Skip to content
Containly
EnglishDeutsch
Account Get started
On this page

Add hosts and endpoints

Connect more Docker hosts to Containly over TCP with TLS, over SSH or with the outbound agent, and how many hosts the free tier covers.

The local Docker host is connected from the start. A new installation calls it "Local Docker" and shows that name in your interface language until you rename it (from Containly 2.5.0). One Containly instance manages any number of further hosts: 2 hosts in total in the free tier (the local one plus one more), unlimited with Pro. In Containly, open Endpoints and choose Add endpoint; "Show instructions" opens the step-by-step guide for each way.

TCP with TLS

For a Docker daemon that listens on a TLS port (2376).

  1. On the target host, create a CA, a server and a client certificate once. The server-*.pem files stay on the host for the daemon; ca.pem, cert.pem and key.pem are the client files.
  2. Turn on TLS in /etc/docker/daemon.json. The systemd service already passes -H fd://: if hosts is in daemon.json as well, Docker does not start, so clear ExecStart with a drop-in first.
  3. Restrict the firewall so port 2376 is only reachable from your trusted network, then reload and restart Docker.
  4. In Containly enter the host (IP or domain), port 2376 and paste the three client files.

Never use port 2375 without TLS: it exposes the host unprotected.

SSH

For hosts you reach over SSH. The SSH user must be allowed to use Docker (member of the docker group, or root). Password or key authentication both work for the connection; stack deployments over SSH need key authentication, because the Docker CLI cannot connect with a password. An OpenSSH private key is recommended.

The agent (behind NAT, no open ports)

The agent is a small hardened container (containly-agent) that you start on the remote host. It dials out to Containly over WSS, so the host needs no open Docker port, no SSH access and no inbound firewall rule.

  1. Choose the agent when you add the endpoint. Containly shows a one-time token and a ready-to-paste docker run command and a docker-compose.yml. The token is shown once: copy it now.
  2. Run one of them on the remote host.
  3. Containly shows "Waiting for the agent to connect" until the agent is there. If it stays like that, check the agent logs on the target host.

After the first connection the agent reconnects on its own with a persistent credential. Logs, console, stats, files and Compose stacks all run over that one connection.

Stacks on remote hosts

On TCP and SSH hosts Containly manages Compose files through a small helper container over the plain Docker API, so nothing has to be installed by hand. Set the stack paths per host on its host page; Compose projects started outside Containly are found through their Compose labels.

The host limit

The free tier allows 2 endpoints, the local host included. A third host shows "Endpoint limit reached". With a Pro licence the limit is gone. Without a licence (or after a subscription ended), hosts above the limit stay connected but locked; you see their containers again with Pro.