FR
live

Your Docker logs deserve better than docker logs -f in an SSH terminal

Dozzle weighs 4 MB, stores nothing, and streams Docker logs in real time from your browser. v10.6.13 shipped July 27, 2026 with an adaptive ANSI palette and an embedded SQL engine: if your only log tool is still the terminal, you’re bleeding time every single day.

Dozzle, real-time Docker log viewer in 4 MB — ETTAYEB illustration

Dozzle just shipped version 10.6.13 on July 27, 2026, three days after introducing a theme-aware ANSI color palette and an in-browser SQL query engine powered by DuckDB. The project has crossed 13,800 GitHub stars and 186 million Docker pulls. Its compressed image is 4 MB — not 40, not 400. The Dockerfile weighs less than a vacation photo.

Here is the ugly truth about Docker logs in 2026: most people still SSH into a server, run docker ps to find a container name, then docker logs -f and squint at a monochrome wall of text. It works for one container on a quiet afternoon. It falls apart the moment you need to search, filter, compare two containers side by side, or screenshot a stack trace for a teammate. Dozzle fixes this with a brutal simplicity that is rare in the self-hosting world: no config, no storage, one docker run command, done.

What Dozzle does — and what it won’t do

Dozzle is a real-time log viewer, not a container management platform. It mounts /var/run/docker.sock read-only, streams logs through the Docker API, and renders them in a reactive web UI. No database. No config file. No retention. The tool stores nothing — it only broadcasts.

The difference from log aggregators like Loki, Elasticsearch, or Graylog is stark: those platforms index and persist logs for historical search, which requires storage, index maintenance, and operational overhead. Dozzle does instant visualization only — and that is why it fits in 4 MB. This distinction matters when you pick your tooling: Dozzle is the daily debugging companion, not the SIEM for your infrastructure.

Here is how the two philosophies compare:

NeedDozzlePortainer (covered separately)Loki/Graylog/ELKReal-time log viewing✅ 4 MB, zero config✅ built-in✅ after setupContainer/image/network management❌ by design✅ core product❌Historical search❌ no storage❌ limited✅ full indexingLog pattern alerts✅ webhooks/Slack/Discord❌✅Docker image size4 MB39 MB200 MB – 2 GBTime to first logdocker rundocker run30 min – 2 h

Dozzle and Portainer are not competitors — they are complementary. Portainer manages your containers; Dozzle reads their logs. In a well-equipped homelab, both run side by side.

One command, and you are done

Dozzle has no exotic prerequisites: Docker Engine 19.03 minimum (API 1.40+), released in July 2019. Any machine running Docker today is compatible.

bash
docker run -d \
  --name dozzle \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -v dozzle_data:/data \
  -p 8080:8080 \
  amir20/dozzle:latest

The dozzle_data:/data volume is optional but recommended — it persists notification and alert configurations across container restarts. Without it, any alert rule you create in the UI vanishes on the next docker rm.

Docker Compose for those who version their stack:

yaml
services:
  dozzle:
    image: amir20/dozzle:latest
    container_name: dozzle
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - dozzle_data:/data
    ports:
      - 8080:8080
    environment:
      # - DOZZLE_ENABLE_ACTIONS=true  # start/stop/restart containers
      # - DOZZLE_ENABLE_SHELL=true    # shell access inside containers
      # - DOZZLE_AUTH_PROVIDER=simple  # authentication
      # - DOZZLE_FILTER=label=com.example.app  # limit visible containers

volumes:
  dozzle_data:

Security note: mounting docker.sock gives Dozzle root-equivalent access to the host. If you expose the UI beyond your LAN, enable authentication (DOZZLE_AUTH_PROVIDER=simple) or put Dozzle behind a reverse proxy with upstream auth — Authelia, Authentik, or plain Traefik with a basicAuth middleware all work.

What v10 brought to the table

The v10 branch, marked major since early 2026, transformed Dozzle from a simple log viewer into a full debugging workstation. Here is what shipped recently and what actually matters:

  • Embedded SQL engine via DuckDB + WebAssembly (v10.5+) — query recent logs with real SQL in your browser, no backend, no index. SELECT * FROM logs WHERE message LIKE ’%panic%’ AND container = ’api’ runs entirely client-side.
  • Theme-aware ANSI palette (v10.6.11, July 20, 2026) — application log colors (red for ERROR, yellow for WARN) adapt automatically to light or dark mode.
  • Cmd+K command palette (v10.6.12, July 26, 2026) — full keyboard navigation, switch containers without touching a mouse.
  • Alerts and webhooks — match log patterns with powerful expressions and notify Slack, Discord, ntfy, or any HTTP endpoint.
  • Multi-host with TLS agents — connect multiple remote Docker daemons from a single UI, encrypted end to end.

The project is maintained by Amir Raminfar, a solo developer shipping almost weekly — 6,500 commits and counting, a release cadence that is remarkable for a tool this size. Dozzle is part of the Docker Sponsored OSS program, and its codebase is pure Go on the backend with a Vue.js frontend, licensed under MIT.

Dozzle vs docker logs -f — the daily delta

Let us walk through a typical day for a homelabber running a dozen containers. A 502 error on the reverse proxy, a container in a restart loop, a cron job that did not fire.

With the terminal:

  1. docker ps to find the container name
  2. docker logs nginx-proxy —tail 200 for context
  3. docker logs nginx-proxy -f | grep error to filter live
  4. Repeat for the application container
  5. docker stats in a separate window to check CPU

With Dozzle:

  1. Open the UI — the crashing container is highlighted in red
  2. Click it — logs stream in real time
  3. Type /panic in the search bar
  4. Open a split-screen panel to compare with another container
  5. CPU and memory stats sit in the sidebar

The win is not dramatic for a single incident. It compounds with repetition: the more often you debug, the faster Dozzle pays back its nonexistent setup cost.

The bottom line: who needs this, and who doesn’t

Dozzle does not replace Loki or Portainer. It replaces docker logs -f in an SSH terminal you have had open for twenty minutes. If you run fewer than five containers on a single box and touch them once a month, the terminal is fine.

If you have a homelab with more than five containers, if you debug multiple times a week, or if you share log access with someone else in your household or team: install Dozzle. One command, 4 MB of bandwidth, and you will never go back to the terminal for log reading.

For teams that need history, indexing, and legal retention, the answer remains Loki + Grafana — but that is a different time budget. Dozzle covers the most common use case (what is happening right now in my containers?) and stops exactly where complexity begins. That is engineering discipline, not a technical limitation.

References

The cyber brief, every Tuesday

The flaws that matter and the patches to apply, in a ten-minute read.

No spam. One-click unsubscribe.
read next

On the same topic

Immich replaces Google Photos once you budget for a mini PC and real backups

Immich shipped version 3.0 on 2 July 2026, nine months after its first stable release and weeks after a two-year retrospective on its backing by nonprofit FUTO. It replaces Google Photos once you can afford roughly $300 of hardware and a disciplined off-site backup — skip either, and the migration trades Google’s reliability for a real chance of losing everything.

Coolify gives you a free Vercel on your own server in one command

Coolify shipped version 4.2.0 on July 21, 2026, and now sits at 59,800 GitHub stars. This open-source PaaS deploys your apps, databases, and 280 services to any Linux server with a single click — no per-GB billing, no bandwidth caps, no lock-in.

← Back to the feed

Type at least two characters.

navigate open esc dismiss