Overview

WolfStack provides comprehensive container management for both Docker and LXC containers. Create, start, stop, restart, clone, and migrate containers across your entire fleet from a single dashboard.

Docker Containers

• View all running Docker containers with live CPU, memory, and network stats
• Start, stop, restart, and remove containers
• View real-time container logs
• Open a web terminal (shell) into any container
• Pull images and create containers from the App Store
• Manage Docker volumes and networks

LXC Containers

• Create system containers from downloadable templates
• Full lifecycle management: start, stop, freeze, unfreeze, destroy
• Clone containers locally or across nodes
• Migrate containers between servers in one click
• Edit container configuration directly
• Assign WolfNet IPs for cross-node communication
• Set CPU, memory, and disk resource limits
• Autostart containers on boot

Creating an LXC Container

Click the Create Container button on any node page. Choose a distribution template (Debian, Ubuntu, AlmaLinux, Alpine, etc.), set the container name, and optionally configure resources. WolfStack handles the rest.

Container Networking

Each container automatically gets a bridge IP on the lxcbr0 bridge. When WolfNet is enabled, containers also receive a WolfNet IP (10.10.10.x) for encrypted cross-node communication. The bridge IP matches the WolfNet last octet for easy identification.

LXC Container Features

WolfStack lets you toggle advanced LXC features from the container's Settings page. These are applied to the container configuration and take effect on the next start.

Feature	Description	Required By
TUN/TAP Device	Enables /dev/net/tun inside the container for VPN and tunnel support	WolfDisk, Tailscale, WireGuard, OpenVPN
FUSE	Enables /dev/fuse for user-space filesystems	WolfDisk, AppImage, sshfs, rclone mount
Nesting	Run LXC or Docker inside the container	Docker-in-LXC, nested containers
NFS	NFS server/client support inside the container	NFS shares
Keyctl	Kernel key management for systemd support	Some systemd services

Cloning & Migration

Clone creates a copy of a container on the same node. Migrate moves a container to a different node in the cluster — WolfStack handles the file transfer, IP reassignment, and route configuration automatically.

Card View

Every container and VM screen supports a card view as an alternative to the default table view. Toggle between the two layouts using the view switcher at the top of the page — your preference is saved per screen.

• SVG pie charts — Each card displays live CPU, RAM, and disk usage as small SVG pie charts for at-a-glance resource monitoring
• Responsive layout — 4 cards across on desktop, 2 on tablet, 1 on mobile
• Available everywhere — Card view works on Docker, LXC, and VM screens
• Per-screen preference — Switch the Docker screen to cards while keeping LXC as a table, or vice versa — each screen remembers its own setting

Additional Features

vSwitch VLAN networking

An LXC container’s network-interface editor can put the container straight onto a provider vSwitch (Hetzner vSwitch, OVH vRack, generic 802.1Q). Pick a vSwitch uplink NIC from the dropdown and enter the VLAN ID — WolfStack creates the tagged sub-interface and bridge if they don’t exist and attaches the container, with no separate Networking-page step. Each interface row also has a delete button, so a NIC can be removed and is dropped when you save. See Networking for the full vSwitch model.

VNC Desktop Access

One-click VNC into any running Docker, LXC, or Proxmox-LXC container. WolfStack detects the container's OS (Debian/Ubuntu, Alpine, RHEL/Rocky/Fedora), probes for an existing desktop environment (Cinnamon, MATE, GNOME, KDE, XFCE, LXQt, LXDE, Openbox, Fluxbox, IceWM, i3) and lets you choose:

• Full Desktop — install TigerVNC + XFCE4 (~450 MB on Debian-family, ~30 MB on Alpine).
• VNC Only — install just TigerVNC + a fallback xterm and reuse whatever desktop is already in the container. Recommended when the container already has a DE (e.g. Linux Mint, Ubuntu Desktop, Kubuntu).

The install runs live in a console tab so you can watch it. Once installed, the WebSocket bridge tunnels VNC through WolfStack's port 8553 — works behind Cloudflare, corporate proxies, or any environment that restricts traffic to well-known ports. No port publishing on the container, no firewall rules, no per-user VPN.

