Open-source alternatives to Caddy Docker Proxy

Pomerium is an identity-aware reverse proxy designed to provide zero-trust access control for internal infrastructure. It functions as a centralized gateway that verifies user identity, device context, and group membership for every request before granting access to protected applications, services, or API servers. By integrating directly with external identity providers, it replaces traditional VPNs with granular, policy-based access enforcement. The platform distinguishes itself by extending zero-trust principles beyond standard web traffic to include non-HTTP protocols, such as TCP and UDP

docker-gen is a general-purpose configuration generator that produces configuration files by applying Go templates to live Docker container metadata. It generates dynamic configuration for reverse proxies, log forwarding, log rotation, and other service files based on real-time container state. The tool watches Docker container lifecycle events—such as start, stop, and die—and automatically re-renders templates each time a change occurs. It supports multiple template jobs defined in a configuration file, executing them sequentially, and can send Unix signals or run commands after regeneration

This project is a public key infrastructure management system designed to automate the issuance, renewal, and revocation of X.509, TLS, and SSH certificates. It functions as a machine identity provider and certificate authority, enabling the establishment of private PKI to secure inter-service communication and remote access. The system distinguishes itself through hardware-bound identity attestation, which ties cryptographic keys to physical device silicon or TPMs to prevent credential exfiltration. It supports a wide array of identity verification mechanisms, including OIDC, cloud-provider

This project is a Kubernetes ingress controller that manages external traffic by dynamically configuring the HAProxy load balancer. It functions as a bridge between cluster resources and the network data plane, translating high-level ingress definitions into active proxy configurations to route HTTP, TCP, and UDP traffic into containerized environments. The controller distinguishes itself through a decoupled architecture that separates control plane logic from the proxy process, allowing for independent lifecycle management and versioning. It utilizes template-based configuration generation a

Maddy is a modular mail server that assembles a complete email system by connecting small, single-purpose modules through a declarative configuration file. Rather than a monolithic stack, it lets operators compose message processing, storage, authentication, and security enforcement from interchangeable building blocks, with each module handling a specific function like receiving SMTP connections, verifying credentials, or applying policy checks. The server distinguishes itself through its flexible authentication and security architecture. It delegates user verification to external systems in

Tye is a local development orchestrator and distributed application manager designed for .NET microservices. It coordinates the startup and communication of multiple services, including frontends, backends, and databases, allowing them to run as isolated containers on a local host with a single command. The tool distinguishes itself by automating service discovery and network address resolution, removing the need for hardcoded URLs between services. It also handles the transition from local development to production by containerizing applications and generating the manifests required for Kube

This project is a Kubernetes deployment guide and infrastructure provisioner designed for hobbyist and home lab environments. It provides a framework for setting up multi-node clusters across various cloud providers and physical or virtual nodes, acting as a self-hosted cluster orchestrator. The project focuses on security hardening and infrastructure stability through specific implementation guides. This includes a framework for network security that covers host firewalls and encrypted network overlays, as well as detailed instructions for configuring ingress routing to manage external publi

This project is a Kubernetes Ingress Controller that functions as a layer 7 traffic router and NGINX reverse proxy. It serves as a secure network gateway, directing external HTTP and HTTPS traffic to backend services within a cluster based on declarative routing rules. The controller acts as a TLS termination gateway to secure traffic and integrates with Prometheus to expose request metrics and latency data for cluster monitoring. It supports canary deployment workflows by implementing weight-based traffic splitting between different versions of a service. The system manages external access

Unregistry is a decentralized container cluster orchestrator and Docker Compose manager. It allows for the deployment and scaling of containerized services across multiple remote hosts without the need for a centralized control plane. The project distinguishes itself by providing a registry-less deployment model, using SSH to transfer container image layers directly to remote servers. This capability enables deployments to air-gapped or private networks by bypassing external image registries entirely. The system covers a broad range of operational capabilities, including overlay mesh network

