# Dozzle

## Overview

Dozzle is a lightweight, real-time log viewer for Docker containers. It provides a
web UI to stream, search, and follow container logs without needing to SSH into the
host and run `docker logs`. It is configured to monitor containers on both
Centerpoint and Lusankya (the second homelab server at `192.168.1.114`).

## Access

| Type      | URL                            | Notes                             |
|-----------|--------------------------------|-----------------------------------|
| Internal  | `https://dozzle.home.local`    | LAN access via Step-CA TLS        |

No external (internet-facing) Traefik route — LAN and Tailscale access only.

## Configuration

**Image:** `amir20/dozzle:latest` (v10.6.0 at time of writing)
**Compose project:** `dozzle` (managed via Portainer)

### Environment Variables

| Variable                | Value                                            | Purpose                              |
|-------------------------|--------------------------------------------------|--------------------------------------|
| `DOZZLE_HOSTNAME`       | `Centerpoint`                                    | Display name for the local host      |
| `DOZZLE_REMOTE_HOST`    | `tcp://192.168.1.114:2375\|Lusankya`             | Adds Lusankya as a remote Docker host |
| `DOZZLE_ENABLE_ACTIONS` | `false`                                          | Disables container start/stop from UI |
| `DOZZLE_ENABLE_SHELL`   | `true`                                           | Enables shell access to containers   |

> `DOZZLE_ENABLE_SHELL=true` allows executing shell commands inside any container
> from the Dozzle UI. This is a powerful capability — ensure Dozzle is not accessible
> externally.

### Traefik Labels

```yaml
traefik.enable: "true"
traefik.http.routers.dozzle.rule: Host(`dozzle.home.local`)
traefik.http.routers.dozzle.entrypoints: websecure
traefik.http.routers.dozzle.tls.certresolver: step-ca
traefik.http.services.dozzle.loadbalancer.server.port: 8080
```

Internal-only route. No Authentik ForwardAuth on this route — access is controlled
at the network level (LAN + Tailscale only).

## Volumes / Bind Mounts

| Host Path              | Container Path         | Purpose                          |
|------------------------|------------------------|----------------------------------|
| `/var/run/docker.sock` | `/var/run/docker.sock:ro` | Read-only Docker socket access |

Dozzle mounts the Docker socket read-only. No persistent data volume is required —
Dozzle streams logs directly from the Docker daemon and does not store them.

## Networks

| Network       | Purpose                         |
|---------------|---------------------------------|
| `traefik-net` | Exposes the Dozzle web UI       |

## Remote Hosts

Dozzle connects to Lusankya's Docker daemon at `tcp://192.168.1.114:2375`. This
requires Lusankya's Docker daemon to have TCP exposure enabled. Logs from both
Centerpoint and Lusankya containers are visible in a single Dozzle instance.

## Dependencies

- Docker socket on Centerpoint (`/var/run/docker.sock`)
- Lusankya Docker daemon accessible at `tcp://192.168.1.114:2375`
- Traefik on `traefik-net` for the `dozzle.home.local` route

## Notes / Gotchas

- `DOZZLE_ENABLE_SHELL=true` gives the ability to `exec` into any container from
  the browser. Treat this with the same care as SSH access to the host.
- Dozzle does not persist logs. Once a container is removed, its historical logs
  are no longer accessible from Dozzle (use `docker logs` or a log aggregation stack
  for archival).
- The `latest` image tag tracks the latest release. Dozzle updates frequently — check
  the changelog before pulling, especially for breaking UI changes.
- Lusankya's Docker TCP port (`2375`) is unencrypted. This is acceptable on the
  private LAN but should never be exposed externally.

---
*Last Updated: 2026-06-16*