Question 1

Is my container log data stored outside my server?

Accepted Answer

No. DockLog runs entirely on your infrastructure. It reads container output through the Docker socket on your host and streams it to your browser over WebSockets. Log lines are not copied to our servers, and the project does not include telemetry, analytics, or any third-party log forwarding. What you see in the UI is what Docker has on that machine.

Question 2

Is DockLog free and open source?

Accepted Answer

Yes. DockLog is open source under the MIT license. You can pull the Docker image, build from source, and run it on your own hardware or cloud account without a subscription or usage fee. There is no hosted SaaS tier: you deploy and operate the instance yourself, which also means you own the data and the uptime.

Question 3

Why use DockLog instead of docker logs or SSH?

Accepted Answer

docker logs and SSH work fine when one person debugs one container on a box they already control. DockLog is better when several people need access: each developer gets a browser UI with per-user container patterns, optional action permissions, and an audit trail, without handing out SSH keys or Docker socket access to everyone. Live tailing, host metrics, and start/stop controls sit in one place instead of juggling terminals and compose project names.

Question 4

When is DockLog the right tool?

Accepted Answer

DockLog fits single-host (or single-daemon) Docker setups where you want fast visibility, not a full observability platform. Typical wins: a small team on one VPS, staging and prod on the same machine with RBAC separation, a homelab or agency host where clients get log access without shell access, or any case where you want logs and light metrics in under a minute with one container image. If your main goal is tail stdout, check CPU/memory, and optionally restart a service, DockLog is aimed at that workflow.

Question 5

When should I use Elasticsearch, Loki, or a full logging stack instead?

Accepted Answer

Choose a full stack when you need centralized logs across many hosts, months of indexed retention, complex search queries, alerting pipelines, or compliance archives at scale. Those systems are better at aggregate analytics and long-term storage. DockLog is better at low-latency tailing on one Docker engine, minimal ops overhead (~30 to 50 MB RAM, no mandatory search cluster), and built-in team RBAC on that host. Many teams run DockLog for day-to-day debugging and a separate stack later if search-at-scale becomes a requirement.

Question 6

Can I use DockLog without authentication?

Accepted Answer

Set DISABLE_AUTH=true (or NO_AUTH=true) and the login screen is skipped. The UI opens straight to containers and logs. This is useful for a local laptop, a homelab on a private network, or a throwaway dev box. Do not use no-auth mode on anything reachable from the internet: anyone who can load the URL gets full Docker visibility through the socket.

Question 7

Does DockLog require a database?

Accepted Answer

It depends on how you run it. With authentication enabled, DockLog stores users, RBAC rules, audit entries, and historical metrics in a SQLite file at DB_PATH (default docklog.db). If you disable auth and leave DB_PATH unset, DockLog uses an in-memory SQLite database instead. That works for a quick local dashboard, but users, audits, and stored metrics are lost when the container restarts.

Question 8

What are the default admin credentials?

Accepted Answer

A fresh install seeds a single administrator account with username admin and password admin123. On first login you are prompted to change that password before continuing. Treat the defaults as a bootstrap step only: change them before exposing the UI on any network you do not fully trust, and use a strong password that meets the eight-character minimum.

Question 9

Can I manage containers directly from DockLog?

Accepted Answer

Yes. From the containers view you can start, stop, restart, inspect, and remove workloads when your permissions allow it. In auth mode, both the server ALLOW_* environment flag and your per-user can_* database flag must be enabled for each action type. In no-auth mode, only the ALLOW_* variables gate actions. Every permitted action is recorded in the audit log when auth mode uses a persistent database.

Question 10

Can I monitor multiple Docker hosts?

Accepted Answer

Each DockLog instance connects to one Docker daemon: typically the local socket at /var/run/docker.sock, or a remote daemon if you set DOCKER_HOST. You can point DOCKER_HOST at another host, but the UI does not yet let you switch between multiple engines in one session. For several machines today, run one DockLog container per host (or per daemon). Multi-host switching in a single UI is on the roadmap.

