Arcane vs Dockhand: Which Docker Manager Should You Choose?

Managing Docker containers doesn’t have to mean Portainer. For years, Portainer was the only serious web UI for Docker, and it worked fine until the licensing changes started pushing people toward paid tiers for basic features. That opened the door for alternatives, and two of them have been getting real attention: Arcane and Dockhand.

I deployed both on the same VPS running a mix of compose stacks, and I still run Arcane on my own servers. This comparison comes from actually using them, not from reading feature lists. Both are solid, but they target different users and make different trade-offs that matter.

This article was re-checked on 2026-09-23. The earlier version claimed Arcane had no vulnerability scanning and no auto-updates. Both are wrong now: Arcane shipped Trivy scanning in v2.12.0 and tag-based container updates in v2.11.0. The gap that used to decide this comparison has narrowed, so the sections below were reworked.

Quick comparison

Architecture

These two took very different paths under the hood.

My take on architecture

Here’s what each UI looks like in practice:

Arcane’s Go backend feels snappier for basic container operations. Page loads are fast, API responses come back quickly. Dockhand’s Bun-based stack is no slouch either, but you can feel the difference when clicking through lots of containers. It’s marginal, though. Both are faster than Portainer.

Licensing

This is where you really need to pay attention.

For most self-hosters, both licenses work fine. You’re running it on your own hardware for your own use. The BSL restriction on Dockhand only kicks in if you try to resell it as a service.

But if you’re building something on top of a Docker management UI, or you want to embed it in a product, Arcane gives you more freedom.

Features: where each one wins

Container and compose management

Both handle the basics well. You can start, stop, restart, and remove containers. You can view logs, inspect settings, and manage networks and volumes. Compose stack management works in both. You can deploy, update, and edit compose files from the web UI.

Security features

This used to be the easy part of the comparison: Dockhand had scanning, Arcane didn’t. Not anymore. Arcane v2.12.0 added Trivy scanning in the UI with per-image CVE counts, a “Fix available” filter, and CSV export, and v2.10.0 added Copacetic image patching for OS-level CVEs. Both tools scan now.

What still separates them:

One more thing worth saying: these UIs are themselves attack surface. Dockhand v1.0.45 shipped as an “important security upgrade” with API hardenings, which is a reminder that whichever you pick, you keep it updated. For a homelab, the security gap between these two is now small. For a small business running production workloads, Dockhand’s scan-before-swap and secrets integration are still worth the trade-off of a more restrictive license.

GitOps and automation

Multi-environment management

Both let you manage containers on remote hosts, but the mechanisms differ.

Arcane uses arcane-agent, a lightweight binary you install on a remote machine. It connects back to your main instance over an mTLS edge tunnel and can upgrade itself. If you followed my older guides, this is what used to be called arcane-headless.

Dockhand uses Hawser, which has a trick up its sleeve: NAT traversal. If your remote machine is behind a firewall or NAT, Hawser can still connect without opening ports. That’s genuinely useful for managing machines in different networks.

Maturity and stability

The maturity story is different than it was in February.

Two things stand out. First, the current Arcane repo is younger than people assume (the pre-rename history under ofkm/arcane is unconfirmed, so I’m counting from the repo that exists today), but it has shipped over a hundred releases since April 2025. Second, Dockhand went from 3 releases to 35 and from 7 to 35 contributors in seven months, roughly a release a week. Both projects move fast; Arcane has just had more runway.

Pricing

Arcane is free. No tiers, no paid features, no “community edition” with missing parts. BSD-3-Clause means you get everything.

Dockhand has a tiered model:

The free tier is genuinely usable and wider than it used to be. OIDC/SSO, MFA, vulnerability scanning, restic backups, and the secrets-manager integrations are all included at $0, which is better than what Portainer offers. But if you need RBAC or LDAP, you’re paying enterprise prices.

Community and support

Arcane has the bigger community, but the gap is smaller than it was. Eighty-four contributors versus thirty-five, 7.5k stars versus 6.3k. Both repos were pushed to the day I checked.

Dockhand has picked up an ecosystem on its own: there’s a community MCP server that exposes 130+ API endpoints, a Home Assistant integration, and an iOS client, none of them official. When third parties start building against your API, that’s a good sign.

Both have active Discord/GitHub channels. Response times have been reasonable from both teams in my experience.

Installation

Both are Docker-based installs, which is appropriate for Docker management tools. I’ve written full install guides for both: install Arcane and install Dockhand.

services:
  arcane:
    image: ghcr.io/getarcaneapp/manager:latest
    container_name: arcane
    ports:
      - "3552:3552"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - arcane-data:/app/data
      - /opt/docker:/opt/docker
    environment:
      - APP_URL=http://localhost:3552
      - PUID=1000
      - PGID=1000
      - ENCRYPTION_KEY=your-32-byte-encryption-key
    restart: unless-stopped
volumes:
  arcane-data:

openssl rand -hex 32

services:
  dockhand:
    image: fnsys/dockhand:v1.0.48
    ports:
      - "3000:3000"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - dockhand_data:/app/data
    environment:
      - SECRET_KEY=change-this-to-something-random
volumes:
  dockhand_data:

Both require access to the Docker socket, which is standard for these tools. If that makes you uncomfortable, the better answer than a raw socket mount is a socket proxy in front of it. My Arcane install guide shows the tecnativa/docker-socket-proxy setup, and the same pattern applies to Dockhand or anything else that manages Docker.

Who should pick which

My honest take

The honest answer changed since February. Back then Dockhand’s security tooling was the reason to pick it, because Arcane didn’t scan at all. Now Arcane scans, patches with Copacetic, backs up to S3, and updates containers on tags, all while staying BSD-3-Clause and shipping a release roughly every week.

So: Arcane is still my default, and it’s what runs on my own servers. The case for Dockhand narrowed to the things Arcane doesn’t do: scan-before-swap rollbacks, LDAP (paid), external secret managers, and the restic backup setup. If any of those are hard requirements, Dockhand earns its license terms. If they’re not, Arcane is the easier recommendation.

And if you’re still shopping, the full Portainer alternatives comparison covers Sencho, Dockge, Komodo, and the rest of the field.

Related articles

• Best Portainer alternatives in 2026 - the full Docker management UI comparison
• Install Arcane - full Arcane setup guide with socket proxy and OIDC
• Install Dockhand - full Dockhand setup guide with vulnerability scanning and Hawser
• Install Dockge - another Docker management UI worth trying
• Best Docker containers for home server - what to run once you’ve picked a manager
• Best self-hosted panels - server management panels compared
• Podman vs Docker - the container engine comparison
• Docker auto-update with Tugtainer - keep containers updated automatically
• Server monitoring tools - monitoring your Docker host