ctop

Last reviewed Aug 26, 2026 · 858 words

docker stats is what ctop replaces, and it replaces it well. Both show live CPU, memory, network and block I/O for every running container, but docker stats is an unsorted scrolling table and ctop is an interactive, sortable, colour-coded screen with a drill-down menu that can tail logs, open a shell, or stop the container from the same keyboard. It is a single static Go binary with a 32 MB memory footprint and no configuration file. The catalogue's "zero-config overview" is precise: you type ctop, you see your host.

Install: one binary, or one Docker command

On the host, download the release binary for your architecture from the project's GitHub releases, drop it in /usr/local/bin, and mark it executable. Debian and Ubuntu users can also find it in some third-party repos, and Homebrew has it on macOS. If you would rather not put anything on the host at all:

docker run --rm -ti \
  --name ctop \
  -v /var/run/docker.sock:/var/run/docker.sock \
  quay.io/vektorlab/ctop:latest

Either way it talks to the Docker socket, so it needs to run as root or as a user in the docker group. Mounting the socket into a container grants that container root-equivalent access to the host, which is fine for an interactive tool you run and exit, and worth remembering before you leave anything like it running permanently. The container security guide covers the socket question properly.

What the screen tells you and what the keys do

The main view is one row per container: name, CPU percent, memory used against its limit, network in and out, block I/O read and write, and process count. Stopped containers show too, dimmed, which is useful when something has crashed and you are trying to work out which. The keys that matter:

s opens the sort menu, and sorting by memory is the single most useful thing ctop does on a crowded host. f filters by name. Enter on a container opens a menu with logs, exec shell, stop, start, remove, and pause. l jumps straight to a log tail. H toggles the header, q quits. On a Raspberry Pi running 20 containers, "which of these is eating the 4 GB" goes from a minute of squinting at docker stats to a keypress.

The single-container view expands the row into per-second graphs for CPU and memory, which is enough to watch a leak grow or confirm that a media server transcode is the reason the fans came on.

What it deliberately does not do

ctop keeps nothing. Close it and the numbers are gone. There is no history, no alerting, no web page to open from your phone, and no way to answer "what was memory doing at 3 a.m." That is a design choice, not an omission, and it is why the monitoring category still needs a second tool. For history and dashboards, Netdata gives you per-container charts with a year of retention and an install as simple as ctop's; the Prometheus and Grafana stack is the heavier, more flexible version of the same idea.

It is also Docker-focused. It reads runc containers and has had experimental support for other runtimes, but if your workloads are on Podman or Kubernetes you will be reaching for podman stats or kubectl top instead. And it is terminal only, which is the catalogue's other con and my favourite feature: it works over SSH from anything, including a phone, with no port to expose.

The pair it belongs in

The tools that sit naturally next to ctop are the other terminal-first container utilities. Lazydocker is the closest sibling: a fuller TUI that shows logs, compose projects, images and volumes alongside stats, at the cost of being busier. I use ctop when the question is "what is hot right now" and Lazydocker when the question is "what is on this box at all". Dozzle is the web equivalent for logs only, handy when the person asking is not on SSH. Glances is the host-wide top replacement that happens to include a container section, if you want one screen for the machine and the containers together.

One caution on the project itself. It is mature and works reliably against current Docker releases, but its development pace has been slow for a while and releases are infrequent. That is fine for a tool this small and this finished. It is not something I would expect new features from.

What I'd do

Put the binary on every Docker host, alias docker stats to it, and forget about it until something is slow. Run Netdata alongside for the history and the alerts, because ctop answers "now" and nothing else. Do not mount the socket into a long-running container just to have ctop available; SSH in and run it. For a tool that costs 32 MB and 30 seconds to install, it has saved me more diagnostic time per byte than anything else in the stack.