I'm Building ReverseDock, an Open-Source Reverse Proxy

Executive Summary

• What it is: ReverseDock is my free, open-source reverse proxy (Apache-2.0), written in Rust on Cloudflare's Pingora. No account, no telemetry, no paid tier.
• The idea: Traefik-style Docker discovery, Caddy-style automatic HTTPS and HAProxy-style reliability in one proxy, with a dashboard on top.
• Today: 0.4.0-alpha.1 is out. It is an alpha: it works, but it is not production-hardened yet.
• Honest numbers: in my own benchmarks NGINX is still faster, and the report is public.
• Next: a built-in dashboard. It is a design today, and I want your input before I build it.

I made a short video of this on X.

I kept running three proxies. So I'm building ReverseDock.

Why another reverse proxy

On my servers I kept combining tools: Traefik for Docker labels, Caddy when I wanted HTTPS without thinking about it, NGINX or HAProxy when traffic got serious. Each one is great at its part. ReverseDock is my attempt to get those parts in one binary, on the same engine Cloudflare uses at its edge.

One label, with HTTPS

Put a label on a container and ReverseDock creates the route, the service and the certificate:

services:
  app:
    image: ghcr.io/me/app
    labels:
      rdock.host: app.example.com   # route + service + automatic HTTPS

Certificates come from Let's Encrypt or any ACME CA (HTTP-01, TLS-ALPN-01, or DNS-01 with Cloudflare for wildcards), and renewals run on their own. For localhost and private names there is a local CA: rdock trust installs its root.

One label routes a container, with HTTPS

Already on Traefik?

ReverseDock reads traefik.* labels as they are. If you want a config file instead, rdock migrate traefik converts a Compose file. This is the real output on the example in the repo:

rdock migrate traefik compose.yaml

routes:
  api:
    listeners:
    - web
    match: Host(`api.localhost`) && PathPrefix(`/api`)
    middlewares:
    - strip-api
    service: api
  whoami:
    match: Host(`whoami.localhost`)
    service: whoami
    tls: "off"

It also tells you what it could not migrate ("2 note(s) about what was not migrated"), so you can check the result with rdock validate before you switch.

On Traefik? Your labels work as they are

When a backend dies

Load balancing (least-requests, power-of-two, consistent hash), active and passive health checks, and retries with a retry budget are in 0.4. When a backend stops answering, the request in flight is retried on a healthy one and the backend is ejected until it passes its checks again. Config reloads don't drop requests, and a bad config falls back to the last one that worked.

Health checks and retries keep traffic flowing (illustration)

Honest numbers

From the benchmark report (October 29, a laptop VM, 2 CPUs and 1 GiB per proxy, one route, no TLS):

• Up to 10,000 req/s: all five proxies keep up (NGINX, HAProxy, Traefik, Caddy, ReverseDock), with medians around 0.2 ms.
• At a 20,000 req/s target: NGINX reaches 17,884 req/s, ReverseDock 13,702.
• At 40,000 req/s (overload): NGINX keeps 18,795 req/s; ReverseDock drops to 1,925 with about half the requests failing.

Overload behaviour is the main performance work now. A nightly CI job compares ReverseDock with NGINX so regressions show up the next morning.

Honest numbers: NGINX is still faster

Next: the dashboard, and your input

The dashboard is the next milestone, together with a REST API. Today it is a design, not software. The design preview shows an overview with traffic, backend health and certificate status, a routes table that shows where each route came from (a file, a Docker label or the API), and a certificates page with renewal state, in light and dark mode.

The dashboard design preview

This is the part where your answer changes what I build. What should the dashboard show you first? Reply on X or open a discussion.

Try the alpha

git clone https://github.com/Docker-Hunterpedia/ReverseDock
cd ReverseDock/deploy/docker && docker compose up -d
curl -H 'Host: whoami.localhost' http://localhost/

It is an alpha, so try it on a side project first, and please open an issue when something breaks.

Sources

• ReverseDock on GitHub: README, roadmap, design docs
• Release 0.4.0-alpha.1, October 31, 2026
• Benchmark report 0.4.0-alpha.1
• Cloudflare Pingora
• @Cloudflare on X