Question 11

Can I restrict which containers users can access?

Accepted Answer

Yes. Staff accounts use allowed_containers patterns to limit visibility: exact names, wildcards like backend-*, or full regex such as ^prod-.*$. Administrators see every container. Patterns are evaluated per user, so two developers on the same DockLog instance can tail completely different sets of workloads. See the RBAC section in the docs for examples and the action-rights model.

Question 12

Are audit logs available?

Accepted Answer

When authentication is on and DB_PATH points to a file on disk, DockLog writes an audit trail to SQLite. Entries cover logins, container lifecycle actions, shell sessions, password changes, and admin edits to users or settings. If you run no-auth mode without a persistent DB_PATH, the database lives in memory and audit history is cleared on restart. Export or back up the SQLite file if you need long-term retention.

Question 13

Can I restrict which namespaces or pods users can access?

Accepted Answer

Yes. Staff accounts use the same allowed_containers pattern field for Docker and Kubernetes. Patterns can match namespace names (e.g. staging), pods in a namespace (staging/api-*), or pod names across namespaces. Administrators see every workload. Combine per-user patterns with the instance-level K8S_NAMESPACES allowlist when you want defense in depth.

Question 14

Does DockLog support Docker Compose applications?

Accepted Answer

Containers started by Docker Compose appear in DockLog like any other workload: you see their names, status, logs, and stats. DockLog does not currently offer Compose-specific features such as grouping by project label, editing compose files, or one-click stack deploy. For day-to-day debugging, tailing and managing those containers works the same as standalone containers.

Question 15

Can DockLog be exposed to the public internet?

Accepted Answer

You can expose it, but treat it like any admin tool that holds Docker socket access. Put DockLog behind HTTPS using Nginx, Traefik, or Caddy, keep authentication enabled, set ENV=production with a strong SECRET_KEY, and restrict who can reach the URL (VPN, firewall, or SSO in front of the proxy). Never publish raw HTTP on a public port without auth. The socket behind DockLog is effectively root-level access to your host.

Question 16

Why does DockLog need access to the Docker socket?

Accepted Answer

The Docker socket is how DockLog talks to the engine: listing containers, streaming logs, reading CPU and memory stats, and running lifecycle commands. Mounting /var/run/docker.sock (or setting DOCKER_HOST to an equivalent endpoint) grants the same power as the docker CLI on that host. Only install DockLog on machines and networks you trust, and limit who gets UI access through auth and RBAC.

Question 17

Does DockLog support SSL certificates?

Accepted Answer

DockLog serves plain HTTP inside the container on port 8000 (or whatever you set in PORT). It does not terminate TLS or manage certificates itself. In production, put a reverse proxy in front that handles HTTPS and forwards traffic to DockLog. Set TRUST_PROXY=true and add your public URL to ALLOWED_ORIGINS so login and API origin checks work correctly behind the proxy.

Question 18

Can I monitor resource usage?

Accepted Answer

Yes. The dashboard and health views show host-level CPU and memory, and the containers table includes per-container usage. Live samples stream over WebSocket; historical points are stored in SQLite and retained for about 30 days before automatic pruning. This is enough for spotting spikes and capacity trends on a single host without deploying a separate metrics stack.

Question 19

How much memory does DockLog consume?

Accepted Answer

DockLog is a single Go binary with an embedded Vue frontend, so its footprint stays small compared to full observability stacks. Typical RAM use is around 30 to 50 MB on a modest VPS, depending on how many containers you list and how many log streams are open. It is designed to run alongside your workloads rather than competing with them for memory.

Question 20

What happens if I lose my admin password?

Accepted Answer

Use the built-in CLI from the Docker host: docker exec docklog docklog reset-password admin 'YourNewPassword123'. Do not open the SQLite file with sqlite3 while the server is running. It holds a write lock. The reset command invalidates existing JWT sessions automatically. If the database is locked, stop the container, run a one-off reset against the same DB_PATH volume, then start again. If you do not need users or audit history, delete docklog.db and restart to re-seed admin / admin123.

