A container stack as a site
A Docker Compose site is a reverse-proxy site whose upstream is a container stack. The panel allocates a loopback port and hands it to your compose file as AURA_PORT, runs docker compose up in the foreground under a systemd unit it manages, and renders an nginx server block that proxies the domain to that port with a Let's Encrypt certificate. The compose file and a .env live in the site's directory, owned by the site's Linux user, and you edit them like any other file.
Nothing else changes: the same domain handling, certificates, redirects, basic authentication, logs, edge shield and backups apply to a Docker site as to every other site on the server.
Two ways to create one
Create returns quickly; the image pull runs in the background and the site shows the panel's placeholder until the stack is up. Then Up, Down, Restart, Pull and Recreate are one click each, and docker compose logs is on the Logs tab. Docker Compose sites →
- Single image. Give the image, the container port, environment variables as
KEY=valuelines and optionally a host port; the panel writes the compose file. Good for Ghost, Umami, Uptime Kuma, Gitea, n8n and any other application that ships as one image. - Compose file. Paste your own YAML for multi-service stacks: a web service with its database, cache and worker. The only requirement is that the web service publishes to
127.0.0.1:${AURA_PORT}:<container-port>.
Guardrails the panel enforces
All stacks share the host's Docker daemon, so the panel checks every compose file before it starts anything and refuses the settings that would let a container reach the host:
- Publishing a port on any address other than
127.0.0.1. privileged: true,network_mode: host,pid: host.- Capabilities that allow escape, and bind-mounting
/or the Docker socket. - A stack with no service publishing the proxy port.
- Administrators only
- Loopback publishing only
- Compose file validated before start
Alongside everything else
Most servers are not all containers. A typical auraPanel host runs a WordPress site, a Laravel application on PHP-FPM, a Node.js API as a systemd service and one or two container stacks, each on its own domain with its own certificate and its own Linux user, all in one list. When something ships as an image, run it as a Docker site; when it is a PHP, Node.js or Python codebase, run it natively and skip the container. Reverse-proxy sites cover services you run yourself outside the panel.
Data, backups and updates
Keep persistent data in a bind mount under the site's directory rather than a named volume: site backups archive the directory, and the restore wizard brings it back. Updating an application is Pull then Recreate. Deleting the site removes its containers, network, named volumes and images. Docker itself is installed by the panel's installer or later from the Services screen.
What this is not
- Not a container orchestrator or a Portainer replacement. The unit is a site with a domain; the panel does not expose arbitrary container management.
- Not per-site Docker isolation. Stacks share the daemon, which is why only administrators can create Docker sites.
- No CPU or memory quotas set by the panel; declare them in your compose file.
- No registry credential management;
docker loginon the host for private images. - The Databases tab and page cache are hidden for Docker sites; run the database inside the stack, or use a panel database from another site.
Frequently asked
Can a container talk to a MariaDB or PostgreSQL database managed by the panel?
Panel databases listen on the host's loopback interface. From a container that means the host gateway address rather than localhost, and the database user is granted access from 127.0.0.1 and localhost only, so in practice run the database inside the stack, or use a Docker site for the application and a PHP or Node.js site's database when both run natively.
Does the panel expose ports 80 and 443 to the container?
No. nginx owns 80 and 443 for every site on the server and proxies your domain to the container's loopback port; the container never binds a public port.
Which images work?
Any image that serves HTTP on a port you can map. The application inside must bind 0.0.0.0, not localhost, or nginx will get a 502.
Is Docker included in the licence?
Yes. Docker Compose sites are a site type like any other; one licence covers the server and everything on it. Pricing →