Dozzle

The stack

Generated output

services:
  dozzle:
    image: docker.io/amir20/dozzle:v10.6.2@sha256:dac897ce93cbc0db48d9a6014ba24fb9438edc95c27e283a6fcc9260ea474d6d
    restart: unless-stopped
    environment:
      DOZZLE_ADDR: :8080
      DOZZLE_NO_ANALYTICS: "true"
      DOZZLE_AUTH_PROVIDER: ${DOZZLE_AUTH_PROVIDER}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

# Caddyfile for Dozzle
# Replace dozzle.example.com with your real domain. Caddy issues TLS automatically.

dozzle.example.com {
	encode zstd gzip
	reverse_proxy dozzle:8080
}

# Traefik labels for Dozzle
# Merge into the dozzle service in docker-compose.yml.
# Assumes an external Traefik network named "proxy" and a
# certresolver named "letsencrypt". Replace dozzle.example.com.

services:
  dozzle:
    labels:
      traefik.enable: "true"
      traefik.http.routers.dozzle.rule: Host(`dozzle.example.com`)
      traefik.http.routers.dozzle.entrypoints: websecure
      traefik.http.routers.dozzle.tls: "true"
      traefik.http.routers.dozzle.tls.certresolver: letsencrypt
      traefik.http.services.dozzle.loadbalancer.server.port: "8080"
    networks:
      - proxy
      - default
networks:
  proxy:
    external: true

Replace dozzle.example.com with your domain. Generate secrets below.

Environment

.env with generated secrets

# Built-in authentication mode. `none` (default) means Dozzle does no login of its own and you rely on the reverse proxy for access control. Set to `simple` to enable Dozzle file-based users (you must also mount a users.yml, generated with `dozzle generate` — see the docs), or `forward-proxy` to trust an upstream authenticating proxy. No secret is generated here.
DOZZLE_AUTH_PROVIDER=none

Requirements

Before you start

• Docker 24+ and Docker Compose v2 on the host — Dozzle reads the local Docker daemon.
• Read access to the Docker socket at `/var/run/docker.sock`, mounted read-only. This lets Dozzle see and stream the logs of every container on the host; treat that visibility as sensitive (see the limitations).
• 128 MB RAM is plenty — Dozzle is a single small Go process and stores nothing of its own.
• A reverse proxy with authentication in front of it. Dozzle exposes all container logs, so do not bind it to the host or publish it openly.

Deploy

How to deploy

1. Decide on authentication. The default `DOZZLE_AUTH_PROVIDER=none` does no login inside Dozzle, so you must add auth at the reverse proxy. Alternatively set it to `simple` for Dozzle built-in users (which also needs a mounted `users.yml`; see the Dozzle docs).
2. Start the stack: `docker compose up -d`.
3. Open `https://dozzle.example.com`; live logs for every container on the host should start streaming immediately.
4. Confirm access is gated before exposing it. Because Dozzle can read all container logs, never publish it without authentication — keep it behind the proxy and add a login layer.
5. Leave the Docker socket mounted read-only (`:ro`). Dozzle only reads; it never needs write access to the daemon.

Errors

Common errors & fixes

Limitations

Honest limitations

• Read-only, but still powerful. The socket mount lets Dozzle read the logs of every container on the host, and logs routinely contain tokens, connection strings, and personal data. Read-only stops Dozzle from changing anything, but it does not hide log contents — protect access accordingly.
• No long-term log storage. Dozzle shows what Docker currently retains in its logging driver; it does not archive logs. Rotated or dropped logs are gone from Dozzle too.
• No alerting or notifications. Dozzle is for watching and searching live logs, not for triggering on patterns — pair it with a real log and alerting pipeline if you need that.
• Container control is intentionally absent here. Because the socket is mounted read-only, Dozzle cannot stop or restart containers; use a manager like Dockge, which takes a read-write socket, for that.

FAQ

Frequently asked

Related

Related stacks