ContainerDesk vs Foredeck

ContainerDesk is the native cockpit to manage your Docker containers and Kubernetes clusters remotely, from your Mac, iPad and iPhone. No Docker daemon exposed to the network, no agent to install: ContainerDesk talks to the Docker API and kubectl through a secure SSH connection. Your servers stay closed; you stay in control. DOCKER • All your containers, grouped by Docker Compose project • Real-time stats (CPU, RAM) and streaming logs with search • Start, stop, restart, remove, with confirmation • Interactive terminal and exec inside a container • File browser (download and upload) • Images (pull, remove, prune), volumes and networks • Create containers and deploy a local container to a remote server KUBERNETES • Pods by namespace, deployments, services, ingress • Logs, console and terminal inside a pod • Scale, rollout restart, edit ConfigMaps and Secrets • Guided Deployment creation • Cluster overview: top consumers A REAL TERMINAL A true interactive (PTY) terminal on your hosts and straight inside your containers and pods: autocomplete, colors, history. SECURITY FIRST • Everything goes through SSH, never an open Docker port • Human approval before every destructive action • Host keys verified (TOFU) with an alert on change • Secrets stored in the Keychain, never in the clear • Local audit log • Zero telemetry: your data never leaves your devices FROM MAC TO PHONE One native app on macOS, iPadOS and iOS. Organize servers with favorites and folders; with iCloud (Pro), they sync across your devices. PRO Unlock unlimited servers, Kubernetes, the MCP server (for AI agents), iCloud sync and deployment. One-time purchase, yours for life. Built for developers, sysadmins and homelab enthusiasts who want to manage Docker and Kubernetes cleanly, securely, from anywhere.

Foredeck is the first touch-native Kubernetes console for iPhone and iPad. Add a cluster from its kubeconfig and you get the view you would have on a laptop: what is running, what is wrong, and the actions your credential is allowed to take. The Deck A cluster opens as a map. Namespaces are hexagons packed edge to edge, each application a ring split by the health of its replicas, each pod a ring split by its containers. Tap to fly into a namespace, an application, a pod, a container; the panel beside it shows usage against requests and limits, recent events, and how traffic reaches the thing you are looking at — Ingress, Gateway, HTTPRoute or VirtualService, through the Service and its endpoints, down to the pods. The same map can be grouped by node instead of by namespace. The Overview Every resource type the cluster serves, as lists: workloads, network, configuration, storage, RBAC, cluster resources, and your own custom resources. A CRD gets the same lists, details, YAML and health treatment as a Pod, because health is read from the conditions every controller publishes. Watch live Foredeck lists once and then watches, applying changes as the API server sends them. Logs stream and follow, from one container or from every replica of a workload at once, with the previous instance readable after a crash. Detailed statuese CrashLoopBackOff, ImagePullBackOff, Init:0/2, Pending because nothing can schedule it — the container-level reason, not just "Running". Work with the cluster - touch native Scale, restart, roll out, cordon, evict, delete, edit YAML with syntax highlighting and search, tune requests and limits with sliders, deploy from a template. Each one appears only after the cluster confirms your credential may do it, and any cluster can be marked read-only. Convenient best practices at your fingertips One pass over a namespace checks the things that cause incidents: missing probes, absent resource requests, a single replica behind a Service, images pinned to latest, Pod Security Admission left unset — and sets the enforce, audit and warn levels for you, with the consequences spelled out before anything is applied. New yet so familiar Go to (Command-K on a keyboard) finds a namespace, an application, a pod, a resource type or an object by name, and understands the shorthands your fingers already know: ns, deploy, sts, svc, ing, cj. Storing locally Cluster addresses and preferences live in the app's own storage; tokens, passwords and client certificate keys live in the iOS Keychain, marked to stay on the device. Foredeck talks only to the clusters you add. Demo cluster Built in No cluster to hand? One runs on the device, with a few things going wrong in it, so you can see the whole app before connecting anything. Note on kubeconfig Credentials must be self-contained. A kubeconfig written by "aws eks update-kubeconfig" or by gcloud carries a command to fetch a token rather than a token, and iOS cannot run one; client certificates and bearer tokens work everywhere. Foredeck says so at import and shows the commands that produce a usable credential for EKS, GKE, AKS, DigitalOcean, Yandex Cloud and hand-built clusters. The cluster also has to be reachable from the phone — connect your VPN first. Kubernetes is a registered trademark of The Linux Foundation. Foredeck is an independent client, not affiliated with, endorsed by or sponsored by The Linux Foundation or the Kubernetes project.