Portainer locked RBAC behind a paid tier, so I looked at Komodo as a GitOps-native alternative
Portainer moving role-based access control behind its paid Business Edition is the kind of change that makes you look at the rest of the field, even if you weren't actively unhappy before. I run more than one small Docker host, and "a dashboard with login" was never really the requirement — "declare what should be running and have it reconciled" is closer to what I actually want. That pointed me at Komodo (moghtech/komodo), which is built around exactly that idea and is GPL-3.0 with no paid tier gating features.
The architecture is the actual pitch
Komodo splits into a Core server holding state and the UI, and a Periphery agent running on each managed host that executes Docker commands and reports metrics back. As of v2.0.0 (24 March 2026), Periphery can initiate the connection to Core itself — meaning you don't need an inbound port open on every managed box, just outbound reachability to Core. Core and Periphery authenticate with auto-generated key pairs and automatic rotation, which is a meaningfully different trust model from "dashboard with a shared API key sitting on every agent."
Resources — stacks, builds, servers, syncs — are declared in TOML, editable from the UI, a local file, or a remote Git repo. Sync is additive and recursive across files and folders, filterable by tags, and the UI shows a diff before you confirm execution. That's the part that actually makes it GitOps rather than "a dashboard that happens to read a config file once": the plan-then-apply step is there, not assumed.
What's actually shipped recently
Checking the release history rather than just the pitch: v2.3.0 (29 July 2026) added pagination on resource and container list APIs (default 50 per page), mid-run cancellation for builds/actions/procedures, a multi-server stats page, and opt-in usage reporting. v2.3.3 (1 September) fixed intermittent "Project Missing" stack reports by addressing a Periphery command-timeout edge case. The most recent, v2.3.4 (22 October), is a supply-chain hygiene release — bumping `webpki-roots` to drop a root certificate after an intermediate CA key compromise, which is a good sign for how seriously dependency pinning is taken here, not a feature release. v2.0.0 also brought Docker Swarm management (nodes, services, stacks, configs, secrets), built-in 2FA including passkeys, and OpenAPI docs; Swarm support kept expanding through the 2.1.x and 2.2.x line.
What you give up
Komodo at roughly 12.8k GitHub stars and 2,859 commits is a smaller, younger project than Portainer's 38k+ stars — fewer integrations, a smaller community to search for when something breaks, and a UI that's clearly built by people prioritizing the Core/Periphery reconciliation model over dashboard polish. If what you actually want is point-and-click container management with a mature ecosystem and you're fine paying for RBAC specifically, Portainer Business is still a reasonable answer. Komodo is the better fit if the thing you actually wanted was "my Docker fleet's desired state lives in a Git repo and gets reconciled," and RBAC is a smaller concern than having the feature gated behind a license at all.
What I'm doing with it
I haven't migrated this blog's Coolify-managed deployment to Komodo — Coolify already gives me the git-push-to-deploy flow I actually need there. But for the other small Docker hosts I manage with less structure around them, standing up a Core instance and pointing Periphery agents at them with TOML-declared stacks in a repo is now the plan, specifically because the outbound-only connection model means I'm not opening new inbound ports to get there.