Docker on a box, run from one place. Every screen of it.

Docker from docker.com — the distribution's docker.io lags a year and ships no compose plugin — with compose and buildx, enabled at boot. Before the first start Lens seeds daemon.json with log rotation and live-restore, so a box set up here never fills a disk with container logs and never drops its containers when the daemon restarts. The service and the docker group (offered, not assumed: it is root in all but name), and the daemon's keys that decide whether the box is still standing in six months, are read and set on one screen.

Docker publishes ports past ufw unless it is told not to: a container on port 3306 with a "closed" firewall is open to the internet, and most people find out the hard way. Lens writes the ufw-docker block into after.rules once, and from then on every published port is a ufw route rule — added and removed here, "to whom" asked first, the operator's own address never stripped. The second screen is the same box after: the ports Docker publishes, governed by ufw like everything else.

Ready compose files for a small developer: pick the app, answer the three things that matter, running. Every choice is a ${VAR} written into a mode-600 .env, so no password ever sits in the YAML; databases are bound to 127.0.0.1, admin passwords are generated, logs are rotated, and the note on the card says which ports face the world. A stack already on the box is a compose project like any other: pull-and-up, the update check, the effective config read back, the editor for the file itself.

Running first, then the trouble. A row opens to its details, its stats — Monitor's charts for one process tree, every number a rate between two samples — and its top. Logs follow live, with the lines in hand for Themis when something in them needs explaining. A shell into a container is a real terminal tab with docker exec typed in. The run form carries the long tail of docker run, one control a row; any container reads back into it, and Recreate steps the old one aside under a temporary name until the new one is up.

A container is disposable; its volume is not. Every volume on the box is listed with what uses it and what it weighs, and a volume opens to the three verbs that matter: back it up — to the box, to this computer, or to any repository described under Setup, encrypted to your key; restore it, into the same name or another; and browse the files inside it, right there, without starting a container to look. Images and networks sit beside them: pull, build and prune; new, attach, and what each network reaches.

A full disk is how most Docker boxes die: dangling images, stopped containers, build cache, logs nobody rotated. Lens shows what takes the room by kind and offers the cleanups one at a time, each saying afterwards what the disk looks like now — and a prune schedule the box runs on its own, so the same box does not fill up again in a month.