Considering Dockhand?
Both are solid choices. If you want update safety controls (rollback, maintenance windows, hooks) and the broadest registry and notification coverage — all free — Drydock is built for that. One Docker command to get started.
$ docker run -d \
--name drydock \
-v /var/run/docker.sock:/var/run/docker.sock \
-p 3000:3000 \
-e DD_ANONYMOUS_AUTH_CONFIRM=true \
codeswhat/drydock # open dashboard — add real auth before exposing thisReady to try Drydock?
No SaaS subscription, no data sent off your host, and we ship updates fast.