tui-tools

tui-containers

Every container on one screen, docker and podman together

A terminal UI (TUI) for docker and podman on Linux: the containers on a machine.

v0.2.2betacontainersMIT
Every container on one list, docker and podman together, with what is wrong at the top
Every container on one list, docker and podman together, with what is wrong at the top

A terminal UI for the containers on a machine. Docker and Podman are two engines with two stores, two sets of commands and — for Podman — two scopes that do not see each other; tui-containers puts them on one list, worst first: the ones exited non-zero, the ones stuck restarting, the ones their own health check disagrees with.

A container is more than its row. Open one and it says what it is using, what it is mounted on, what its health check has been printing, and its environment — with any value whose name says it is a secret replaced, and the name still on screen. Logs are a pane, re-read on a timer rather than followed.

Changes are previewed as the exact command line: the lifecycle verbs, remove, update --restart, a pull, compose up -d/down/pull from the labels Compose wrote, and every prune as a sentence, not a flag.

N runs a new container from an image — name, ports, mounts, an --env-file path, a restart policy — showing the whole run -d line first. n creates a volume or a network. There is no inline environment value: a secret typed into a form would sit in the preview and in inspect.

Run tui-containers --demo for a sample machine with both engines.

Keys

KeyAction
tab / 1-4Move between containers, images, volumes and networks, and the engines
enterOpen the selected container: what it is using, its mounts, its health check
LRead the selected container's log in a pane
s / xStart or stop the selected container
r / KRestart it, or kill it with SIGKILL and no grace period
p / uPause or unpause it
dRemove what is selected: a container, an image, a volume or a network
oChange the selected container's restart policy in place
UPull the selected container's image (the container is not recreated)
NRun a new container from an image: ports, volumes, env-file, restart policy
nCreate a volume or a network on the engine the selected row is on
PPull an image by reference into the selected engine's store
ccompose up, down or pull for the selected container's project
XPrune, with each variant spelled out before you choose one
AWhat Podman's auto-update would do, as a dry run
/Filter the rows of the current screen
?Help
qQuit

Press ? inside the tool for the full help screen, which is generated from the same action table as the key map.

Compatibility

This tool is a face on the program below, so its version matters. Tested is not a claim: a version lands there only after the tool's own suite passed against it on a real machine in the lab, and the run is kept as evidence in the repository. At startup the tool probes the backend once and says what it found in its header — a version nobody has run against is shown as (untested) in the warning colour, one older than the minimum as (below minimum) in the error colour. Neither stops it: the backend still refuses what it cannot do, in its own words.

docker

docker ≥ 20.10
Binary
docker
Minimum
20.10
Probed with
docker --version
Tested
No recorded run yet. The tool still runs and reports the version it found as untested.

Needs a version this new

  • format-jsonsince 23.0

What changes on older versions

  • docker <23.0

    --format json as a shorthand does not exist, so every list is read with --format '{{json .}}' instead. Nothing is lost: it is the same output, and it is what the shorthand expands to

  • docker >=20.10

    docker --version answers without a daemon, which is why it is the version probe: a machine with the CLI installed and dockerd stopped reports its version and then reports the daemon as not answering, with the reason

  • docker >=20.10

    the label list docker ps prints is every label joined with commas and nothing is escaped, so a label value containing a comma can be mis-split. The Compose labels this tool reads never contain one

  • docker >=20.10

    reading needs whatever the docker socket needs: an account in the docker group or a rootless daemon reaches it directly, and otherwise the tool retries the probe once through sudo -n and says in the header that it did

podman

podman ≥ 4.0
Binary
podman
Minimum
4.0
Probed with
podman --version
Tested
5.8.1

Needs a version this new

  • quadletsince 4.4
  • composesince 4.7
  • update-restartsince 5.0

What changes on older versions

  • podman <4.4

    Quadlet did not exist, so the ~/.config/containers/systemd and /etc/containers/systemd directories are not read and no unit files are listed on the engines screen

  • podman <4.7

    podman compose does not exist, so a Compose project is listed and grouped but cannot be driven from here. Before 4.7 a project was run by calling podman-compose directly, which takes different arguments

  • podman <5.0

    podman update --restart does not exist — podman update arrived in 4.3 carrying only the resource limits — so the restart policy key refuses with that reason instead of running a command Podman would reject

  • podman >=4.0

    rootless and root are two separate sets of containers, not two views of one. Both are listed when both answer; root's are read through sudo -n, and where that needs a password the screen says the system scope was not read

  • podman >=4.0

    an infra container — the pause process holding a pod's namespaces open — is dropped from the list. It runs nothing anyone wrote, and showing one per pod would be an unexplained extra row

Maintain docker or podman? You are welcome to help shape this tool. About → maintainers

Install

Once per machine, then every tool in the family is one pacman away.

