Self-hosted Docker log viewer · container monitoring · apt & dnf

DockBeacon

Docker log viewer and container monitoring tool — live logs, metrics, multi-host

Self-hosted Docker and PM2 logs without SaaS. Stream and merge container logs, follow PM2 apps on the same host, watch CPU and memory, and manage Compose stacks from one browser tab — instead of juggling SSH, docker logs, and pm2 logs.

Install in one command Read the guide Star on GitHub

Latest v0.7.0 amd64 · arm64 2026-10-02 

curl -fsSL https://dock-beacon.web.app/install.sh -o install.sh
sudo bash install.sh

Then open http://<host>:9447. The apt and dnf tabs only add the repo. Install details

Docker and PM2 logs, Diagnose, restarts, alerts, users, agents, compose stacks, and system status across servers, all in one browser tab. Open as GIF
  1. Merge logs
  2. Filter
  3. Collapse sidebar
  4. Diagnose
  5. Restart
  6. PM2 logs
  7. Alerts
  8. Alert channels
  9. Create user
  10. Add agent
  11. Compose & .env
  12. System status
  13. Switch host
Features

Everything you reach for at 2am

Built for people who run real Docker hosts — not another cloud dashboard.

⚡

Live log streams

WebSocket tails with pause, reconnect, time ranges, and multi-container merge.

{}

Pretty JSON

Toggle compact or indented JSON with bright syntax colors — regex search too.

⧉

Host groups

Merge agents into one view. Group prod hosts and follow them together.

▣

CPU & memory

Live stats beside the logs, with simple history sparklines.

⚙

Stacks + RBAC

Compose lifecycle, env edits, and viewer / operator / admin roles.

▶

PM2 logs

On hosts that already run PM2, Logs gains a Docker / PM2 switch. Stream stdout and stderr. Operators and admins can start, stop, or restart an app. Viewers cannot.

◔

System status

One click shows the selected server's CPU, memory, and disk: total, used, and free. Works for every agent too.

🔔

Alerts

Know when a container exits, turns unhealthy, crash-loops, or nears its memory limit, when a PM2 app errors or keeps restarting, and when a host runs hot or an agent goes quiet. Sent to Slack, Teams, Discord, or any webhook.

⏱

Timeline

What changed and when: starts, stops, crashes, health changes, and who restarted or redeployed what, for a container or a whole stack. Kept 14 days.

🩺

Diagnose

Why is it unhealthy? One click reads the health check, exit codes, restarts, memory, recent errors, and disk, and explains the likely cause in plain words.

📦

apt & dnf

systemd unit included. Open http://<host>:9447 with no TLS setup. Flip APP_MODE between standalone and agent.

Compare

Why not just docker logs?

It’s perfect — until your third SSH tab, second host, and first “wait, which terminal was prod?” moment.

docker logs

  • One container at a time, per host
  • Pipe to grep and start over when you get it wrong
  • JSON arrives as a wall of text
  • Separate window for docker stats
  • SSH into every machine

DockBeacon

  • Many containers, merged across hosts
  • Regex + level filters while streams keep running
  • Pretty JSON with syntax colors
  • CPU / memory charts next to the logs
  • One browser tab — UI + remote agents

Not competing with Loki or ELK on analytics — see where this fits.

Architecture

Control plane + agents

Multi-host log aggregation without standing up a centralized log-storage platform. Same package on every host — flip APP_MODE.

Browser One tab for logs, metrics, stacks, and RBAC
HTTP :9447 (lab / staging) · HTTPS reverse proxy (production)
Control plane Standalone UI + API · RBAC · host groups · session cookie
HTTP or HTTPS / WebSocket · each agent authenticates locally
Agent · prod-01Docker Engine
Agent · prod-02Docker Engine
Agent · prod-03Docker Engine
Where it fits

Not a Loki or ELK replacement

Use this when you need to see what is happening across Docker hosts right now, without building a full observability stack.

ToolBest for
docker logsQuick troubleshooting on one container
DozzleLightweight real-time container logs
PortainerFull container management UI
DockBeaconLive multi-host operations: Docker logs + PM2 logs + metrics + host status + Compose + RBAC. Installed as a systemd service with apt or dnf, no container needed
LokiCentralized log storage and query
ELK / OpenSearchLarge-scale log analytics and search
DatadogFull SaaS observability
Security

Stacks and env edits are privileged

If this is reachable on a production network, a stolen session is more than log access — operators can restart containers and edit Compose / .env. Treat it like a host admin tool.

