Introduction

Docker Hub Overview

The published image is `aimldev/docklog:latest`. It ships DockLog as one self-contained container so you can start quickly without stitching together separate backend and frontend images.

Configuration & Quickstart

Two modes: auth (SQLite for users, RBAC, audits) and no-auth (skip login; in-memory DB if you omit DB_PATH).

version: "3.8"
services:
  docklog:
    image: aimldev/docklog:latest
    container_name: docklog
    ports:
      - "8888:8000"
    environment:
      - SECRET_KEYSECRET_KEY: Secret token string for signing secure JWT user session cookies.=your-secure-key-here
      - DB_PATHDB_PATH: SQLite database storage file path for users and audit records.=/app/data/docklog.db
      - CLIENT_ACCESSCLIENT_ACCESS: strict or off. Controls browser origin validation for API and WebSocket access.=strict
      - ENVENV: Set to production to enforce a non-default SECRET_KEY and disable localhost origin bypass.=production
    volumes:
      - /var/run/docker.sockdocker.sock: Local UNIX host socket allowing direct control of the Docker daemon engine.:/var/run/docker.sockdocker.sock: Local UNIX host socket allowing direct control of the Docker daemon engine.
      - ./data:/app/data
    restart: unless-stopped

version: "3.8"
services:
  docklog:
    image: aimldev/docklog:latest
    container_name: docklog
    ports:
      - "8888:8000"
    environment:
      - DISABLE_AUTHDISABLE_AUTH: Skips the login screen. Fine on a private LAN; don't use on the public internet.=true
    volumes:
      - /var/run/docker.sockdocker.sock: Local UNIX host socket allowing direct control of the Docker daemon engine.:/var/run/docker.sockdocker.sock: Local UNIX host socket allowing direct control of the Docker daemon engine.
    restart: unless-stopped

version: "3.8"

services:
  docklog:
    image: aimldev/docklog:latest
    container_name: docklog
    ports:
      - "8888:8000"
    environment:
      - SECRET_KEYSECRET_KEY: Secret token string for signing secure JWT user session cookies.=generate-secret-here
      - DB_PATHDB_PATH: SQLite database storage file path for users and audit records.=/app/data/docklog.db
      - CLIENT_ACCESSCLIENT_ACCESS: strict or off. Controls browser origin validation for API and WebSocket access.=strict
      - ENVENV: Set to production to enforce a non-default SECRET_KEY and disable localhost origin bypass.=production
      - TRUST_PROXYTRUST_PROXY: Honor X-Forwarded-* headers from a trusted reverse proxy. Set true behind Nginx, Traefik, or Caddy.=true
    volumes:
      - /var/run/docker.sockdocker.sock: Local UNIX host socket allowing direct control of the Docker daemon engine.:/var/run/docker.sockdocker.sock: Local UNIX host socket allowing direct control of the Docker daemon engine.
      - ./data:/app/data
    restart: unless-stopped

Reverse Proxy & SSL

DockLog works best behind a reverse proxy when you want HTTPS, a custom domain, or access controls in front of the app.

location / {
  proxy_pass http://127.0.0.1:8888;
  proxy_http_version 1.1;
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "Upgrade";
}

Security Hardening

Use this checklist when DockLog moves from a private lab install to a team-facing environment.

Permissions & Client Access

DockLog separates who can see a container from who can act on it. Both checks must pass before an action is allowed.

Forgotten Password Recovery

DockLog stores credentials only in your local SQLite file. Use the built-in reset-password command instead of opening the database with sqlite3 while the app is running — the server holds a write lock on the DB, and the runtime image does not ship the SQLite CLI.

Recommended: built-in reset command

From the host, run this inside the running container (replace docklog with your container name and quote the password):

docker exec docklog ./docklog reset-password admin 'YourNewPassword123'

The command uses the same DB_PATH as the running service (default /app/data/docklog.db). On first login after reset, DockLog will prompt for a password change because password_changed is cleared.

If the database is locked

When the reset command reports a locked database, stop the app first, run a one-off container against the same data volume, then start again:

docker compose stop docklog
docker compose run --rm \
  -e DB_PATHDB_PATH: SQLite database storage file path for users and audit records.=/app/data/docklog.db \
  docklog ./docklog reset-password admin 'YourNewPassword123'
docker compose start docklog

Troubleshooting

These are the most common issues teams run into during first deploys and proxy-based setups.

Backup & Upgrade

DockLog keeps important state in the mapped data directory when auth mode is enabled. Back up that folder before upgrading or migrating hosts.

docker pull aimldev/docklog:latest
docker compose up -d --force-recreate

RBAC Rules & Regex Permissions

Architecture Overview

Go backend talks to Docker. Vue frontend in the same image. SQLite on disk when auth mode has a DB_PATH volume.

Historical CPU and memory samples are stored in SQLite for up to 30 days, then pruned automatically. Host metrics cover CPU, memory, total memory, and core count.

Product Tour

Screenshots from a live instance. Same UI you get after mounting the Docker socket and signing in.

Future Roadmap

Log viewer today. Multi-host, K8s, alerts, and the rest are planned but not shipped. The list below is direction, not a release schedule.

• Multi-host · Switch between Docker daemons from one UI. Today: one daemon per instance via DOCKER_HOST.
• Kubernetes · Pod logs and workload views without the Docker socket.
• Alerts · Notify on log patterns, container exits, or resource spikes (Slack, email, webhooks).
• Compose stacks · Deploy and update Compose projects from the UI, not just watch containers they already started.
• Richer metrics · Disk and network stats, longer retention. CPU and memory only for now.

Track or discuss ideas on GitHub Issues.