Question 21

How is DockLog different from traditional observability stacks?

Accepted Answer

Traditional stacks usually need agents, a broker, and a search index before anyone can see a line of logs. DockLog skips that pipeline: one container mounts the Docker socket and streams stdout/stderr over WebSockets. Where DockLog is stronger: setup time (often under a minute), resource use (tens of MB of RAM, optional SQLite only), per-user RBAC and audit on the same host, and container actions when you enable them. Where full stacks are stronger: cross-cluster search, long retention, dashboards across hundreds of nodes, and mature alerting ecosystems. DockLog is a focused Docker admin and log viewer, not a replacement for Elasticsearch at fleet scale.

Question 22

How does DockLog compare to lightweight Docker log viewers?

Accepted Answer

Tools like Dozzle focus on fast, read-only log tailing with very little configuration. DockLog goes further for teams: authentication, wildcard and regex container visibility per user, two-layer action permissions (ALLOW_* plus can_*), audit logging, host and container metrics with short history, and optional shell access. If you only need a personal log tail on a trusted LAN, a minimal viewer may be enough. If multiple people share one Docker host and you need to control who sees prod containers or who can restart them, DockLog is built for that.

Question 23

How do I run DockLog behind Nginx or a reverse proxy?

Accepted Answer

Terminate TLS at the proxy and forward HTTP to DockLog on your internal port (for example 8888 mapped to container port 8000). WebSocket support is required: without Upgrade and Connection headers, live log streams will disconnect. Set TRUST_PROXY=true on DockLog and list your public HTTPS origin in ALLOWED_ORIGINS (full URL or host-only). Full Nginx and header examples are in the reverse proxy section of the docs.

Question 24

Does it support Docker Swarm or Kubernetes?

Accepted Answer

DockLog targets a single Docker Engine API for containers. On Docker Swarm you can run one DockLog instance per node with that node's local socket to watch stacks scheduled there. For Kubernetes, set RUNTIME_MODE to kubernetes or both and mount kubeconfig or run in-cluster with a ServiceAccount. DockLog lists pods, deployments, HPAs, services, and events; streams pod logs; supports pod shell and RBAC patterns for namespaces and pods; and includes Kubernetes event alert rules. See the Kubernetes guide in the docs for compose examples.

Question 25

How do I upgrade to the latest version of DockLog?

Accepted Answer

Pull the new image and recreate the container so it picks up the updated binary and embedded UI. With Docker Compose: docker pull aimldev/docklog:latest then docker compose up -d --force-recreate. With a plain docker run deployment: pull the image, stop and remove the old container, then run your original command again. Your SQLite database and mounted data volume are preserved as long as you keep the same DB_PATH mount. Review the changelog if a release changes environment variables or WebSocket auth behavior.

Question 26

Can DockLog monitor stopped containers?

Accepted Answer

Stopped containers remain visible in the list with their last known status, exit code, and metadata from Docker. You can open historical logs that Docker still retains for that container. Live tailing only applies to running containers. Once a container is removed from Docker entirely, it disappears from DockLog as well.

Question 27

Can multiple team members use DockLog simultaneously?

Accepted Answer

Yes. Several users can sign in at the same time, each with their own JWT session and RBAC rules. Log streams and container actions are independent per browser or native client. Auth mode with per-user visibility patterns is what makes shared access safe: developers see only the containers assigned to them while admins retain full visibility.

Question 28

Does DockLog support ARM devices?

Accepted Answer

The published Docker image includes ARM64 builds alongside amd64. That covers Raspberry Pi, AWS Graviton, Oracle Cloud ARM instances, and Apple-silicon Linux VMs. Pull aimldev/docklog:latest on your ARM host the same way you would on x86; Docker selects the correct architecture automatically.

