Docker Projects 2026
I’ve spent the last year building tools. Not the shiny kind that everyone uses, but the everyday kind that solve a particular problem and then stay out of the way. Most of them run in Docker—a straightforward way to package an application with all its dependencies, so it runs the same on my NAS as it would on a laptop.
Docker is how it works. You write down what an app needs (Python version, database, libraries), bundle it into a container image, and Docker runs it in isolation. The container has its own filesystem, its own processes, its own network. Define it once in a text file, run it anywhere consistently. Simple idea, but it lets you go from idea to working app without the usual mess of incompatible versions and “works on my machine” disasters.
Container Radar
A dashboard that watches all your Docker containers for newer versions of their base images. It compares what you’re running against what’s available in registries, spots updates before they break anything, and sorts them by severity: critical gets your attention, normal can wait, ignored never bothers you. Behind the scenes it uses digest comparison (the cryptographic fingerprint of each image) to spot real updates rather than just tag changes. Signed cookies keep it secure, and it runs a check every six hours by default.
It’s built in React and Node, and stores its state in JSON files. The hardening matters: strict content policies, brute-force rate limiting on login, and settings encrypted at rest with AES.
DinnerTime
An AI-powered meal planner that knows what recipes you have and suggests dinners. Point it at your recipe library and it learns what you cook, or plug in an API key for Claude and it gets smarter about suggestions. It talks to Home Assistant for notifications and integrates with Mealie, a recipe app I run separately. Once you tell it what to make, it reads and writes your meal plan like a notebook—always the current copy, never a stale duplicate.
Built in Python with FastAPI, it uses APScheduler to handle the daily suggestion run without you having to ask. Secrets—API keys, SMTP credentials—are encrypted with keys derived from your login password. Nothing lives in environment variables or git.
AutoLedger
Tracks fuel, service costs, and everything else about owning a vehicle. It calculates MPG per fill, reminds you when tax and MOT are due, sends notifications via email and Home Assistant, and draws 9 different reports in your browser. All of that drives a public stats API for the home-lab dashboard tile, publishing just the totals.
It’s built in Flask with flat JSON storage, not a database—genuinely intentional. JSON is easy to inspect, back up, and diff in git. Python gets to the core logic without schema indirection. Writes are serialised through a single Gunicorn worker to prevent race conditions. There’s no password recovery, so keep that credential somewhere safe.
Energy Tracker
PDF statements from Octopus Energy and Affinity Water go in, and this pulls out the numbers: kWh, cost, standing charges, water usage. Stores it in SQLite and serves a dashboard with cost histories and a boiler efficiency comparison (the old one versus the new one installed last August). Charts are built in Chart.js, rendered server-side in Jinja. Tests are strict about the text extraction—the parser is verified before it touches a real PDF.
Coffer
A net-worth tracker and pension drawdown simulator. Record what each account is worth once a month; from those snapshots, every chart and projection follows. It values your crypto and shares at live prices, tracks ISA allowance, and runs a Monte Carlo pension simulation with real UK income tax.
Coffer holds the complete financial picture, encrypted at rest on the Mac. The data backs up nightly to the NAS (encrypted), with a weekly drill that proves restoration works. That last part matters: a checksum proves the bytes arrived, but only a drill proves they’ll restore. The simulator’s tax bands are frozen, not indexed to inflation, which is pessimistic over 35 years but appropriate for a tool that’s trying not to surprise you with false confidence.
Streaming Radar
Watches what you watch across Plex, queries The Movie Database for richer detail, and sends you a weekly digest of what was worth the time. A ranking engine sorts by quality and interest, not just chronology. Notifications come via email or ntfy. Built in FastAPI with SQLite and APScheduler.
Vitalist
An Apple Health dashboard and AI health engine. You export your health data from your phone—millions of records—and this parses them into DuckDB (a columnar store that’s fast for analytics), then serves up activity, heart rate, running routes, and an “Ask” tab where you can ask Claude questions about your own data. Routes even get rendered as maps by querying OpenStreetMap. Everything stays on your network; no telemetry, no cloud.
