Download websites that use Docker

Docker is the odd entry in a web technology dataset, because a container is not supposed to be visible from outside. Containers package an application with its dependencies so it behaves the same way on a laptop, in CI and in production, and the point of the abstraction is that a visitor to the site sees the application and nothing underneath. When Docker shows up in a scan of a public page, something has leaked.

The leak is usually harmless and always informative. A default landing page from an unconfigured image, a registry or dashboard exposed on a subdomain, a health endpoint left public, a header or error page carrying the runtime, a path that exists only inside a stock image: each of those is a fingerprint. Detection of this kind is inferential rather than declarative, and the honest way to describe the result is that we find sites revealing a containerized deployment, not sites that use containers.

The consequence for the count is large. As of October 2026 we detect Docker on 3,154 sites, and the figure sits far below the real installed base, because a well-configured deployment behind a reverse proxy or a CDN reveals nothing at all. Anyone treating the number as a measure of container adoption will be wrong. The number is better understood as a census of deployments whose infrastructure is discoverable from the outside, which is a different and in some ways more interesting population.

The resulting list attracts audiences with opposite motives. Security researchers want it because an exposed registry, dashboard or default page is a finding in itself, and the population is the starting point for measuring how common that class of exposure is. Vendors of container tooling, image scanning, orchestration, observability and managed platforms want it because a leaked fingerprint identifies an operator who runs infrastructure directly and has no platform team hiding the details, which is a specific and reachable buyer.

Docker Inc. has shipped the engine since 2013 under Apache 2.0, and the runtime is written in Go. Open licensing is part of why the footprint cannot be measured from sales, because nothing is registered, nothing reports back in a way we can observe, and adoption spread through developers rather than procurement. Counting from the outside is the only method available, and its shortcomings deserve to be stated rather than smoothed over. A per-domain check tells you whether one host leaked its runtime. The download tells you how many did, where they are and what else they run, which is the only way to study a pattern of exposure at scale.