Question 29

Does DockLog require internet access?

Accepted Answer

After you have pulled the image (or copied a saved tarball), DockLog does not need outbound internet to operate. Log streaming, auth, and metrics all run on your LAN or VPC. Internet is only required again when you want to pull upgrades or if your deployment policy fetches images from a registry on each start.

Question 30

Can I run DockLog on a home server or NAS?

Accepted Answer

Yes. People run it on Synology, Unraid, Proxmox VMs, homelab NUCs, and small VPS instances. As long as the host runs Docker and you can mount the socket (or point DOCKER_HOST at the engine), DockLog works the same as on a cloud VM. Use auth mode and HTTPS if the UI is reachable outside your home network.

Question 31

What happens if Docker restarts?

Accepted Answer

If the Docker daemon stops or restarts, DockLog loses its connection until the engine is back. Once Docker is healthy again, refresh the UI or wait for automatic reconnect on WebSocket streams. You do not need to restart the DockLog container unless it crashed along with the daemon. Container list and stats repopulate from Docker on the next successful API call.

Question 32

Can I search within container logs?

Accepted Answer

The log viewer includes search and filter controls so you can narrow output without scrolling through thousands of lines. Matching highlights the terms in the stream you already have loaded. DockLog does not index logs into a separate search engine: search applies to the buffered and streamed content in the UI, not a cluster-wide historical query like Elasticsearch.

Question 33

Does DockLog support log auto-scrolling?

Accepted Answer

Live tails follow new lines as they arrive from Docker, similar to tail -f. You can pause auto-scroll when you need to read or copy a section without the view jumping. Re-enable follow when you want to stick to the end of the stream again. Reconnection logic handles brief network drops without losing your place in the session.

Question 34

Can I monitor hundreds of containers?

Accepted Answer

DockLog has no separate indexing layer to maintain, so a single instance on a reasonably sized host can list and manage large single-engine deployments. Performance depends on CPU, memory, and how many simultaneous log streams are open. Very large fleets across many hosts are better served by one DockLog per daemon today rather than one UI for everything.

Question 35

Can I disable destructive actions such as delete or restart?

Accepted Answer

In auth mode, container actions use two layers. First, enable the action on the server with ALLOW_START, ALLOW_STOP, ALLOW_RESTART, ALLOW_DELETE, or ALLOW_SHELL. Second, grant the matching can_* flag to each user in Admin, including administrators. Both must be true for the button to work. In no-auth mode, only the ALLOW_* environment variables apply. Leave either layer false to block that action entirely.

Question 36

Can I open a shell inside a container?

Accepted Answer

Interactive shell access is available in the browser terminal view when ALLOW_SHELL=true (or ALLOW_BASH=true) is set on the server and the user has can_shell in the database. This applies to every account, including admin. Shell sessions stream over WebSocket and are audited when auth mode uses a persistent database. Keep ALLOW_SHELL=false in production unless a specific workflow requires it, because shell access inside a container is high privilege.

Question 37

Does DockLog support dark mode?

Accepted Answer

The bundled Vue UI supports Auto, Light, and Dark themes. Auto follows your operating system preference. The marketing site defaults to light mode independently. Theme choice is stored in the browser for the dashboard and does not affect server-side configuration or other users on the same instance.

Question 38

Can I view container health check status?

Accepted Answer

Docker health check state is surfaced in the container list and detail views alongside status, uptime, and ports. You see the same healthy, unhealthy, or starting states that docker ps reports. DockLog does not define its own health probes; it reflects whatever healthcheck you configured in the image or compose file.

Question 39

How are user sessions managed?

Accepted Answer

After login, DockLog issues an access token (JWT, 24 hours) and a refresh token (30 days). Native clients can call POST /api/token/refresh with refresh_token to rotate both without re-entering credentials. Each API request re-validates the access token against the database for active status, admin flag, and password_version. Changing a password or deactivating an account invalidates existing sessions. Login attempts are rate-limited to ten failures per IP every fifteen minutes to slow brute-force attacks.