Add the repository
$ curl -fsSL https://pkgs.tui.tools/install.sh | sh
Or run the same thing yourself, one command at a time

A family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.

The one-time setup, by hand
$ curl -fsSL -o /tmp/tui-tools.asc https://pkgs.tui.tools/pubkey.asc
  sudo pacman-key --add /tmp/tui-tools.asc
  sudo pacman-key --lsign-key \
    "$(gpg --show-keys --with-colons /tmp/tui-tools.asc | awk -F: '/^fpr:/{print $10; exit}')"
  printf '[tui-tools]\nServer = https://pkgs.tui.tools/arch/$arch\n' \
    | sudo tee -a /etc/pacman.conf
  sudo pacman -Sy
Arch Linux · tui-containers
$ sudo pacman -S tui-containers

Upgrades then arrive with the rest of your system updates.

What it can do to your machine

  • Preview, then confirm

    Every change is shown as an exact command line and confirmed before it runs. The dialog and the runner receive the same value, so the preview cannot drift from what executes.

  • Escalates for actions

    Rootless Podman and a Docker socket this account can reach need nothing at all. Escalation through sudo -n, which never prompts, is used for exactly two things: root's Podman containers, and a Docker daemon this account cannot reach otherwise — and the header says when it is being used.

  • No daemon, no state of its own

    Nothing keeps running after you quit, and nothing is installed to run later. The system is the source of truth; the tool re-reads it after every change.

  • No network access

    The tool opens no network connection of its own. No telemetry, no update check, no phone home.

  • Static binary

    Released statically linked, with no runtime dependencies to install.

  • Signed release, with provenance

    checksums.txt carries a keyless cosign signature from this repository's release workflow, every archive has a CycloneDX SBOM, and every archive, package and the checksum file carry SLSA build provenance. The security page shows the three commands that check it.

Reporting

Report a security issue privately, through GitHub's private vulnerability reporting on the repository's Security tab. The family-wide policy, and what counts as in scope, is on the security page.

Downloads

v0.2.2 · 2026-09-25
FileSizeSHA-256
checksums.txt1 KB—
checksums.txt.sigstore.json10 KB—
provenance.intoto.jsonl12 KB—
tui-containers-0.2.2-1-aarch64.pkg.tar.zst1.8 MB787bf4db35cdffb56419a059a83eaccda6b35dcd31303307b5265f18a68664da
tui-containers-0.2.2-1-x86_64.pkg.tar.zst2.0 MB569cd9688a2de313b5f64b1e56c93c214c5ab7b4c6a8c497a0de6e249858818b
tui-containers-0.2.2-1.aarch64.rpm1.8 MB154bd8d4508774c236ada7e9614910a1a8455466053bcaa4cba8f2e328d3e1b1
tui-containers-0.2.2-1.x86_64.rpm2.0 MBcb84aca5f205aa83b015fed6ea5f978c8514a1f3637f6a3f0efa8ef213ab3af5
tui-containers_0.2.2_amd64.deb2.0 MB4fe3a1b3d6e0ea18986b08fbf2e13630f5f27ae1322c4c8fbab9b71248dce5b3
tui-containers_0.2.2_arm64.deb1.8 MBad4e752bff8f2d218b652f19b97a664a3b6d45bd28433223d638301d4153b80f
tui-containers_0.2.2_linux_amd64.tar.gz2.0 MB83aa6d70e97f5f18b2bbc6c605a2c8082cbe558ec6a1bc747ba071f1fd3cce81
tui-containers_0.2.2_linux_amd64.tar.gz.cyclonedx.json24 KBf40ccc32561f913b76c77278257cb19ca2a8aa7ca6e2ba4df9a940849c1be6db
tui-containers_0.2.2_linux_arm64.tar.gz1.8 MB4db05e7d6267847301da052b6883d251fbb52fa30f2c935523d766a6d16f94ac
tui-containers_0.2.2_linux_arm64.tar.gz.cyclonedx.json24 KB7073c77b8c1a45c1c12eba8c90b8108c742ae3779c587a596c2c9a10d03e410d

Every release ships a checksums.txt. Download it next to the archive and run sha256sum -c checksums.txt --ignore-missing. See verifying a download.

