Beta documentation

Quickstart

  1. On a device with Docker Engine 24+ and Compose v2: 
    curl -fsSL https://simpledockerops.com/install | sudo sh
  2. The agent prints a pairing code and a QR code. In the portal choose Devices → Add device, enter the code, name the device, pick a fleet.
  3. Applications → New: paste your docker-compose.yml, declare variables, save.
  4. Releases → Cut release: choose a version. Images resolve to digests; the preflight lists platforms.
  5. Deploy to the device or fleet. Watch it go healthy.

Applications and releases

An application is a reusable Compose workload. A release is an immutable snapshot of it: the Compose text, every image pinned to an OCI digest, the platforms each image provides, and the default configuration. Releases never change; you cut a new one.

  • Variables in ${VAR} form become release configuration with defaults per application, overrides per fleet and per device.
  • Values marked secret are stored encrypted and never shown again.
  • Preflight blocks a release from deploying to a device whose architecture the images do not provide.

Deployments

A deployment assigns a release to a device or fleet with a strategy:

strategy:
  waves: [10, 25, 100]      # percent of targets, cumulative
  max_parallel: 5
  min_healthy_seconds: 120  # per device before the wave counts
  fail_threshold_percent: 10
  on_failure: pause         # or rollback
  deadline_minutes: 240     # offline devices past this are reported, not failed

Health is evaluated on the device: every service running, services with a healthcheck reporting healthy, plus optional HTTP or TCP probes defined on the application. Rollback re-deploys the previous release with a single 100 percent wave.

Secrets and registries

  • Secrets are scoped to organisation, fleet, device, or application; the most specific wins.
  • External registries: Docker Hub, GHCR, and any OCI registry with username and token. Credentials are encrypted and used for digest resolution and device pulls.
  • The managed registry (private repositories per organisation, short-lived pull credentials, retention) is on the roadmap for the Phase 1 release.

API

Base URL https://app.simpledockerops.com/api/v1. Send Authorization: Bearer sdko_… with a key from Developers.

# Cut a release from CI, then deploy it to the test fleet
curl -X POST https://app.simpledockerops.com/api/v1/applications/APP_ID/releases \
  -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" \
  -d '{"version":"1.8.4","notes":"fix mqtt reconnect"}'

curl -X POST https://app.simpledockerops.com/api/v1/deployments \
  -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" \
  -d '{"release_id":"rel_…","target_type":"fleet","target_id":"flt_test",
       "strategy":{"waves":[100],"on_failure":"rollback"}}'

# Watch it
curl https://app.simpledockerops.com/api/v1/deployments/DEP_ID -H "Authorization: Bearer $KEY"

Security model

  • Each device gets a unique credential at pairing; revocable from the portal. No fleet-wide secrets.
  • Outbound TLS only. The agent opens no ports.
  • Docker socket access is root-equivalent: deployments are treated as privileged actions and every one is audited with who, what, where, when.
  • No remote shell in this release. Commands are limited to restart, logs, diagnostics, and prune.
  • Agent updates are signed and roll back automatically on failure.