The Problem

Running Docker containers across multiple machines usually means juggling SSH sessions, raw CLI commands, and per-host configuration. Arcane replaces that with a web dashboard and API that manage containers, images, volumes, and projects across a fleet of Docker hosts, including role-based access control and activity logging.

What This Does

Arcane is a self-hosted Docker management platform. The backend/ (Go) exposes a REST API and WebSocket endpoints for real-time container logs and stats. The frontend/ (Svelte + TypeScript) is the browser UI. A cli/ (Go) binary handles upgrades and tunnel management, and email-templates/ provides transactional emails.

The repo is five self-contained projects, not a single codebase: backend/ (671 Go files), frontend/ (293 code files), cli/ (67 Go files), types/ (62 files), and email-templates/. Each has its own dependencies and lifecycle.

How It Is Wired

Execution starts at main in backend/cmd/main.go:11, which reaches only 3 functions but leads to Bootstrap in backend/internal/bootstrap/bootstrap.go:33, a 61-function reach. From there, the API layer in backend/api/handlers/ registers routes. The shortest path to an external effect is Bootstrap -> Load, which writes files via os.WriteFile in two hops.

The registration pattern is centralized: RegisterSwarm and RegisterVolumes each call RegisterWithPermission 51 and 23 times respectively, with defaultOperationSecurityInternal on every call. RegisterContainers and RegisterProjects follow the same pattern. The backend/internal/common/errors.go file is the widest blast radius—48 files depend on its Classify function, so changes there ripple across the entire backend.

The WebSocket layer in backend/api/ws/handler.go owns the real-time paths: ContainerExec reaches 42 functions, streamContainerLogsInternal reaches 36, and SystemStats reaches 23. File I/O is spread across 330 functions; 19 touch the database, 43 do crypto/secret work, and 10 make outbound network calls. The frontend/src/lib/services/api-service.ts is the frontend hub—37 modules import it, making it the highest-churn file in the UI.

How To Use It

The repo includes docker/Dockerfile and docker/Dockerfile-agent, so container builds are the primary deployment path. Development setup uses .devcontainer/ and a Justfile for task automation.

git clone https://github.com/moses-y/arcane
cd arcane
# Backend
cd backend && go build ./cmd/ && ./arcane
# Frontend
cd frontend && npm install && npm run dev

Configuration lives in .env.example at the root—copy it to .env and set database credentials, API keys, and host connection details. The cli/main.go handles upgrades and tunnel operations. The README points to the official docs at getarcane.app for full setup; the repo itself lacks a quick-start guide.

Real-World Use

A team running Docker on three VPS instances can deploy Arcane as a container on one host, register the other two as agents, and manage all containers, volumes, and images from a single dashboard. The RBAC system in backend/internal/middleware/auth_middleware.go lets an admin grant read-only access to a developer for one host while keeping deploy rights for the rest.

Code Health & Issues

Static analysis found 331 findings (113 high, 217 medium, 1 low) across three kinds. The api-service.ts hub module is a high-severity clarity risk—37 modules depend on it. Deep nesting (58 instances) is the dominant cognitive-load issue, worst in api-service.ts, base-template.tsx, and role-scope-selects.svelte. The tests/utils/fetch.util.ts has 55 branch points over 147 lines.

The audit also found:

  • High – GitHub Actions pinned to tags, not commit SHAs (.github/workflows/), a known secret-leak vector
  • High – go-git@5.19.1 and docker/docker@28.5.2 carry published CVEs; upgrade and commit the lockfile
  • Medium – Devcontainer base image not pinned by digest; no dependency vulnerability scan in CI; persist-credentials not disabled on checkout; a preinstall script in package.json runs install scripts in CI
  • Low – Three workflows lack timeout-minutes

Tests and CI are present, no secrets are committed, and the license is BSD-3-Clause.

The Bottom Line

Arcane is a serious, well-structured Docker management platform with real engineering depth—the registration patterns and service layer are consistent and testable. The main risks are supply-chain: unpinned actions and vulnerable dependencies need attention before production use. Teams already comfortable with Portainer or Dockge should evaluate this for its RBAC and multi-host support, but the setup documentation is thin.