selfhost
← All apps

Dozzle

Browse container logs with optional scoped users and identity-provider login.

Choose your deployment and the way you want to use Selfhost. The instructions below follow that choice.

Set up Dozzle

Browse container logs with optional scoped users and identity-provider login.

  • The native deployment requires explicit Docker socket acknowledgement. Even a read-only socket bind grants powerful access to the Docker API.
  • Shell, container actions and MCP are disabled by default. Keep the service private until authentication and proxy access are configured.
Customize deployment inputs (1)
Local HTTP port port
portDefault: 18083
Review this deployment’s requirements

Your selections add the matching CLI acknowledgements. The installer checks them again.

Save this as inputs.json and adjust the values before initialization. 

{
  "port": 18083
}

Review and acknowledge every requirement above before running initialization. 

selfhost app --directory ./dozzle init dozzle --method native --inputs inputs.json

Initialization writes portable files and does not start the app. Review compose.yaml, the private .env and any files in files/, then start it: 

selfhost app --directory ./dozzle start

No Selfhost dashboard or background service is needed. You can also start these files directly: 

cd dozzle
docker compose -f compose.yaml up -d
  • Review the portable Compose and native configuration before starting.
  • The default listener is local-only. Add an authenticated HTTPS proxy before exposing private data.
  • The Docker socket provides root-equivalent access, even with :ro. Keep the dashboard local until authentication is configured.
  • To use OIDC, configure provider roles and container filters before enabling it. OIDC replaces local users; verify provider access before restarting.

Before configuring integrations

  • The OIDC connection profile configures the issuer and client credentials, with callback /api/auth/callback.
  • Use provider claims to assign the supported roles and container filters. OIDC replaces the local user authentication flow.
  • Remote agents, remote hosts, filters and other supported options are available as native environment settings.
  • Agent deployments and their credentials must be configured explicitly.
  • The Docker socket is not a restricted logs-only API, even when its filesystem mount is read-only.

Dozzle integrations

Compose service: dozzle. These operations use the profile saved when this deployment is created.

  • Docker socket access is root-equivalent. Enabling actions, shells or MCP increases access to this engine.
  • OIDC requires role claims and replaces local users. Assign provider roles and container filters before switching authentication.

Native settings

Changes use the app’s Compose environment. Unrelated settings are preserved.

Supported fields (40)
DOZZLE_FILTER dozzle-filter
string · advanced
DOZZLE_REMOTE_HOST dozzle-remote-host
string · advanced
DOZZLE_REMOTE_AGENT dozzle-remote-agent
string · advanced
DOZZLE_NAMESPACE dozzle-namespace
string · advanced
DOZZLE_ADDR dozzle-addr
string · advanced
DOZZLE_BASE dozzle-base
string · advanced
DOZZLE_HOSTNAME dozzle-hostname
string · advanced
DOZZLE_HOST_ID dozzle-host-id
string · advanced
DOZZLE_LEVEL dozzle-level
string · advanced
DOZZLE_MODE dozzle-mode
string · advanced
DOZZLE_TIMEOUT dozzle-timeout
string · advanced
DOZZLE_NO_ANALYTICS dozzle-no-analytics
string · advanced
DOZZLE_CERT dozzle-cert
string · advanced
DOZZLE_KEY dozzle-key
string · advanced
DOZZLE_ENABLE_ACTIONS dozzle-enable-actions
string · advanced
DOZZLE_ENABLE_SHELL dozzle-enable-shell
string · advanced
DOZZLE_ENABLE_MCP dozzle-enable-mcp
string · advanced
DOZZLE_DISABLE_AVATARS dozzle-disable-avatars
string · advanced
DOZZLE_RELEASE_CHECK_MODE dozzle-release-check-mode
string · advanced
DOZZLE_IMAGE_CHECK_MODE dozzle-image-check-mode
string · advanced
DOZZLE_AUTO_UPDATE dozzle-auto-update
string · advanced
DOZZLE_AUTO_UPDATE_TIME dozzle-auto-update-time
string · advanced
DOZZLE_AUTH_PROVIDER dozzle-auth-provider
string · advanced
DOZZLE_AUTH_TTL dozzle-auth-ttl
string · advanced
DOZZLE_AUTH_LOGOUT_URL dozzle-auth-logout-url
string · advanced
DOZZLE_AUTH_GITHUB_CLIENT_ID dozzle-auth-github-client-id
string · advanced
DOZZLE_AUTH_GITHUB_CLIENT_SECRET dozzle-auth-github-client-secret
secret · advanced
DOZZLE_AUTH_OIDC_ISSUER dozzle-auth-oidc-issuer
string · advanced
DOZZLE_AUTH_OIDC_CLIENT_ID dozzle-auth-oidc-client-id
string · advanced
DOZZLE_AUTH_OIDC_CLIENT_SECRET dozzle-auth-oidc-client-secret
secret · advanced
DOZZLE_AUTH_OIDC_NAME dozzle-auth-oidc-name
string · advanced
DOZZLE_AUTH_OIDC_ROLES_CLAIM dozzle-auth-oidc-roles-claim
string · advanced
DOZZLE_AUTH_OIDC_FILTERS_CLAIM dozzle-auth-oidc-filters-claim
string · advanced
DOZZLE_AUTH_OIDC_SCOPES dozzle-auth-oidc-scopes
string · advanced
DOZZLE_AUTH_HEADER_USER dozzle-auth-header-user
string · advanced
DOZZLE_AUTH_HEADER_EMAIL dozzle-auth-header-email
string · advanced
DOZZLE_AUTH_HEADER_NAME dozzle-auth-header-name
string · advanced
DOZZLE_AUTH_HEADER_FILTER dozzle-auth-header-filter
string · advanced
DOZZLE_AUTH_HEADER_ROLES dozzle-auth-header-roles
string · advanced
DOZZLE_AGENT_ADDR dozzle-agent-addr
string · advanced