The dashboard and API sit behind a Basic-Auth password, while the sync endpoint (for your phone’s background sync) uses its own token instead. That way your phone can push data without needing Basic Auth, which it can’t do on a background task. Backups rotate three generations locally, encrypt them at rest off-host, and a weekly drill proves they decrypt and restore.
HomeVault
A household records vault: insurance policies, car tax, pension statements, renewal dates, where the wills live, and now the actual paperwork itself—PDFs, scans, photos. It sends family members renewal reminders via email, but the full details only travel inside AES-encrypted zips locked with their own passphrase. Email bodies show just the last four digits of account numbers.
The whole thing lives in SQLite, encrypted with a key the scheduler can use without anyone logged in. It backs up nightly, keeps an audit log of who changed what (without storing field values in the log—that would be a second, unencrypted copy), and can search across everything. Attachments are encrypted blobs in the database alongside the records, so one restore solves everything.
Behind the scenes it’s React and Python, with strict CSP headers and login rate limiting. The one security fix along the way stopped an unauthenticated path traversal on the LAN port—fixed by resolving paths and enforcing containment.
GS1 Toolkit
A barcode parser for logistics and retail standards. Feed it a GS1-128 barcode and it splits the packed fields, validates each one against the official spec, and converts between element strings and Digital Link URLs (the same barcode in two notations). One optional external call checks Open Food Facts, but the whole thing runs air-gapped if you don’t use that. It’s built in FastAPI with a local SQLite cache and no cloud or accounts.
Umami Quiggles
Web analytics, self-hosted. My websites phone home to their own analytics engine instead of some cloud service. It’s Umami running on the NAS with a PostgreSQL database and a Cloudflare tunnel to the public internet. The dashboard sits behind Cloudflare Access (email verification) then Umami’s own login, so it stays private. The tracking script is public (anyone’s website could use it), but firewalled to accept data only from whitelisted domains. It’s the kind of thing most people never notice—visitors to the site get tracked, I get a dashboard showing what’s happening—but building it meant learning Cloudflare tunnels and running managed Postgres instead of SQLite for the first time.
Quigley Arts
Not Docker, but the natural complement to Umami. A rebuild of Jo’s art website from Joomla into a static site (Astro) with a Git-backed CMS (Sveltia) and Stripe payment links. 481 paintings migrated from the old site with categories, tags, and sales status. Jo edits everything through the CMS at /admin without touching code or FTP. The shop starts empty—a painting is only buyable when she prices it and flips it to “For sale”. It deploys as static HTML to DreamHost, pulling its analytics from Umami Quiggles above.
The rebuild also fixed a structural problem: the old Joomla site got compromised with webshells. Static sites have no server-side code to exploit. No PHP, no database server exposed, no remote code execution surface. Just files and HTTPS.
Common patterns
What ties these together? All are single-user or small-team tools. None phone home or need the cloud. They run on a Synology NAS or a Mac, reachable over the home network or via Tailscale remotely. Authentication is lightweight—mostly passwords and tokens—because they sit behind a reverse proxy (Nginx Proxy Manager handles HTTPS for everything). Secrets get encrypted at rest. Backups exist in multiple places, and the critical ones (Vitalist, Coffer, HomeVault) verify their own restoration weekly.
Docker itself sits in the background quietly doing what it does: defining the environment once so every run is identical. The Compose files live in git. The data—databases, user uploads, encrypted backups—lives in volumes that survive container restarts. Most of these run on demand on a Mac rather than always on, so they cold-start when needed and don’t burn electricity when they’re not.
The year’s batch tested some patterns that didn’t exist before: snapshot-first net worth (Coffer), envelope encryption where the server holds the key (HomeVault), weekly restore drills (Vitalist, Coffer, HomeVault), and moving truly sensitive off-host backup (health records, finances, household admin). The backups broke silently a few times along the way—copying a WAL-mode database without its sidecar, restoring the wrong file—which is why every critical app now has code that proves the backup works.