Distro coverage

• Debian / Ubuntu — pulls tigervnc-standalone-server, tigervnc-common, and tigervnc-tools (the latter provides vncpasswd).
• Linux Mint — an apt preferences file at /etc/apt/preferences.d/wolfstack-mint-fix.pref pins the Mint repo below Ubuntu so XFCE/GTK packages resolve against the Jammy base. Works around the linuxcontainers.org Mint 22.x (Wilma / Xia / Zara / Zena) LXC images that mix a Jammy base with Mint’s Noble-targeted repo.
• RHEL / Rocky / Fedora — pulls tigervnc-server + tigervnc (which provides vncpasswd).
• Alpine — minimal install with TigerVNC.

Multi-strategy startup so the install actually starts a session

• Strategy 1 — tigervncserver Perl wrapper reading geometry/security/password from /root/.vnc/config. The config-file approach sidesteps the version-dependent CLI flag churn (-localhost, -PasswordFile vs -PasswordFile=) that bites different distros.
• Strategy 1b — vncserver on RHEL-family installs that don’t ship the TigerVNC wrapper.
• Strategy 2 — direct Xvnc with WolfStack spawning xstartup itself. Bypasses the Perl wrapper entirely, no xauth/cookie shenanigans, no per-distro flag quirks.
• LXQt fallback — if the chosen desktop’s package set is unsatisfiable on a broken LXC template (e.g. Mint Zena’s GTK t64 transition vs Jammy libc6 2.35), WolfStack installs LXQt instead and tells you so.
• xterm last resort — if no desktop installs cleanly, xstartup still launches an xterm so the session isn’t a black screen.

Admin user & failure diagnostics

• Admin user auto-creation — if no non-root user exists, an admin account is created and added to sudo (Debian/Ubuntu) or wheel (RHEL). The VNC session runs as that user because GNOME / KDE / Cinnamon refuse to run as root.
• Idempotent install — re-running the install on an already-set-up container reinstalls cleanly without breaking the existing session.
• Diagnostics on failure — if Strategy 1 + 1b + 2 all fail to bring up port 5901, WolfStack captures the start-up log and surfaces it in the modal so you see the real error rather than a swallowed exit code.

Docker Compose Stacks

A full Compose manager lives alongside single containers: create stacks in a built-in YAML editor (or import an existing docker-compose.yml), validate, bring them up/down, restart, pull, and tail logs — per stack, per node. The stacks directory is configurable in Settings → File Locations, so WolfStack can adopt the compose layout you already have.

Secrets in Compose New in v24.37

Stop pasting passwords into YAML. Store them once in the Secrets Manager (linked from the Compose page), then reference them in any compose file as ${KEY}:

environment:
  - MYSQL_ROOT_PASSWORD=${DB_PASSWORD}

WolfStack injects the value when the stack is deployed — it never gets written into the stack folder or a .env file, and secrets are stored encrypted on the node the stack runs on. Names that could change how Docker itself behaves (PATH, DOCKER_HOST, …) are refused outright.

Container Cron Jobs

WolfStack lets you manage cron jobs inside individual Docker and LXC containers directly from the dashboard. View, create, edit, and delete crontab entries without needing to shell into the container.

Update Checks & Automatic Updates

For Docker containers, WolfStack periodically checks whether a newer version of each container’s image is available, and updates can be applied from the dashboard.

Updates can also be applied automatically. A background image watcher checks on a schedule and, for any container opted in, pulls the new image and re-creates the container:

• Per-container policy — auto-update is opt-in on each container, so you choose exactly which workloads track latest.
• Maintenance window — a cluster-wide window (cron schedule + duration) confines auto-applies to a time you pick; with no window set, updates apply as soon as they’re detected.
• Bounded concurrency — a parallelism limit (one at a time by default) stops a host with many containers being swamped by simultaneous image pulls.
• Audit history — every applied update is recorded, giving a full trail of what changed and when.

Docker Image Management

• View all pulled Docker images on a node
• Pull new images from Docker Hub or private registries
• Search Docker Hub for images
• Remove unused images

Docker Network Management

• View Docker networks on each node
• Inspect network configuration and connected containers

Try this on your own servers

WolfStack is free for personal use and installs in about two minutes — one command, no agents, works on any Linux server or Raspberry Pi.

Running it at work? Commercial licences start small and fund development.