For services running as Docker Compose stacks, PrivateNexus gives you direct operational control without needing a separate terminal session or a tool like Portainer.
From a service's detail view, backed by read-only Docker access:
PrivateNexus's Docker access is read-only by design — it can see container state, but stack operations that change something go through the governed action flow rather than a direct, ungoverned socket call. This is the same principle behind the Catalogue deploy flow: nothing changes state on your infrastructure without a proposal, a review of what will actually happen, and an approval on record.
Concretely, this means there's no "just SSH in and run docker restart" backdoor inside PrivateNexus itself — even a one-container restart triggered from the UI creates a real proposed action, gets whatever approval your account's policy requires, and lands in the audit log with the rest of your action history.
A direct terminal session doesn't leave an audit trail, doesn't check whether the action fits an approved policy, and doesn't correlate the change against the service's own health/recovery data. Stack operations through PrivateNexus do all three automatically — the convenience of a one-click restart, with the same governance and audit trail as any other action.
This doesn't mean you can never SSH into a host directly — sometimes that's genuinely the right tool. It means that when you use PrivateNexus for the operation instead, you get the audit trail and policy enforcement for free, without extra effort on your part.