See your Docker stack instead of listing it.
DockScope draws your containers as a live 3D dependency graph, then lets you dig into any one of them: logs, metrics, a shell, and a guess at why it died.
You need Docker running. That is the only prerequisite. Either command below serves the dashboard at http://localhost:4681, with nothing to configure and no account to make.
The image is published at ghcr.io/manuelr-t/dockscope.
docker run --name dockscope --restart unless-stopped -p 4681:4681 \
-v /var/run/docker.sock:/var/run/docker.sock \
-v dockscope-data:/data \
ghcr.io/manuelr-t/dockscopedocker-compose.yml
services:
dockscope:
image: ghcr.io/manuelr-t/dockscope
container_name: dockscope
restart: unless-stopped
ports:
- '4681:4681'
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- dockscope-data:/data
volumes:
dockscope-data:dockscope-data is what keeps your access token and installed plugins. Without
it they sit in the container's writable layer and vanish the next time you
recreate the container, pulling a new image for instance. See
Where state lives.
Compose project management (up and down) is the one feature unavailable in a container, since it cannot reach your host's compose files.
No container, and it opens your browser for you:
npx dockscope upOr npm install -g dockscope for a permanent dockscope command. This route
can manage Compose projects, since it runs on the host. Every flag it takes,
including -H to point at a remote Docker daemon, is in
dockscope up options.
Containers are spheres, coloured by health and wired together by depends_on
arrows and shared networks. Size is not decorative: it scales with how central a
container is, so the thing everything leans on is visibly the biggest. Compose
projects sit in their own enclosure, so a stack reads as one thing.
Search by name or image, filter by running, stopped or unhealthy, and colour the links by network when you need to see the wiring rather than the workload.
DockScope reads the exit code, checks whether the kernel OOM-killed it, and
pulls the last log lines, then puts the likely cause in the sidebar instead of
making you piece it together from docker inspect and docker logs.
Spikes get caught the same way. CPU and memory are watched for outliers, so a container that starts misbehaving pulses on the graph and raises an alert rather than waiting for you to go looking.
Select a node and press I. Everything that depends on it lights up and the
rest of the graph dims. Useful before a restart, and useful when something is
already broken and you want the blast radius.
Every container opens a sidebar of tabs: live logs with colour and in-log search, an interactive shell, env vars with secrets masked, labels, mounts, running processes, and the filesystem diff against the image.
| Environment and labels | Processes |
|---|---|
 |
 |
| Filesystem diff | Logs |
 |
 |
Start, stop, restart, pause, kill and remove are all there, with a confirmation step on the destructive ones. Whole Compose projects go up and down from the project manager.
Hit REC and DockScope records the graph, events and metrics into a JSON file.
Load that file on any other DockScope instance and replay it with a scrubber,
event markers and 1-8x speed. Live updates and actions are disabled during
replay, so a recording is safe to hand to someone else.
For a written postmortem, export the current view as PNG or SVG.
Kubernetes ships as an official plugin that talks to your cluster directly, with
no kubectl needed. Deployments, StatefulSets, DaemonSets, Pods, Services,
Ingresses and HPAs render next to your containers, each pod attached to the
controller that owns it, with the same sidebar: metrics, env, logs and a shell.
Rollout restart, scale and delete included.
Install it from the Plugins panel, or write your own.
| Key | Action |
|---|---|
/ or Ctrl+K |
Focus search |
Escape |
Close panel, clear search |
F |
Zoom to fit |
R |
Reset camera |
C |
Center on selected node |
I |
Toggle impact view |
Space |
Play or pause replay |
? |
Show this list |
On your own machine, yes, and that is the default: DockScope listens on localhost only, and websites you visit cannot reach it.
Two things to know before you expose it anywhere:
- It controls your Docker daemon, including shell access to containers. Treat access to DockScope as access to the host.
- The first time you open a reachable instance, it offers to set an access token. Take it. If you already run Authelia, Authentik, oauth2-proxy or Cloudflare Access, DockScope can use that instead.
SECURITY.md has the full picture.
| Guide | What is in it |
|---|---|
| Configuration | Every CLI flag, environment variable and state file |
| Security | Access tokens, reverse proxy auth, the threat model |
| HTTP API | Every endpoint, and the WebSocket messages |
| Writing plugins | Build your own data source, panel or action |
| Publishing plugins | Package, sign and distribute one through a catalog |
| Operating plugins | Loading, permissions, health and quarantine |
| Contributing | Development setup and how to send a PR |
| Roadmap | Where this is going, and what needs doing |
Contributions are welcome, and there is a short list of issues tagged good first issue that are self-contained enough to pick up cold. Larger open work is tagged help wanted, and ROADMAP.md groups it all by theme.
git clone https://github.com/ManuelR-T/dockscope.git
cd dockscope
npm install
npm run devCONTRIBUTING.md covers the rest. Bug reports count too.
Built with Svelte 5, Three.js and Express. No account, no telemetry, no cloud.