Reverse proxy plus a small home-lab control plane
GoDoxy starts with the familiar job of putting friendly HTTPS names in front of self-hosted applications. It watches Docker and Podman, reads container names, exposed ports, and labels, then creates or updates routes without a manual proxy entry. A proxy.aliases label supplies the subdomain; otherwise the Compose container name becomes the default. Route files cover services that discovery cannot describe.
The project goes further than an ordinary proxy. Its web interface manages routes, configuration, containers, logs, metrics, and uptime. It can forward raw TCP and UDP ports, apply HTTP middleware, use OpenID Connect or an external ForwardAuth service, filter clients by address or country, and request certificates through DNS-01 providers. Idle sleeping stops quiet Docker containers and Proxmox LXC guests, then wakes them when a request arrives.
That combination is genuinely useful in a home lab where memory and power matter. A rarely opened dashboard does not need to run all week, and proxy traffic is a natural wake signal. It also couples ingress to workload control. A compromised GoDoxy administrator or dangerous route configuration can affect both traffic and container state, so this is a trusted infrastructure service, not a cosmetic dashboard.
A sensible Compose baseline
The quickstart asks for wildcard A and, optionally, AAAA records pointing at the proxy host. GoDoxy is designed for host network mode, with listener ports controlled through its environment file. A setup script downloads the Compose and configuration files, after which docker compose up -d launches the stack. Inspect a network-fetched shell script before running it, particularly when it configures a host-level proxy. The manual download path is only a few commands longer.
The example Compose design deserves credit. GoDoxy runs as UID and GID 1000 by default, enables no-new-privileges, drops all Linux capabilities, and adds back only permission to bind privileged ports. It does not mount the Docker socket directly into the main application. A separate socket-proxy container exposes an allowed subset: container listing, events, information, and start, stop, or restart operations. That reduces exposure compared with handing the UI unrestricted Docker API access.
Reduced does not mean harmless. The socket proxy still mounts the root-controlled Docker socket and permits state-changing requests because idle sleep and UI controls require them. Pin its image rather than following latest, bind its port only to loopback as the example does, and prevent other workloads from reaching it. Persist and back up configuration, data, logs, and certificates with restrictive permissions.
Automatic routing needs disciplined labels
Discovery is convenient because a newly started container can become reachable immediately. It is risky for the same reason. Decide which Docker providers use explicit-only mode, where a provider name ending in ! requires deliberate route labels, instead of publishing any container with an inferable port. Treat labels as ingress configuration under code review. Avoid exposing databases, admin ports, metrics, or development servers simply because Docker advertises them.
Multi-node discovery supports remote Docker endpoints and a GoDoxy agent. Issue 233 reports severe behavior with many remote Docker providers over mTLS on v0.29.0 and v0.29.1: synchronized unexpected EOF errors, routes disappearing, CPU rising above 100 percent, and restart being required. The reporter says agent-based providers did not show the same problem. This is a detailed open report against older versions, not a finding reproduced here. Operators should soak-test v0.30.2 with their provider count and interrupt event streams deliberately before trusting it.
HTTPS, identity, and traffic limits
GoDoxy can use an existing certificate or obtain certificates through Cloudflare and other DNS-01 providers. DNS credentials can change records for a domain, so scope tokens narrowly and keep them outside route files. Automatic certificates make one instance pleasant; they do not make several replicas safe. Issue 35 asks for high availability with certificate coordination and remains open. Plan for one active proxy, backed-up certificates, and a tested replacement unless you bring an external certificate and your own failover design.
OIDC and ForwardAuth are important for applications lacking login screens. Confirm callback URLs, cookie scope, forwarded identity headers, and direct backend isolation. If clients can reach an application port without passing through GoDoxy, proxy authentication is optional from the attacker's perspective. Issue 243 notes that v0.30.2 supports per-route OIDC client credentials but only one global issuer URL, which does not fit Authentik deployments using a distinct issuer per application.
TCP and UDP forwarding do not inherit every HTTP feature. Issue 218 requests SNI-based proxying and TLS passthrough so several upstream HTTPS services can share port 443 while retaining their own certificates. The current reported workaround is not equivalent, because a raw TCP listener conflicts with the HTTP listener. Traefik is a better fit when HostSNI rules and end-to-end upstream TLS termination are requirements. Issue 201 separately requests PROXY protocol support for streams.
Project health and the right fit
GoDoxy had 3,998 stars and 11 open issues and pull requests when researched. GitHub did not identify the license automatically, but the repository's LICENSE file contains the MIT license plus notices for modified Go standard-library code. The latest release, v0.30.2, was published August 3, 2026, and the last push was August 5. Issue activity continued August 10. Releases, documentation, a live demo, and Discord indicate an actively maintained project.
The v0 version and open HA gaps still matter. Use GoDoxy for one home-lab or small-office ingress host, particularly when Docker discovery, Proxmox controls, and idle sleep solve real chores. Put the web UI behind strong authentication and a private network, monitor routes from outside, pin every image, and keep recovery files. Choose Caddy for a simpler proxy, Nginx Proxy Manager for manual GUI hosts, or Traefik for more established multi-provider routing and TCP features. GoDoxy's best quality is the useful integration of proxy and lab operations; its biggest risk is forgetting how much authority that integration holds.