dPanel
GitHubInstall
dPanel
GitHubInstall
Engineering Whitepaper

Pure Rust Architecture & Dual-Tier Security

Discover how dPanel achieves enterprise-grade reliability, sub-millisecond execution, and total memory safety on standard Linux distributions.

Multi-Layered Execution Flow

Data and command flow across the privilege boundary via Unix domain sockets.

Layer 1

Presentation & Edge Layer

Nginx / Modern Browser

Handles incoming HTTPS traffic on ports 80/443. Terminates TLS using Let's Encrypt certificates, applies HTTP/2 & HTTP/3 QUIC acceleration, and forwards authenticated panel requests to the internal Rust daemon.

Layer 2

Unprivileged Web Daemon (dpanel)

Axum 0.7 + Tokio Async Runtime

Runs strictly as the non-root 'dpanel' user. Serves the embedded web UI, handles REST API endpoints, validates JWT authentication, and queries the local SQLite configuration database.

Layer 3

Privilege Separation IPC

Unix Domain Socket (/run/dpanel.sock)

Strictly typed JSON-RPC communication over an isolated Unix domain socket with strict 0600 file permissions. Every privileged command is cryptographically validated before execution.

Layer 4

Privileged System Executor (root daemon)

Rust System Worker

Executes low-level operating system tasks: Nginx vhost config generation, systemctl service reloads, UFW firewall manipulation, Fail2ban jail management, and user quota provisioning.

Layer 5

Linux Operating System Subsystems

Debian 12 / Ubuntu 22.04 & 24.04 Kernel

Interacts directly with systemd, iptables/nftables, cgroups v2, BIND9, Pure-FTPd, PHP-FPM pools, Node.js PM2 supervisor, and Docker Engine.

Architectural Design Principles

Engineered from scratch to solve the bloat and security flaws of legacy control panels.

Memory Safety Without Garbage Collection

Written entirely in Rust without unsafe pointers. Zero memory leaks, zero segmentation faults, and zero GC pause latency.

Single-Binary Packaging (rust-embed)

Web frontend HTML/JS/CSS, database migration scripts, and Nginx templates are compiled directly into the ELF binary. Zero runtime dependencies.

Principle of Least Privilege

Even if a remote vulnerability were to exist in the HTTP server layer, the attacker is jailed within an unprivileged non-root user without root access.

Atomic SQLite with WAL Mode

Configuration data is stored in SQLite with Write-Ahead Logging (WAL). Supports concurrent lock-free reads and crash-resilient atomic commits.

Standard Linux Filesystem Layout

dPanel follows standard Linux FHS (Filesystem Hierarchy Standard) guidelines for predictable operations.

/opt/dpanel/ # Compiled single binary & daemon runner
    ├── dpanel # Main executable (Axum + Tokio + rust-embed)
    ├── dpanel-worker # Privileged root IPC worker
/etc/dpanel/ # Configuration files & secrets
    ├── dpanel.conf # Daemon configuration & listen ports
    ├── jwt.key # HMAC-SHA256 session encryption key
/var/dpanel/ # State persistence & runtime storage
    ├── dpanel.db # SQLite configuration database (WAL mode)
    ├── backups/ # Automated website & database snapshot archives
    ├── logs/ # Access, error, and audit trail logs
/run/dpanel.sock # Unix Domain Socket for IPC (0600 root:dpanel)

Compare dPanel with cPanel & Plesk

See direct head-to-head performance, memory consumption, and licensing benchmarks.

View Benchmark Comparison