Authentication

Login required. Passwords stored as bcrypt hashes. Sessions are HMAC-signed cookies: HttpOnly, SameSite=Lax, Secure via COOKIE_SECURE=auto (honors X-Forwarded-Proto), 24h TTL. Optional OIDC SSO. Login rate-limited. APIs also accept X-Auth-Token, Bearer, or HTTP Basic.

RBAC

  • viewer — logs, switch hosts
  • operator — container inspect, start / stop / restart containers and PM2 apps, Compose lifecycle, env edits, reveal secrets
  • admin — operators plus user management, alert settings, and audit tail

Agents

Sign in once on the control plane. Agents trust that session when AUTH_SECRET matches. Agents still require CORS_ORIGINS (fail closed when unset). There is no second login when you switch hosts.

HTTP + reverse-proxy HTTPS

Lab listens on LISTEN_ADDR=0.0.0.0:9447 by default. Production: LISTEN_ADDR=127.0.0.1 and terminate TLS on Nginx/ALB. No in-process TLS.

Docker socket

Packaged unit runs as docker-log-viewer in group docker (not root). Socket access is still full Engine power — optionally put docker-socket-proxy in front and set DOCKER_HOST.

Secrets in .env / inspect

Stack env keys matching password / token / key names are masked until revealed. Container inspect is for operators and admins, with env secrets masked until revealed. Writes stay under PROJECTS_DIR.

Alerts & webhooks

Only admins change alert rules and channels, and every change is audited. Webhook URLs are stored server-side (0600) and never sent back to the browser, only a short hint. Slack, Teams, and Discord must use https://. Messages carry names and states, never log lines or env values.

CSRF / CORS / sessions

Double-submit CSRF (dlv_csrf + X-CSRF-Token) on mutating cookie-auth requests. WebSocket Origin checked against CORS_ORIGINS. Password changes require the current password.

Audit + packages

Privileged actions append JSON audit lines (AUDIT_LOG_PATH, also journal). Admins can GET /api/audit. Package repos are GPG-signed when GPG_PRIVATE_KEY is configured in release CI; otherwise SHA256SUMS + inspect-then-install.

Roles table, service hardening, production checklist, and how to report a vulnerability: Read the full security page →

Production

Deploy it like a host console

Same binary everywhere: HTTP on :9447. Lower environments open that URL directly. Production adds TLS at Nginx / ALB in front.

  1. Network isolationSet LISTEN_ADDR=127.0.0.1 in production. Agents should not be reachable from the public internet — only from the control plane.
  2. Nginx / ALB + TLSTerminate HTTPS on the proxy and forward to 127.0.0.1:9447. Enable WebSocket upgrade for /wslogs and /ws/project/watch. Set COOKIE_SECURE=auto.
  3. systemdRuns as docker-log-viewer (not root), group docker. Config: /etc/docker-log-viewer/docker-log-viewer.env. Data: /var/lib/docker-log-viewer/.
  4. FirewallAllow 443 to the proxy. Allow control-plane → agent :9447. Block 9447 from untrusted networks.
  5. Auth & backupsSeed AUTH_USER/AUTH_PASS only on first boot, or configure OIDC. Back up /var/lib/docker-log-viewer/. Optional: docker-socket-proxy to shrink Engine API surface.
  6. UpgradesCommands in Upgrade. Env file survives and the service restarts on its own (v0.6.5+). Roll back from the package pool.

Step-by-step Nginx snippet and RBAC details: User guide → Production.

Install

Ship it to your hosts

apt or dnf, configure once, enable systemd.

Upgrade

Run on each server (control plane and every agent). Your settings in /etc/docker-log-viewer/docker-log-viewer.env are kept.

