Dozzle

Last reviewed Aug 26, 2026 · 837 words

Dozzle is docker logs -f with a browser, search and every container in one tab, and it costs 32 MB of RAM and 1 volume mount. It does not store anything. That is the feature and the limit in one sentence: if you want to look at what a container is saying right now, nothing is faster to deploy; if you want to know what it said last Tuesday, you need something else in the stack.

The entire setup is one socket mount

services:
  dozzle:
    image: amir20/dozzle:latest
    ports:
      - "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    restart: unless-stopped

Open port 8080 and every container on the host is listed down the left, live-tailing on click, with regex search, per-container CPU and memory graphs, and a split view for watching two at once. There is no database and no configuration file; the Docker socket is the only source of truth. That also means Dozzle can only see what docker logs can see. If you have switched the daemon's logging driver to syslog or shipped logs straight to a collector, docker logs returns nothing and so does Dozzle. Stick with the default json-file driver, or local, and cap it in /etc/docker/daemon.json with "max-size": "20m" and "max-file": "5" so a chatty container cannot fill the disk.

Several hosts, one page, without opening the socket to the network

The first instinct for a second host is DOZZLE_REMOTE_HOST=tcp://host2:2375, which requires exposing the Docker API over TCP. Do not. Exposing the socket over the network unauthenticated is root on that machine for anyone who can reach the port. Dozzle's answer is agent mode: run amir20/dozzle with the agent command on each remote host, mounting its local socket read-only and listening on 7007, then point the main instance at it with DOZZLE_REMOTE_AGENT=host2:7007. The agent speaks Dozzle's own protocol, can sit behind a VPN like Tailscale, and the hosts appear as a dropdown in the UI. Five hosts and 100 containers is a routine setup; the thing on screen is still just a stream.

Put a password on it before anything else

By default Dozzle has no login, and a page that shows the stdout of every service you run will eventually print a token, a database URL or a customer's email. Two options. DOZZLE_AUTH_PROVIDER=simple with a users.yml in a mounted /data directory gives you local accounts with bcrypt hashes, generated by dozzle generate. DOZZLE_AUTH_PROVIDER=forward-proxy trusts headers from an authenticating reverse proxy, which is the right choice if you already run Authentik or Authelia in front of everything. Either way, keep the socket mount :ro. Dozzle never needs write access, and a read-only socket cannot be used to start a privileged container if the UI is ever compromised. DOZZLE_FILTER=name=prod- is a cheap extra: it hides containers whose names do not match, useful when one host mixes work you want visible with work you do not.

It will never be your log archive, on purpose

The catalogue lists "no long-term log storage" as a con. I would call it scope. Dozzle's maintainer has consistently kept it a viewer, and that restraint is why it stays at 32 MB and never needs a migration. The moment you need retention, correlation across time, or alerting on log lines, pair it with Loki fed by Promtail or Alloy and query in Grafana. Dozzle stays as the "what is it doing right now" tab, which in practice is 90% of the times I open a log at all. For "is it up" rather than "what is it saying", Uptime Kuma is the companion; my homelab monitoring write-up covers how those pieces divide the work.

Docker only, and that includes Swarm

Dozzle reads the Docker API, so Docker Swarm services work and show as grouped stacks. Podman works if you expose its Docker-compatible socket. It is not a general log viewer for systemd units, files on disk or a Kubernetes cluster you are not running through the Docker socket; for those, reach for Loki or Beszel for host-level metrics with a similarly small footprint. Fourteen thousand stars for a tool that does exactly one thing tells you how often that one thing is the thing people need.

What I'd do

Deploy it on every Docker host on day one, socket read-only, behind the same forward-auth proxy as everything else, with agents rather than TCP for the remote hosts. Cap the json-file driver in daemon.json so logs rotate. Add Loki only when I catch myself wishing I could see yesterday, which for a small stack takes months. Total cost is a compose stanza and about a minute; the return is never again running docker ps to remember a container name before tailing it.