🐳 Virtualmin Docker

A clean, security-first Webmin & Virtualmin module for managing Docker from your browser

Containers · images · volumes · networks · Compose · backups · vulnerability scanning — with a live dashboard widget and Virtualmin reverse-proxy awareness.

⬇️ Download the latest module (`docker.wbm.gz`)

Current release: v1.5.2 · direct link · all releases

Why another Docker module? Because a panel that runs as root has no business pasting your input into a shell. Every Docker command in this module is built from constant flags plus individually escaped values — proven, not promised (see Security model). On top of that it's fast, responsive, and it knows which of your Virtualmin sites proxy to which container.

If you want a full standalone Docker UI, look at Portainer. This module is for people who already live in Webmin / Virtualmin and want Docker management that fits right in — under Servers → Docker.

✨ Highlights

🔒 Injection-proof by construction — no user input ever reaches /bin/sh unescaped.
🧭 One-glance dashboard — running/paused/stopped counts, disk usage, and a clickable home-screen widget.
🌐 Virtualmin-aware — see the domains/subdomains reverse-proxied to each container, right in the list.
🧰 Everything you actually do — full lifecycle, bulk actions, images, Compose, storage, backups, scanning.
👥 Granular access control — grant or deny each capability per Webmin user.
📝 Audited — every change is written to the Webmin Actions Log.
🧑‍🏫 Friendly to non-technical users — every risky button explains itself in plain words, and destructive actions show a red list of exactly what will be deleted before anything happens.
⬆️ Real updates — a dedicated Update action applies new versions from .env / docker-compose.yml (a restart alone never does).

📸 Screenshots

Dashboard & containers	Home-screen widget

🚀 Features

Dashboard

Running / paused / stopped / image counts
docker system df disk-usage breakdown
Clickable home-screen widget on the Webmin dashboard

Containers

List with live CPU / memory, ports, and proxied domains
Start · stop · restart · pause · unpause · kill
Remove · rename · update resources · clone
Bulk select-and-act on many at once
Per-container logs (timestamps, since, filter, auto-refresh, download), inspect, non-interactive exec with quick-command buttons, live stats

Images

List · inspect · history · remove · pull · push · tag
Build from an inline Dockerfile · run a new container
Docker Hub search · prune

Compose

One-click per-project actions — Update (pull & recreate), restart, stop, start, logs, status, down — using each project's own compose file (no path typing)
Projects show the Virtualmin domain they belong to
Advanced: run any action against a compose file by full path

Storage

Volumes & networks: list · inspect · create · remove · prune

Backup & restore

Images: save / load to a host tar
Containers: commit to an image · export the filesystem
Volumes: back up & restore a local volume as .tar.gz

Maintenance

system prune & builder prune with red deletion previews — see exactly which containers, volumes and images would be removed, tagged DATABASE and belongs to domain X, before you confirm

Security

Image scanning via Docker Scout or Trivy

Registry & contexts

Private-registry login · switch Docker context (rootless-friendly)

Monitoring

"Docker Up" & "Container Up" monitor types for System and Server Status

🌐 Virtualmin integration

Running Docker behind Virtualmin virtual servers? When a site has Website Proxy Settings → Proxying enabled pointing at a local port (e.g. http://localhost:3000), this module matches that port to the container publishing it and shows the domain right in the container list:

Name	Status	Image	Ports	Proxied to
`server-1`	🟢 Up (healthy)	`image/image`	`3000->3000/tcp`	example.com

It reads Virtualmin's domain definitions read-only, links each domain through to the live site, and degrades silently to nothing on non-Virtualmin hosts. Turn it off any time in Module Config.

And it can fix them. The Domains & Proxies page manages the write side: it flags any domain whose Website Proxy points at a port with no running container (a site that's down — e.g. after a container's port changed), and reconnects it to a running container in one click via the virtualmin modify-proxy / create-proxy CLI (which reloads the web server for you). The dashboard shows a red alert linking straight to the fix.

🔒 Security model

This is the whole reason the module exists.

