Skip to content
Oday Bakkour
Back to projects
opensource2026

ReverseDock

ReverseDock is a free, open-source reverse proxy in Rust on Cloudflare Pingora, with Docker discovery, automatic HTTPS and load balancing. Now in alpha.

Launch project Source code
CORE TECHNOLOGIES
RustCloudflare PingoraDockerLet's EncryptOpenTelemetry
ReverseDock

ReverseDock: One Reverse Proxy for Every Dock

Overview

ReverseDock is a free, open-source reverse proxy written in Rust on Cloudflare Pingora. The same single binary is meant to run on a laptop, a VPS, a Docker Swarm or a Kubernetes cluster. It is Apache-2.0 licensed, with no account, no telemetry and no paid tier.

Status: the latest release is 0.4.0-alpha.1 (October 31, 2026), a pre-release. It isn't running in production yet, so treat it as something to test rather than something to put in front of a critical service.

Why I'm building it

Each popular proxy is excellent at one thing, so choosing one usually means giving up something another does well. ReverseDock aims to bring these together in one binary with a dashboard:

  • Traefik's discovery: Docker labels, including your existing traefik.* labels.
  • Caddy's HTTPS: automatic certificates by default.
  • NGINX's HTTP features: rewrites, redirects, headers, compression, static files and caching.
  • HAProxy's reliability: health checks, load-balancing policies, retries with budgets and limits.

Not all of this ships yet. The next section covers what's in the current release, and the roadmap covers the rest.

What works in 0.4 alpha

  • Load balancing: least-requests, power-of-two and consistent-hash, plus signed sticky sessions.
  • Health checks: active (HTTP, TCP, gRPC) and passive, failing open.
  • Traffic control: retries with a retry budget, weighted splits, mirroring, limits and load shedding.
  • Automatic HTTPS: certificates from Let's Encrypt or any ACME CA over HTTP-01, TLS-ALPN-01 or DNS-01, with alerts when renewals fail. Local and private names use a name-constrained local CA.
  • Security: client certificates, Cloudflare Authenticated Origin Pulls, JWT validation, and trusted Cloudflare ranges for the real client IP.
  • Operations: zstd and Brotli compression, plus OpenTelemetry tracing.

Try it with Docker

bash.txt
cd deploy/docker && docker compose up -d
curl -H 'Host: whoami.localhost' http://localhost/
docker compose exec rdock rdock status

One label is enough to create a route, a service and automatic HTTPS for a container:

docker-compose.yml
services:
  app:
    image: ghcr.io/me/app
    labels:
      rdock.host: app.example.com

Roadmap

  • v0.5 Management: a dashboard and REST API with history and rollback. This is the next release.
  • v0.6: Docker Swarm, TCP/UDP and static files.
  • v0.7: Kubernetes.
  • v0.8: cache and plugins.
  • v0.9: scale and experimental HTTP/3, then v1.0.

License and links

ReverseDock is Apache-2.0 licensed, with no CLA and no open-core tier. The code is on GitHub, and the project has its own website.

Writing about ReverseDock