Meet DockRouter

A small router with a Docker point of view

DockRouter is a self-hosted ingress router. It watches the Docker socket, discovers enabled containers and forwards incoming HTTP and HTTPS traffic to them. Routing settings live in Docker labels; global settings live in environment variables or command-line flags.

Before you start

Use a Docker host reachable from the internet, a domain you control and DNS records pointing to that host. Automatic TLS needs public access to ports 80 and 443. Keep DockRouter and your services on a shared Docker network. Persist /data so certificate state survives restarts.

Docker socket access is privileged. Only run trusted router images, and keep the administration interface private. A read-only socket mount does not make the Docker API read-only.

Your first Docker Compose deployment

Save this as compose.yml. Replace app.example.com and you@example.com with your domain and email, then run docker compose up -d. The two services share Compose’s default network.

services:
  dockrouter:
    image: dockrouter/dockrouter:latest
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - dockrouter-data:/data
    environment:
      DR_ACME_EMAIL: you@example.com
  web:
    image: nginx:alpine
    labels:
      dr.enable: "true"
      dr.host: "app.example.com"
      dr.tls: "auto"
volumes:
  dockrouter-data:

Follow the first request

Wait for DNS to resolve and for certificate issuance, then open your hostname over HTTPS. Inspect container logs if a certificate is still pending. Your application does not need to handle TLS itself.

docker compose up -d
docker compose logs -f dockrouter
# On your workstation:
curl -I https://app.example.com

Make the route yours

Add path matching, a port override or a load-balancing policy through labels. Use the TLS, security and observability guides to configure the edge for your own infrastructure.