Question 40

What is CLIENT_ACCESS=strict?

Accepted Answer

In strict mode (the default with auth enabled), /api and /ws reject browser requests from arbitrary origins. The Vue web UI must send X-DockLog-Client: web with an Origin or Referer that matches the server or ALLOWED_ORIGINS. Native mobile clients authenticate with JWT and do not use browser Origin headers. Set CLIENT_ACCESS=off only for local debugging on a trusted machine, never on a production deployment.

Question 41

What does ENV=production do?

Accepted Answer

Setting ENV=production (or GO_ENV=production) enforces a non-default SECRET_KEY at startup and disables the localhost Origin bypass used during development. Combined with CLIENT_ACCESS=strict and HTTPS in front of the app, this is the baseline for a hardened deployment. It does not by itself configure TLS or firewall rules; you still need a reverse proxy and network controls.

Question 42

Can I download full container logs?

Accepted Answer

If your RBAC rules let you view a container, you can download its full log file from the UI instead of only watching the live stream. The download uses the same Docker log API as the viewer. In auth mode with auditing enabled, the action is recorded in the audit log so administrators know who exported logs.

Question 43

Does no-auth mode persist users or audit data?

Accepted Answer

With DISABLE_AUTH=true and no DB_PATH, DockLog uses in-memory SQLite. No users are created, and nothing survives a container restart. If you want persistence while skipping login, you can still set DB_PATH to a mounted volume, but the typical no-auth setup is intentionally ephemeral. Use auth mode with a file-backed database when you need accounts, RBAC, or audit history.

Question 44

Can I migrate DockLog to a new server?

Accepted Answer

Copy your docker-compose file (or run command), environment variables, and the data directory mounted at DB_PATH. The SQLite file carries users, RBAC rules, audits, and metric history. Update ALLOWED_ORIGINS and proxy settings if the public URL changes. On the new host, mount the same socket or DOCKER_HOST so DockLog sees the containers you expect.

Question 45

Does DockLog modify my containers?

Accepted Answer

DockLog is read-only toward your workloads until someone with permission performs an action. Viewing logs and metrics does not change container state. Start, stop, restart, remove, and shell commands only run when both server and user permissions allow them, and those actions are audited in auth mode. Your application images and compose files on disk are not edited by DockLog.

Question 46

Can I use DockLog in production environments?

Accepted Answer

Teams run DockLog in production for shared log access on staging and prod hosts. Enable auth, assign RBAC patterns per developer, turn on audit logging, and place the UI behind HTTPS with TRUST_PROXY and a strong SECRET_KEY. It is suited to operational visibility on a trusted Docker host, not as a replacement for centralized log analytics at very large scale.

Question 47

Does DockLog support container labels and metadata?

Accepted Answer

DockLog displays the metadata Docker returns from inspect: names, IDs, image, ports, labels, mount points, environment snippets, and health state where available. The container detail view consolidates this alongside live logs and actions. It does not add custom label-based filtering beyond what RBAC container patterns already provide. Anything missing in docker inspect will not appear in DockLog either.

Question 48

Does DockLog support alert rules?

Accepted Answer

Yes. Admins configure notification channels under Admin → Notifications, then create or enable rules under Admin → Alerts. Rules can monitor log patterns (for example repeated ERROR lines), Docker events (restart loops, OOM, unhealthy health checks), and CPU or memory thresholds. Each rule supports severity, container scope, cooldowns, and delivery to one or more webhook channels. Six starter rules ship disabled on a fresh install.

Question 49

Can I hide specific containers from the dashboard?

Accepted Answer

Set EXCLUDE_CONTAINERS to a comma-separated list of container names you want hidden from every user. The DockLog container itself is always excluded automatically (matched by name docklog or image containing docklog). This is useful for hiding infrastructure sidecars or internal services without changing per-user RBAC patterns.

Frequently Asked Questions