Ubuntu / Debian (apt)
sudo apt-get update && sudo apt-get install -y --only-upgrade \
  -o Dpkg::Options::=--force-confold docker-log-viewer
sudo systemctl enable --now docker-log-viewer
sudo systemctl restart docker-log-viewer
Amazon Linux / RHEL / Rocky / Fedora (dnf or yum)
sudo yum update -y docker-log-viewer
sudo systemctl enable --now docker-log-viewer
sudo systemctl restart docker-log-viewer
Or re-run the installer (keeps current settings)
curl -fsSL https://dock-beacon.web.app/install.sh -o install.sh && sudo bash install.sh
Check it is running
systemctl status docker-log-viewer --no-pager
curl -s http://127.0.0.1:9447/api/info

Asked about docker-log-viewer.env during apt upgrade? Press N (keep your version). The --force-confold flag above answers it for you.
502 or "site can't be reached" after upgrading from v0.6.4 or older? Those packages stopped and disabled the service while upgrading. Run sudo systemctl enable --now docker-log-viewer. From v0.6.5 on, upgrades restart it automatically.
PM2 tab empty after upgrade? sudo apt-get install -y acl (or sudo yum install -y acl), then sudo /usr/lib/docker-log-viewer/pm2-grant-access.

What's new

Latest notes on this package feed. How to upgrade.

  • v0.7.0
    • Alerts: get notified when a container exits unexpectedly, turns unhealthy, crash-loops, or nears its memory limit, when a PM2 app errors or keeps restarting, when host CPU, memory, or disk stays high, when Docker is unreachable, or when an agent stops answering. Admins set rules and channels in Settings → Alerts.
    • Alert channels: Slack, Microsoft Teams, Discord, or any JSON webhook, with a Test button, optional @here / @channel mentions, and Resolved messages. Webhook URLs stay on the server and are never shown again after saving.
    • Alerts button in the header shows how many alerts are new. Open it to see what is active (new ones tagged New) and recent history.
    • Diagnose: one click explains why a container is unhealthy from its health check, exit code, restarts, memory, recent errors, sibling containers, and host disk. Read-only, so viewers can use it.
    • Timeline: what changed and who did it. Container starts, stops, crashes, and health changes are recorded (kept 14 days, EVENTS_RETENTION_DAYS) and shown in Diagnose and System status, together with restarts, redeploys, and env edits from the audit log.
    • New DockBeacon logo across the app, browser tab, and website. Tidier header with an account menu (theme, settings, logout), and a slim icon rail when the sidebar is collapsed.
    • Log toolbar actions are grouped into Actions and More menus.
  • v0.6.54 changes
    • Upgrades no longer take the site down: older packages stopped and disabled the service during apt/yum upgrade (502 behind nginx). The service now restarts on its own after upgrading. Coming from v0.6.4 or older, run sudo systemctl enable --now docker-log-viewer once if it is still down.
    • The Update badge opens the new Upgrade section on the website with copyable apt and yum commands. The installer keeps your env file without the dpkg prompt.
    • The package now pulls in acl, so PM2 log access is granted during install and upgrade instead of failing with "setfacl is required".
    • System button in the header opens a System status panel: host CPU (usage, cores, load), memory (total, used, free, swap), and disk (total, used, free for / and the Docker data disk when separate). Refreshes every 5 seconds while open and follows the selected server.
  • v0.6.42 changes
    • Settings → Servers: admins can add, edit, and remove hosts for every user (saved on the server). Operators can still keep hosts in their own browser.
    • This server no longer appears twice behind an HTTPS proxy or under a URL prefix such as /dockbeacon.
  • v0.6.32 changes
    • Container Inspect is for operators and admins only. Viewers no longer see the button, and the server refuses /inspect for them.
    • The header shows an "Update" badge when a newer DockBeacon release is out, with its notes and the upgrade command. Turn off with UPDATE_CHECK=false.
  • v0.6.23 changes
    • One-step installer (install.sh) for apt and dnf hosts: installs or upgrades, asks standalone or agent, writes the env file, starts the service, and prints the URL.
    • Container start, stop, and restart use the same confirmation box as PM2. Viewers still cannot run those actions.
    • PM2 status and actions work under the packaged systemd unit: pm2-grant-access now lifts NoNewPrivileges on PM2 hosts, and the helpers find node for nvm installs.
  • v0.6.11 change
    • Optional BASE_PATH so DockBeacon can be served at /dockbeacon/ when another application already uses /.

One-step install

Ubuntu, Debian, Amazon Linux, RHEL, Rocky, Fedora. Detects apt, dnf, or yum.

