The safe-by-architecture Docker Compose panel

Point Ember at a directory with your existing docker-compose.yml. It runs your stack verbatim and adds automatic TLS plus a small dashboard — nothing else changes. No stored cloud API keys, no admin surface exposed to the internet by default, and a restore command that's actually verified to work before you trust it.

Quick install Compare vs Coolify / CapRover / Dokku

Install

One line, or read the script first — both paths land on the same checksummed binary.

One-command install

curl -fsSL https://ember.x1.kumavolt.dev/install.sh | sh

Detects your architecture (linux/amd64 or linux/arm64), downloads the matching binary and its published SHA-256 checksum, verifies the checksum before placing anything, and installs to /usr/local/bin/ember. It never starts Ember, never opens a port, and never runs a hidden sudo — if the target directory isn't writable it prints the one privileged command it needs and runs exactly that.

Prefer to inspect first?

A tool that pitches "audit us, don't trust us" shouldn't force the pipe. Download, verify, then install — no script involved:

curl -LO https://ember.x1.kumavolt.dev/downloads/ember-linux-amd64
curl -LO https://ember.x1.kumavolt.dev/downloads/ember-linux-amd64.sha256
sha256sum -c ember-linux-amd64.sha256
sudo install -m 0755 ember-linux-amd64 /usr/local/bin/ember

Swap amd64 for arm64 on ARM servers.

Run it

ember up ./my-project        # runs docker-compose.yml verbatim, after a safety pre-flight check
ember serve --tls-domain panel.example.com   # dashboard + automatic TLS (needs an admin credential set first)

Requirements: a Linux server (amd64 or arm64) with the Docker Engine + compose plugin already installed. Ember drives the standard docker compose CLI — it doesn't bundle or replace it.

What it actually does

Deliberately small. It changes nothing about how your compose file runs.

Runs your compose file verbatim

Parses your existing docker-compose.yml with the same library docker compose v2 uses, then drives the real docker compose plugin via a fixed argument list — no shell, no rewriting, no build system bolted on.

Automatic TLS

Point a domain at your box and Ember obtains and renews a Let's Encrypt certificate in-process (no separate reverse proxy to run or configure).

A small dashboard

One page: pre-flight report, live service status, start/stop. Behind a login — never a bare, unauthenticated surface.

Backup that's actually verified

ember verify-restore restores your last backup into an isolated copy and boots it before you ever have to trust it for real.

Why "safe by architecture" isn't just a slogan

Every claim below is a specific, mechanical design decision, stated concretely rather than as a vague assurance.

Zero credential custody. Ember never asks for a cloud provider API key, a registry token, or any third-party secret. There's nothing here for an attacker to steal because nothing is stored.
Bind-mount validation before anything runs. A pre-flight gate inspects your parsed compose file and blocks any bind mount whose host source is the Docker socket or a sensitive system path — the mechanical fix for the CVE-2025-59156 mount-escalation class, catchable only by inspecting the resolved model, not by scanning text.
No admin surface exposed by default. The dashboard binds to loopback only; a non-loopback bind is refused unless both TLS is enabled and an admin credential is set — never one without the other.
Argv-array exec, never a shell. Your compose file's values never get concatenated into a shell string; they're passed as a fixed argument vector to the real docker compose binary.
Destructive ops refused by default. ember down never removes volumes. Deleting a project's volume data requires the separate ember remove --confirm=<project-name> command, and it is refused unless you type the project's own name back — no bare checkbox, no single-click delete.
Atomic, reversible self-update. ember self-update checksum-verifies the latest binary over HTTPS, swaps it in with an atomic rename, smoke-tests that it runs (auto-rolling back if not), and keeps the previous binary for one-command --rollback — and it never touches a managed stack's compose file, .env, or volumes.

Honest status: all four safety mechanisms above are built and tested. Self-update rests on a SHA-256 fetched over TLS from the same origin as the binary (the same trust anchor as the curl | sh install); cryptographic signing is a planned later addition. And the biggest caveat on "audit us, don't trust us": Ember's source isn't public yet. Today you can verify the binary's checksum and watch what it does, but you can't read the code — so for now these safety properties are our design commitments, not something you can independently inspect line-by-line. Publishing the source is the next step.