Guarantee	How
No shell injection	Every value from a form, config, or Docker output is wrapped with a single-quote escaper (`sq()`); constant flags stay literal. Verified by round-tripping `$()`, backticks, `;`, `\|`, `&&`, newlines and `-v /:/host` through a real `/bin/sh`.
Allowlist validation	Container/image/volume/network identifiers are checked against anchored regexes before use — rejecting control characters, leading dashes and path traversal.
POST-only, referer-checked, audited	All mutations go through one dispatcher (`act.cgi`) reached only by POST, gated by ACL, and logged with `webmin_log`.
Secrets via stdin	Registry passwords are fed to `docker login --password-stdin` over the child's STDIN — never on argv, never via `echo`, never stored.
XSS-safe output	All Docker output (names, statuses, error text) is HTML-escaped before display.
Confirmations	Destructive actions (remove / prune / restore) ask first.

📦 Requirements

A host running Webmin (or Virtualmin)
The Docker engine + CLI (docker) available to the Webmin user
Perl JSON::PP (ships with Perl 5.14+)
Optional: docker compose (v2), and docker scout or trivy for scanning

⚙️ Installation

Option 1 — install straight from the URL (fastest). In Webmin go to Webmin Configuration → Webmin Modules, choose From ftp or http URL, paste this, and click Install Module:

https://github.com/MrZaKaRiA/Virtualmin-Docker/releases/latest/download/docker.wbm.gz

To pin an exact version instead, use the versioned URL:

https://github.com/MrZaKaRiA/Virtualmin-Docker/releases/download/v1.5.2/docker.wbm.gz

Option 2 — download, then upload.

Download docker.wbm.gz (latest).
In Webmin go to Webmin Configuration → Webmin Modules → From uploaded file, choose the package, and click Install Module.

Option 3 — from the shell:

wget https://github.com/MrZaKaRiA/Virtualmin-Docker/releases/latest/download/docker.wbm.gz
/usr/share/webmin/install-module.pl docker.wbm.gz

Then open it under Servers → Docker. The dashboard widget appears once the System and Server Status module is installed and enabled. Upgrading is the same procedure — your settings and per-user ACLs are preserved.

Build it yourself from a checkout:

tar -czf docker.wbm.gz docker     # top-level dir in the archive must be "docker"

🛠️ Configuration

Module Config (top-left cog) exposes:

Show live CPU/memory stats in the list
Show Virtualmin domains proxied to each container
Default number of log lines · show the dashboard widget
Confirm before destructive actions
Preferred image scanner (auto / Docker Scout / Trivy)
Default Compose file path · default backup directory · Docker context override

👥 Access control

Under Webmin Users → user → Docker, grant or deny each capability independently: view · manage · create · delete · exec · prune · backup · registry · context. The default grant is full access (you're the admin) — tighten it per-user as needed.

🧩 Rootless Docker

Supported via Docker contexts. Create a context for the rootless socket, then docker context use <name> or set the context override in the module's Contexts page.

🗂️ Module layout

File	Purpose
`docker-lib.pl`	Secure core: shell quoting, validation, every Docker operation, Virtualmin proxy lookup
`index.cgi`	Overview dashboard + container management
`container.cgi`	Per-container logs / inspect / exec / stats / manage / backup
`images · compose · storage · maintenance · security · registry · contexts .cgi`	Section pages
`act.cgi`	The single POST action dispatcher (ACL-gated, audited)
`update.cgi`	Plain-language "update this Compose project" page
`system_info.pl`	Home-screen dashboard widget
`status_monitor.pl`	Monitor types for System and Server Status
`acl_security.pl` · `defaultacl`	Per-user access control
`log_parser.pl` · `install_check.pl`	Audit-log rendering · Docker auto-detection

🤝 Contributing

Issues and pull requests are welcome. Every .cgi/.pl file is validated with perl -c in CI, and changes to command construction should keep the sq() + allowlist discipline described above.

📜 License

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License version 2 as published by the Free Software Foundation. It is distributed without any warranty — see the license for details.

_{Built for the Webmin & Virtualmin community. Not affiliated with Docker, Inc.}

Virtualmin Docker

Overview