Everything running on your NAS, in your menu bar.
Ballast lists the Docker services on your Synology, shows which ones are actually up, and opens any of them in a click.
Free. No account, no subscription, nothing phoning home.
How it works
One read-only script, over the SSH you already use.
No daemon, no exposed Docker socket, no stored password. Every 30 seconds Ballast runs a small script on the NAS and reads what it prints.
Your Mac connects over SSH
Ballast reuses your SSH key and ~/.ssh/config. An alias you
already type in Terminal works here.
A read-only script inspects Docker
ballast-agent asks Docker to describe the containers. It can
inspect; it cannot build, pull or delete.
The menu shows what came back
Each container becomes a row with a status and a port. Click it to open that service.
What you get
A menu that answers the question and then gets out of the way.
Four statuses you can read at a glance
Each is a different shape, not just a different colour. When the NAS stops answering, everything turns unknown rather than showing a stale "healthy".
Start, stop and restart from the row
Hover a row to swap its port for restart and stop — or start, if it's stopped. The only things Ballast can change.
A crash at 3am no longer leaves no trace
Each check is compared with the last, so something that fell over and came back while you slept still shows up, with how long it was down.
Notifications that don't cry wolf
You only hear about a non-zero exit or an out-of-memory kill. Clean stops, restarts Docker already handled, and anything you did yourself stay quiet.
Works away from home
Give Ballast a second hostname — a Tailscale name works well — and it switches over when the local one stops answering.
Only the rows you care about
Hide the containers you never click, filter by name, and sort by status so problems float to the top.
Privacy & security
Nothing leaves your Mac.
One machine, over SSH, with the key already on your Mac. No cloud, no account, no telemetry. This paragraph is the whole policy.
-
No credentials in the app Key authentication and your existing
~/.ssh/config— no password is ever asked for, so none can leak. -
No Docker socket exposed The socket stays root-only. One sudoers rule, scoped to one root-owned script that can only inspect and start, stop or restart.
-
No daemon on the NAS Nothing listens, nothing runs between checks. The script runs over SSH and exits.
-
Container names can't reach a shell A name is checked against the live container list and travels as its own argument, never inside a command string.
Getting set up
Three steps, about ten minutes.
The honest part: Ballast needs SSH access and one small script on the NAS. It is not a download-and-go app.
Turn on SSH and add a key
Use an account in the administrators group, and leave the passphrase empty — Ballast runs unattended and can't answer a prompt.
ssh-keygen -t ed25519 -f ~/.ssh/id_ballast -C "ballast"
Install the agent on the NAS
One script installs ballast-agent root-owned and adds a sudoers
rule scoped to that one file. DSM asks for your password once.
./nas/deploy.sh you@nas.local
Point the app at your NAS
Fill in the SSH destination — user@host, or an alias from your
SSH config. "Test connection" names what's wrong, and the fix.
Full instructions are in the README.
What you need
- A Synology NASRunning Docker or Container Manager, with SSH enabled.
- An admin SSH accountDSM only allows SSH for the administrators group.
- macOS 26 or laterApple silicon or Intel. Lives in the menu bar; no Dock icon.
Stop guessing whether it's still up.
Put your NAS in the menu bar and find out at a glance.
Free, and quiet by default.