Download, inspect, run
curl -fsSL https://dock-beacon.web.app/install.sh -o install.sh
less install.sh
sudo bash install.sh

Adds the repo, installs or upgrades docker-log-viewer, then asks: standalone (web UI) or agent (API for a control plane), server name, port, direct or behind nginx, and an optional URL prefix such as /dockbeacon. Agents also ask for the control plane URL and its signing secret. It writes the env file (keeping a backup), grants PM2 access when PM2 runs, starts the service, checks it answers, and prints the URL, the first admin password, and an nginx block when needed. Re-run it to upgrade; current settings are the defaults.

Unattended (agent example)
curl -fsSL https://dock-beacon.web.app/install.sh -o install.sh
sudo DLV_YES=1 DLV_MODE=agent DLV_SERVER_NAME=worker-1 \
  DLV_CONTROL_URL=https://logs.example.com \
  DLV_AUTH_SECRET='<control plane secret>' bash install.sh

Package managers

Quick install adds the repo. Inspect the script first on production hosts.

Debian / Ubuntu · quick
curl -fsSL https://govindsingh9447.github.io/docker-log-viewer-packages/install-apt.sh | sudo bash
sudo apt-get install docker-log-viewer
Inspect, then run
curl -fsSL https://govindsingh9447.github.io/docker-log-viewer-packages/install-apt.sh -o install-apt.sh
less install-apt.sh
sudo bash install-apt.sh
sudo apt-get install docker-log-viewer
Manual sources.list
echo 'deb [trusted=yes] https://govindsingh9447.github.io/docker-log-viewer-packages/apt stable main' | sudo tee /etc/apt/sources.list.d/docker-log-viewer.list
sudo apt-get update
sudo apt-get install docker-log-viewer

Packages are GPG-signed when the release pipeline has GPG_PRIVATE_KEY configured (install scripts use signed-by / gpgcheck=1). Always verify SHA256SUMS.txt. Public key: KEY.gpg (present on signed publishes).

Configure & run

Config survives upgrades (noreplace).

First boot
sudo nano /etc/docker-log-viewer/docker-log-viewer.env
# APP_MODE=standalone   # or agent
# SERVER_NAME=my-host
# PROJECTS_DIR=/home/ubuntu/backend
# PORT=9447

sudo systemctl enable --now docker-log-viewer
# lab / staging:  http://<host>:9447
# production:     https://logs.example.com  → proxy → 127.0.0.1:9447

Private source. This site hosts packages. Collaborators with repo access can also use gh release download.

Docker logs monitoring FAQ

Common questions about DockBeacon as a Docker log viewer and container monitoring tool.

What is the best self-hosted Docker log viewer?

DockBeacon is a lightweight self-hosted Docker log viewer and container monitoring tool. It streams live logs from many containers, shows CPU and memory metrics, and manages Compose stacks from one browser tab — without a SaaS account.

How do I monitor Docker container logs in real time?

Install DockBeacon with apt or dnf, open the web UI on port 9447, select containers, and start a live stream. Filter by regex or log level, and optionally merge logs across hosts with agents.

Can DockBeacon send Docker alerts to Slack, Teams, or Discord?

Yes. DockBeacon checks every host every 30 seconds and alerts when a container is unhealthy, exits unexpectedly, crash-loops, or nears its memory limit, when a PM2 app errors or restart-loops, when host CPU, memory, or disk stays high, or when Docker or an agent goes down. Alerts go to Slack, Microsoft Teams, Discord, or a generic JSON webhook. See the alerts guide.

Is DockBeacon a replacement for Loki or ELK?

No. DockBeacon is for live operations — what is happening on your Docker hosts right now. Loki and ELK are better for long-term log storage and analytics.

Does DockBeacon support multi-host Docker monitoring?

Yes. Run a standalone UI on one host and optional agents on others, then switch hosts or merge container logs and metrics in one console. One login covers every agent that shares AUTH_SECRET.

Can DockBeacon show PM2 logs?

Yes, on a host that already runs PM2. Logs shows a Docker / PM2 switch. Stdout and stderr stream in the same pane. Operators and admins can start, stop, or restart an app that is already in the list. Viewers can only read logs. DockBeacon does not start a PM2 daemon. After install, run sudo apt-get install acl and sudo /usr/lib/docker-log-viewer/pm2-grant-access so the service user can read those logs.

Start watching your containers

One install. No SaaS account. Logs stay on your network.

Install DockBeacon