Skip to content

Dozzle

Dozzle is a live log viewer for Docker containers. It reads logs straight from the Docker API (it stores nothing), so it's tiny and needs no setup on the containers themselves. One hub shows the containers of every host through a small agent on each of the others.

Component Runs on
dozzle (hub, web UI) control-host, in the monitoring stack; also shows its own host's containers
dozzle-agent every other server, port 7007

It's read-only here: I only use it to read logs, so the container start/stop/restart buttons and the shell are turned off.

Hub

compose.yaml (monitoring stack, excerpt)
services:
  dozzle:
    image: amir20/dozzle:v11.3.3
    container_name: dozzle
    restart: unless-stopped
    ports:
      - "8081:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      DOZZLE_REMOTE_AGENT: <NAS_HOSTNAME>.<YOUR_LOCAL_DOMAIN>:7007,server2.<YOUR_LOCAL_DOMAIN>:7007
      # Logs only: no start/stop/restart buttons, no shell
      DOZZLE_ENABLE_ACTIONS: "false"
      DOZZLE_ENABLE_SHELL: "false"
    healthcheck:
      test: ["CMD", "/dozzle", "healthcheck"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

DOZZLE_REMOTE_AGENT takes a comma-separated list, optionally as host:7007|display-name|group.

Agent

compose.yaml (on each other server)
services:
  dozzle-agent:
    image: amir20/dozzle:v11.3.3
    command: agent
    ports:
      - 7007:7007
    environment:
      - DOZZLE_LEVEL=info
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    restart: always
    healthcheck:
      test: ["CMD", "/dozzle", "healthcheck"]
      interval: 5s
      retries: 5
      start_period: 5s
      start_interval: 5s

No .env needed. The agent's healthcheck checks its connection to Docker; an unhealthy agent is hidden from the hub UI.

Why read-only

Dozzle has no authentication by default. With actions enabled, anyone who can open the UI can stop or restart containers on every host the hub is connected to, agents included. The decision was simple: "it's only used for logs", so the buttons are off. If you do want actions, put Dozzle behind authentication first (DOZZLE_AUTH_PROVIDER with simple file auth, or forward-auth from your SSO proxy).

Secure the agent port

The agent's built-in TLS certificate is the same in every Dozzle install and doesn't authenticate clients, so any Dozzle hub that can reach :7007 can read that host's logs. Keep 7007 firewalled to the hub, and generate your own certificate pair:

docker run --rm -v "$PWD":/out amir20/dozzle:v11.3.3 generate-certs \
  --cert-out /out/dozzle_cert.pem --key-out /out/dozzle_key.pem

Mount the same pair at /dozzle_cert.pem and /dozzle_key.pem on the hub and every agent (or set DOZZLE_CERT / DOZZLE_KEY), and restart them together.

Dozzle vs centralized logging

Dozzle shows what Docker still has. It doesn't keep history beyond the container's own log files, and logs disappear when a container is recreated. That's fine for "what is this container doing right now". For logs you need to keep (the firewall's, for example) use remote syslog, and see Log management for the host journal.

Sources & further reading