Ocelot is a .NET API gateway that functions as an HTTP reverse proxy to route, balance, and secure traffic between clients and backend services. It serves as a centralized manager for incoming requests, providing a single entry point for traffic orchestration. The project differentiates itself through dynamic request orchestration, allowing it to aggregate multiple backend service responses into a single result to minimize client network round trips. It also supports dynamic gateway configuration, enabling updates to system behavior and operational parameters without requiring a service resta

Uncloud is a decentralized container orchestrator designed to deploy and manage applications across multiple servers without a central control plane. It functions as a peer-to-peer system and a Docker Compose cluster deployer, using SSH-based infrastructure management to coordinate operations across remote nodes. The project distinguishes itself by using a secure mesh network overlay to enable direct inter-container communication across different physical machines. It facilitates container image distribution by transferring missing layers directly from local environments to target nodes, bypa

docker-gen is a configuration generator that renders text templates into files using metadata retrieved from Docker containers. It functions as a service discovery tool and template-based orchestrator, mapping container state and environment variables to specific destination paths on a host machine's local storage. The tool automates the update of reverse proxy and service discovery settings in real time as containers are started, stopped, or renamed. It employs sequential template processing and helper functions to filter and sort container data, ensuring stable and consistent configuration

Emissary is a Kubernetes API gateway that manages incoming external traffic and routes it to internal microservices. It utilizes an Envoy proxy as the underlying data plane to handle high-performance traffic routing and protocol translation, with a control plane that translates Kubernetes custom resources and annotations into proxy configurations. The project provides specialized support for gRPC infrastructure, including HTTP/2 routing and gRPC-Web protocol bridging for browser-based clients. It enables zero-trust security through mutual TLS encryption and delegates identity verification to

Higress is an AI API gateway and cloud-native traffic manager that functions as a Kubernetes ingress controller. It provides a centralized system for routing, securing, and optimizing traffic directed toward large language models, AI agents, and microservice architectures. The project distinguishes itself through deep AI orchestration, including the ability to host and manage Model Context Protocol servers that transform REST APIs into tools for AI agents. It features specialized AI infrastructure for model request proxying, protocol translation across multiple providers, and semantic-based c

Contour is a Kubernetes ingress controller that manages external HTTP and TCP traffic by orchestrating Envoy proxy instances. It functions as a control plane that translates declarative Kubernetes API objects into dynamic proxy configurations, enabling real-time traffic management without requiring infrastructure restarts. The system distinguishes itself through a focus on multi-tenant cluster networking and delegated configuration. By allowing routing rules to be partitioned across namespaces, it enables multiple teams to securely manage their own traffic policies within a shared cluster. It

Traefik is a cloud-native edge router and API gateway designed to manage service communication and traffic flow across distributed infrastructure. It functions as a dynamic service proxy that automatically discovers backend services and configures routing rules in real time, eliminating the need for manual restarts or complex configuration updates. By integrating directly with container orchestrators and service registries, it maintains a consistent state for network traffic, load balancing, and security policy enforcement. The project distinguishes itself through its deep integration with di

This project is an automated SSL certificate manager and orchestrator for Nginx proxy configurations. It functions as an ACME protocol client that handles the request, issuance, and renewal of security certificates for web services running in containers. The system monitors Docker container lifecycle events to automatically provision certificates based on assigned hostnames. It automates the full certificate lifecycle, including domain ownership validation and the issuance of specialized wildcard or multi-domain certificates. The tool manages security through both HTTP and DNS challenge reso

brpc is a high-performance C++ RPC framework and network programming library designed for building distributed systems. It functions as a multi-protocol RPC server capable of hosting and detecting multiple communication protocols, including gRPC, Thrift, HTTP, Redis, and Memcached, on a single TCP port. The project distinguishes itself through high-throughput data transport and memory efficiency, utilizing RDMA-based transport to bypass the kernel TCP stack and zero-copy memory management to eliminate data duplication. It also implements the Raft algorithm for consensus-based state replicatio