Releases

v0.2.2

2026-09-25
## tui-containers v0.2.2

tui-containers 0.2.2: tui-kit v0.4.4

tui-containers 0.2.2 moves to tui-kit v0.4.4: every docker or podman command now runs in its own session without a controlling terminal, so a step that would prompt fails at once instead of hanging behind the UI, and a failed step reports its meaningful line, cleaned of escape codes. Command previews are POSIX shell-quoted, the README screenshots are re-rendered with continuous box borders, and the README banner now carries the kit's stability markers.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* 21db50a8aae0e9e754b36b81a5fd199599fa95d1 0.2.2: tui-kit v0.4.4 (#17)
* 32a7149b84368696f34837fda3542565c1ed9544 Bump anchore/sbom-action/download-syft (#3)
* 6721f1efd494feb5e634ef194bf7c2a3cae1fd7c Bump anchore/sbom-action/download-syft in the github-actions group (#15)
* f59b97527f972923757ba522740c0a1ff10d2da1 Bump the github-actions group with 4 updates (#16)
* 3d77bd198170cf8ef7952010c0da22dd0572ac28 README: link the tool's page on tui.tools (#14)
* 52cf645edf52c74489ff8d5a5df14bdc6692a8b0 README: point the install snippet at the current release (#13)

v0.2.1

2026-09-02
## tui-containers v0.2.1

tui-kit v0.3.0: the dialogs wrap and scroll instead of clipping the
command preview, and the picker filters as you type.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* 3aa6793be3b4e44202db4d4d5a11b879aa208492 Bump tui-kit to v0.3.0 (#12)

v0.2.0

2026-09-01
## tui-containers v0.2.0

Manage, not view (wave 3): create what does not exist, edit what does; lab-validated.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* a41ada5e40c094b41264e0e3e17b908e75cfce7a A code of conduct that fits on one screen (#9)
* b8747adfa4e4d4ef8be481b97105d18c114a399b Add --report, and a bug form that asks for it (#10)
* fc11620d98859c526fda46d0dc69f58ab9e52962 Carry the OpenSSF Best Practices badge (#7)
* cbf30b8891595a18ab41a630208df31b751ba742 Fetch the tag annotation before releasing (#5)
* 2dd838ee699182bb81e9c1b76c229e7b9c7f3be4 Pin what CI runs, fuzz the parsers, and say the releases are signed (#2)
* 721e6bb24794b8ad0f7d091cb1fec3dc3d296234 Print the whole tag message, not only its body (#6)
* f5ce2205b01f70c85598e2a407a43ae0e85ece22 Run a new container, create volumes and networks (#11)
* dcfe293d74d2b300266af2eed414352008ba56ca Say beta once (#4)
* 528f6c642868e1806316e1a0f4d6a86067c83ec3 Take tui-kit v0.2.8: hashed pip install, provenance bundle on the release (#8)

v0.1.2

2026-08-30
## Changelog
* 0fee9620ca59667eb86eb52f3499384cc77c762a Drop cross-repo dispatch; the package repo and the site poll releases
* cf3d99398c322fc647641e3f24a54b25f44bd6e9 Gate the release on a security job, and sign what it publishes (#1)
* 92ba8597a7a5abfa6ad1d02a6c5329b5a27897c3 Stop telling readers the packages are unpublished

v0.1.1

2026-08-30
## Changelog
* a515f597b6f5332b2136ecb0ced886ee10d7304b Let a machine with no container engine be a model, not an error
* da24df4fcef0e7e2df30b60594752acf19dc65f0 Packages are available from pkgs.tui.tools
* bf176ea837348204adc3d503b20c385fc6c4c6fa Re-pin the kit at v0.2.3
* cc8b781becd0561fdaa8ad177a07ebff17359376 Ship the tool as a .deb, an .rpm and a pacman package

v0.1.0

2026-08-30
## Changelog
* f70ab7e513330c5a6169967e7318cff065368e87 Initial commit
* 205c289bac39c66f8582c5b9e52f4bc8d117a5a0 Let the host version probe be slow rather than fail
* 274fbbdd8b5d4d30bf3751346765663043d03ade tui-containers v0.1: docker and podman on one screen