v0.2.0-alpha.1Docker labels are here. Automatic HTTPS is next.

One reverse proxy for every dock.

Route, secure and observe your services on a laptop, a VPS or a cluster. One static Rust binary on Cloudflare's Pingora, with Traefik's rule language and reloads that never drop a request.

Get startedComing from Traefik or NGINX?
docker run -p 80:80 ghcr.io/docker-hunterpedia/rdock:0.2.0-alpha.1

Apache-2.0 · free forever · no account, no telemetry

/etc/rdock/rdock.yaml
listeners:
  web:       { address: ":80" }
  websecure: { address: ":443", tls: {} }

routes:
  app:
    match: "Host(`app.example.com`)"
    service: app
    middlewares: [gzip]
  api:
    match: "Host(`app.example.com`) && PathPrefix(`/api`)"
    service: api

services:
  app: { backends: [{ address: "app:3000" }] }
  api: { backends: [{ address: "api:8080" }] }

# HTTP → HTTPS redirect and HTTP/2 are on by default.
$ rdock reload
applied generation 422 routes · 2 services · 0 requests dropped
Engineshipped

Rust on Pingora

The HTTP engine Cloudflare runs at its edge, with our own listeners on top. HTTP/1.1, HTTP/2, h2c, WebSocket, SSE and gRPC.

Operationsshipped

Reloads that drop nothing

Edit the file, send SIGHUP or call the API. A broken config is refused and the last good one keeps serving.

Dockershipped

Labels on your containers

Route containers from rdock.* labels, with the common Traefik labels understood as they are.

TLSv0.3

Automatic HTTPS

Certificates from Let's Encrypt, renewed on schedule, including wildcards through DNS-01.

Migrate

Keep your Traefik rules. Lose the boilerplate.

ReverseDock reads the same Host, PathPrefix and Headers matchers as Traefik v3, with the same priorities. Each migration guide maps every concept, shows both configs side by side and walks you through a switch-over you can roll back.

traefik/dynamic.ymlTraefik v3
http:
  routers:
    app:
      rule: "Host(`app.example.com`)"
      service: app
  services:
    app:
      loadBalancer:
        servers:
          - url: "http://app:3000"
rdock.yamlReverseDock
routes:
  app:
    match: "Host(`app.example.com`)"
    service: app

services:
  app:
    backends: [{ address: "app:3000" }]
From TraefikguideRules carry over; routers and services map one to one.From NGINXguideserver and location blocks to hosts, paths and middlewares.From CaddyplannedCaddyfile sites to routes, with the HTTPS caveats until v0.3.From Nginx Proxy ManagerplannedProxy hosts from the UI to one versioned YAML file.
What works today

Every feature says when it ships.

No page promises what the binary can't do. A setting that isn't implemented yet is refused at start with the version it's planned for.

ShippedNextPlanned
Traefik v3 rulesv0.1
Host, Path, PathPrefix, Headers, Query, Method and ClientIP, with the same priorities.
TLS with your certificatesv0.1
SNI, wildcards, a default certificate, encrypted keys; swapped on file change.
Fifteen middlewaresv0.1
Headers, redirects, rewrites, basic and forward auth, IP filters, rate limits, CORS, gzip, error pages, maintenance.
Smuggling defensesv0.1
Strict framing, size limits, header deadlines and fuzz-tested parsers.
Metrics and access logsv0.1
Prometheus /metrics and JSON access logs with request IDs.
Last-known-goodv0.1
Config history on disk; a broken file at boot falls back to the last one that worked.
Docker labelsv0.2
Opt-in per container, network selection, live on container events.
rdock migrate traefikv0.2
Turns Traefik labels into rdock.yaml and lists what does not carry over.
Automatic HTTPSv0.3
ACME HTTP-01, TLS-ALPN-01 and DNS-01, with ARI renewals.
Health checks and retriesv0.4
Active and passive checks, more balancing policies, retry budgets.
Dashboardv0.5
Built into the binary: routes, certificates, live logs and metrics.
Kubernetes Gateway APIv0.7
A Gateway API controller, checked with the upstream conformance tests.
Compare

Where ReverseDock fits.

CapabilityReverseDockTraefikCaddyNGINX
Written inRust (Pingora)GoGoC
LicenseApache-2.0MITApache-2.0BSD-2-Clause
Traefik rule syntaxYesYesNoNo
Docker labelsYesYesWith a pluginNo
Automatic HTTPSv0.3YesYesWith certbot
Reload without dropping requestsYesYesYesYes

The full matrix compares 171 capabilities across seven proxies, each with its source. Read the feature matrix

Install

Running in five minutes.

A 26 MB image or a single static binary for Linux on x86-64 and ARM64. Every release is signed and ships with an SBOM, so you can check what you run.

Quickstart with Docker Compose →Verify a download →
docker run -d --name rdock \
  -p 80:80 -p 443:443 \
  -v "$PWD/config:/etc/rdock:ro" \
  -v rdock-data:/var/lib/rdock \
  ghcr.io/docker-hunterpedia/rdock:0.2.0-alpha.1
Mount the folder holding rdock.yaml, and a volume for state.
Free foreverApache-2.0 with a DCO. No open core, no enterprise edition, no account.
Signed releasesKeyless cosign signatures, an SPDX SBOM and build provenance for every archive and image.
Fuzzed parsersDifferential HTTP/1 framing, the rule parser and the config loader run under cargo-fuzz every week.
No telemetryThe binary never phones home. The admin API listens on localhost unless you say otherwise.

Read the docs, then put it in front of something real.

Guides for every middleware, a configuration reference generated from the schema, and troubleshooting by symptom.

Get startedStar on GitHub