Docker Commander

by koduj-dev

Not rated
GitHub

About

Secure Docker monitoring and management MCP server for containers, logs, alerts, diagnostics, and safe control across local and remote hosts.

Details

Author
koduj-dev
Categories
Developer Tools

Setup

Install Docker Commander in your MCP client (Claude Desktop, Cursor, Windsurf, and others).

Repository: https://github.com/koduj-dev/docker-commander

Follow the installation instructions in the repository README, then restart your MCP client.

A self-hosted, open-sourceDocker monitoring & control panelwith an enterprise-grade UI — monitor containers in real time, control their full lifecycle, browse logs and files, manage images, networks and volumes, alert on problems, and administer it all from one binary.

One Go binarywith the web UI embedded. No external database, no runtime dependencies, CGO-free. Runs onLinux, macOS and Windows.

🌐docker-commander.app— the project's home page. ·Documentation·Releases·Sponsor

Dashboard— host overview, disk usage, and running containers at a glance.

Container detail— live CPU / memory with history, and tabs for logs, an interactive console, processes, the file browser, filesystem changes and env.

Aggregated logs— many containers in one stream, color-coded by source with level filters, regex search and structured parsing.

- LiveCPU / memory graphsover WebSockets andhistorical charts(Redis or in-memory).
- Dashboardthat updates in near real time (Docker events stream): host facts, disk usage, aresource breakdown(each container's share of host CPU/memory plus host-widenetwork throughput), and aport scanthat fingerprints what's actually listening.
- Network telemetry— per-containerRX/TX rate(derived, so a counter reset on recreate reads as a gap rather than a spike), totals,packets / dropped / errorsand the per-interface breakdown, plusendpoint totalson a network's detail — labelled for what they are, since Docker reports no per-network counters.
- Logs— per-container tail, plus a globalaggregatedview with level detection,regex searchand savedparsing rulesthat turn lines into structured columns.
- Liveeventsfeed, containerdiff/top,disk usage, and raw JSONinspectfor any object.
- Networks & topology— an interactive containers ↔ networks graph (force-directed, pan / zoom / fullscreen,search,filter by compose stack) with a compactlist view(state, image, stack, ports, networks).

- Containers:create/run, start/stop/restart/pause/unpause/kill,rename,updatelimits & restart policy,committo an image, an interactiveshell(xterm.js), andbulk restart/stopacross a multi-selection (preview, confirmation, bounded parallelism, per-container success/failure summary).
- File browserinside containersand volumes— list, download, upload (incl.upload & extracta.zip/.tar/.tar.gz), delete, create folders.
- Images: pull (live progress), build, push, tag, save/load/import, history, prune, andvulnerability scanning(Trivy — severity summary + CVE table).
- Volumes & networks: list, inspect, create, remove, prune; networks alsoconnect / disconnectcontainers, with a per-network detail (graph or list).
- Compose— discover & manageStacksby label (CLI-created ones too: start/stop/restart/remove, andedit their compose file in place on the host, then redeploy— kept where it lives, so relative bind/env_file/build.contextpaths still resolve), andProjects: managed composefoldersedited in a built-incode editor(CodeMirror) withlive, inline validation— compose (anchors/${VAR}-aware),Dockerfile(docker build --check), YAML/JSON/.env— plus aResolvedpreview, a services/portsSummary,templates,schema-aware Compose autocompleteandimage-name / tagsuggestions (local, Docker Hub, and configuredprivate registries), anddeploy via thedocker composeCLIwithprofiles(the summary badges each service's real state, and clearly separates what'scurrently deployedfrom what'sselected for the next deploy, so a profile-excluded service reads as such — not as stopped) and.zipimport/export — to thelocal or a remote host(a remote deploy copies the project's bind-mounted configs/scripts into volumes on that host, andbuild:contexts are uploaded with the build; a redeployrebuildsan edited image).

- Managelocal,TCP(+TLS)andSSHdaemons; SSHhost keys are verified(known_hosts / trust-on-first-use). Every view rebinds to the selected host, and the alert engine watchesallhosts. A per-hostdetailpanel shows the hardware / OS / engine, and a host can bedisabledto take it out of monitoring (e.g. an offline laptop).

- Rules onstate,resource thresholds,log patternsandrestart/crash-loops— editable, with severity & cooldown.
- Threshold alerts areconditions with a lifetime(firingescalated/easedresolved), one per container + metric, so overlapping rules produce one incident instead of one each — and the feed is server-sidepaged, filtered and sorted, withwho acknowledgedit and everydelivery attemptrecorded against it.
- Notify viawebhooks,email (SMTP, per-host routing), an in-app feed, and aPrometheus/metricsexporter. Rulesimport/exportas a portable JSON bundle.

- An optional,off-by-defaultModel Context Protocolserver lets AI tools (Claude Code,Claude Desktop,Cursor)monitor andsafelyoperateDockeras you: read tools (containers, logs, images, projects, stats, events, audit…),diagnostics without a shell(docker top/diff, cross-container log search), thealertsurface (history, what is firingnow, rules, whether an alert was actually delivered, acknowledge), andsafecontrol (start/stop/restarta container or a wholestack,deploy/downa project — including one targeting aremote host— plus apreviewof what a deploy would change and aTrivy image scan), with MCPresources&prompts.
- Authenticate with abearer API token(self-service page) orOAuth 2.1(PKCE, dynamic client registration). Every call reuses the app'sRBAC, and a token can onlynarrowyour rights (a subset of your sections and of thehostsyou reach, plusread-only). New tokensexpire after 30 daysby default (admin-configurable, with never-expiring tokens off unless enabled).Changes are rate limited(30/min per user; reads are not) so a model stuck in a loop — or a stolen token — is bounded to a few containers rather than your whole estate, and hitting that ceiling is audited. Deliberatelyno exec / image export / file read / prune / remove. See
MCP.

- Single CGO-free binary, embedded UI, systemd unit, config file,native HTTPS(built-in--make-certsself-signed cert helper, or behind a proxy),/healthzprobe, and structured alert logging to the journal/syslog. See[Deployment.
- Self-update— aone-tap in-app update & restartfor admins (and an "update available" banner), plus thedockercmd --self-upgradecommand (SHA-256-verified, atomic binary replace).

React + TypeScript SPA ──REST──▶ Go backend ──Docker Engine API──▶ dockerd (Tailwind, Recharts) ◀─WebSocket (live stats + logs)─┘

The Go server embeds the built SPA (go:embed) and serves everything from one origin, so the production artifact is a single executable.

The app talks to Docker two ways: theEngine APIthrough the official Go SDK, and thedocker composeCLIas a subprocess for project deploys. Both move, and you run whatever your distro ships — so here is what is actually tested, not what is hoped for.

The SDK callsWithAPIVersionNegotiation(), so a newer client speaks whatever the daemon understands — you do not need to match versions. Below API 1.43 the app is neither tested nor claimed to work.

No reviews yet — be the first

Sign in to leave a review

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.