DeQ runs bare metal, not in Docker.
It's designed for low-power devices that are already online 24/7 - a Pi, a mini PC, even a WRT router. These give you always-on access to your homelab via Tailscale or LAN, without the overhead of a full server.
Docker would negate its own isolation benefits while adding overhead. To provide actual system control, a containerized DeQ would need host networking, Docker socket access, privileged mode, and volume mounts for every path - at that point, you're running a "container" with full host access anyway, just with extra steps.
DeQ stays up when everything else breaks.
When your Docker daemon crashes, when an update borks the container network, when Portainer can't reach its own backend - your containerized dashboard goes down with the ship. DeQ, running as a simple systemd service, is often still reachable when everything else is on fire.
Yes, it runs as root. Here's why that's okay.
The security model is "trusted tool on a trusted network." DeQ supports optional password protection, and we recommend running it behind a VPN (Tailscale, WireGuard). The code is auditable - all 350KB of it. A technically competent user can read exactly what DeQ does in an afternoon. Compare that to trusting a 200MB Docker image with layers of abstraction you'll never inspect.
Never expose DeQ to the public internet. Use Tailscale or WireGuard.
Read the full FAQ →