StackPilot vs Portainer & Dockge¶
Modern homelabs and infrastructure teams frequently evaluate StackPilot, Portainer, and Dockge. While all three provide web interfaces for managing containers, their underlying systems architectures and security models differ fundamentally.
Architectural Comparison Matrix¶
| Architectural Dimension | StackPilot | Portainer | Dockge |
|---|---|---|---|
| Daemon Model | Daemonless (Native Linux Systemd) | Heavy Daemon (dockerd) |
Heavy Daemon (dockerd) |
| Security Boundary | Rootless User Namespaces (UID mapping) | Root Execution (Full root host access) | Root Execution (Full root host access) |
| Unit Compilation | Systemd Quadlets (.container, .pod) |
Docker Compose / Swarm definitions | Docker Compose YAML files |
| Resource Footprint | ~15MB (Python stdlib ZipApp, 0 pip deps) | ~100MB+ (Compiled Go binaries) | ~40MB+ (Node.js engine) |
| Multi-Host Topology | Native Agent-Hub with pinned TLS certs | Edge Agent (License tiers / commercial) | Single-host only (no multi-host agents) |
| Process Supervision | Linux Systemd (systemctl, cgroups v2) |
Portainer polling loop / Docker restart | Node.js child process monitoring |
| Self-Healing Mechanics | Systemd Timers (heals if Hub is down) | Docker restart policies | Docker restart policies |
| OS Log Integration | systemd-journald (Unified host logs) | Docker logging driver | Docker logging driver |
| Host System Controls | Non-root UFW inspection, reboot/shutdown | Root Docker socket mounts | Root Docker socket mounts |
Detailed Architectural Divergence¶
1. Rootless Podman vs Root Docker Socket¶
- The Docker Problem (Portainer & Dockge): Both tools require mounting
/var/run/docker.sockwith root privileges. Anyone with access to the Docker socket effectively owns root access to the entire host operating system. A vulnerability in the web dashboard or container allows instant root privilege escalation. - The StackPilot Solution: Containers run inside unprivileged user namespaces. User ID 0 inside the container maps to an unprivileged host UID (e.g. UID
100000+). If a containerized process breaks out of its runtime isolation, it has zero host privileges.
2. Native Systemd Quadlets vs Third-Party Supervision¶
- Traditional Model: Container restart managers run inside the container engine daemon. If the daemon crashes or fails to boot, containers fail silently.
- Quadlet Model: StackPilot compiles declarative
.containerand.podfiles into native systemd service units. Systemd treats containers identically to native Linux services (nginx,sshd), guaranteeing cgroups resource budgeting, dependency ordering (After=network-online.target), and automatic restarts on kernel boot.
3. Footprint & Operational Simplicity¶
- Portainer: Requires deploying heavyweight Go agent containers and maintaining an internal database.
- Dockge: Ideal for a single machine with Docker Compose, but lacks remote host management and multi-node enrollment.
- StackPilot: Distributes a zero-dependency Python 3 ZipApp (
stackpilot_agent.pyz) using only standard library modules. Nodes can be enrolled with a single curl command, consuming negligible RAM and CPU.