This project is an API gateway and ingress controller designed to manage traffic, security, and service connectivity within Kubernetes environments. It operates as a controller that monitors cluster state to reconcile gateway configurations with desired infrastructure definitions, ensuring that network policies and routing rules remain consistent across distributed deployments. The system distinguishes itself through a modular request pipeline that allows for the injection of custom logic to handle transformations, security checks, and logging. It supports declarative infrastructure managemen

Quip Node Manager is a graphical user interface designed for deploying, monitoring, and configuring Quip Network nodes and their associated container stacks. It serves as a container orchestration dashboard that allows users to manage interconnected application services without using command-line tools. The project features a hardware acceleration manager for mapping specific CPU and GPU compute resources to the runtime environment and managing device memory. It includes a system readiness validator to verify container tool availability and network port reachability before initiating the appl

Octelium is a zero-trust network access platform and identity-aware proxy designed to secure private HTTP, SSH, and SQL resources. It functions as a secure gateway that validates human and workload identities using OIDC, SAML, and FIDO2 passkeys before granting access to internal applications and SaaS APIs. The system is distinguished by its secretless access broker, which injects credentials—such as API keys, passwords, and AWS Sigv4 signatures—at the gateway level so users can access databases and cloud resources without managing secrets. It further specializes in AI gateway administration,

Higress is an AI-native and cloud-native API gateway that routes, secures, and optimizes traffic between clients and large language model services. It functions as a centralized entry point for microservices, serving as both a Kubernetes ingress controller and an AI gateway orchestrator. The project distinguishes itself by managing traffic across multiple AI providers using a unified protocol, incorporating token-aware rate limiting and response caching to optimize model inference. It coordinates communication between AI models and external tools to provide real-time context and data, while a

Stalwart is a self-hosted email and collaboration infrastructure that provides an integrated mail server supporting SMTP, IMAP, POP3, and JMAP protocols. It functions as a comprehensive communication hub, combining email hosting with a collaboration server for shared calendars, contacts, and files. The system distinguishes itself through a distributed architecture that uses peer-to-peer cluster coordination to ensure high availability and fault tolerance. It features a built-in security suite that implements an S/MIME and OpenPGP email gateway alongside automated TLS certificate provisioning

BunkerWeb is a containerized suite of infrastructure tools that functions as a cloud-native web application firewall and Nginx reverse proxy. It provides a security layer for web applications, combining traffic routing with automated SSL certificate management and a web-based security dashboard for monitoring and configuration. The project distinguishes itself through its deep integration with container orchestrators, serving as a Kubernetes ingress controller that automates security settings and service discovery via container labels. It features a plugin-based extension model and a manageme

ExternalDNS is a controller that automatically synchronizes Kubernetes resource states with external DNS providers. It monitors cluster resources such as services, ingresses, and gateway APIs to dynamically create and update DNS records, enabling automated service discovery and external traffic management. The project features a provider-agnostic interface that supports a wide array of cloud-managed vendors and on-premises providers, as well as an extension system for custom providers via webhooks and sidecars. It implements a reconciliation loop that uses resource annotations and custom reso

Lemmy is a self-hosted, federated discussion platform that enables the operation of independent, decentralized social networking servers. By implementing the ActivityPub protocol, it allows autonomous instances to exchange content, synchronize user interactions, and participate in a global, distributed network without centralized control. The platform distinguishes itself through a decoupled architecture that separates the backend API from the frontend, facilitating the development of custom interfaces while maintaining unified user handles and cross-platform communication. It provides granul

Tower is a modular service abstraction layer for the Rust programming language, providing a framework for building asynchronous request-response pipelines. It serves as a set of core components for managing backpressure, balancing loads, and abstracting service discovery. The project distinguishes itself through a layer-based middleware composition model, allowing services to be wrapped in recursive chains of decorators. This enables the declarative application of cross-cutting concerns, such as timeouts, rate limiting, and retries, in a protocol-agnostic manner. The library covers a broad r