Save a JSON map of the field IDs you want to change as changes.json. Replace FIELD_ID with an ID from the supported fields above, and use its declared value type. Review the plan and replace REVIEWED_REVISION with the revision it returns. 

{
  "FIELD_ID": "YOUR_VALUE"
}
selfhost app --directory ./dozzle config dozzle
selfhost app --directory ./dozzle plan dozzle changes.json
selfhost app --directory ./dozzle apply dozzle changes.json --revision REVIEWED_REVISION

Saved changes need service recreation to become active. Existing interpolated environment values stay under your control in .env or Compose.

Identity provider login

Selfhost can register a client with a supported provider and configure this app. Callback path: /api/auth/callback.

No administrator role is assigned by Selfhost. Check the app’s first-login policy and retain a local recovery account.

Save connection.json and replace the URLs. Supply SELFHOST_IDP_TOKEN privately in your shell. 

{
  "provider": "zitadel",
  "issuer": "https://identity.example.com",
  "app_url": "https://app.example.com",
  "name": "Dozzle"
}
selfhost app --directory ./dozzle connect-account dozzle connection.json
selfhost app --directory ./dozzle connect-plan dozzle connection.json
selfhost app --directory ./dozzle connect dozzle connection.json --revision REVIEWED_REVISION

Test sign-in in a separate browser session. HTTPS domains and HTTP loopback development origins are supported by Selfhost; the chosen app and provider must also accept the resulting callback. Provider permissions, localhost and recovery.

App actions

Check Dozzle health

Check the local Dozzle server without changing containers.

selfhost app --directory ./dozzle action dozzle check-health

App configuration reference

Versions and updates

This deployment uses the following images. Existing projects retain their saved recipe and images. A new catalogue version does not silently update them.

  • dozzle: amir20/dozzle:v11.1.1
  • v11.1.1 amir20/dozzle:v11.1.1

    Local Docker HTTP startup, native configuration roundtrip, declared read-only actions and container recreation with persistent volumes passed. External provider login and version upgrades require separate validation.

Review compatibility and back up app data before an update. Choose an image version and review the change.

Keep control of your setup

Selfhost remains optional. Your app runs using ordinary Compose files, its own settings and persistent data. Keep the Compose project name and volumes to preserve storage. Configuration exports and setting backups do not include application data.

Standalone CLI guide · Backups and removal · Dozzle documentation

Built by Obiente. Your services, your configuration.

Licensed under AGPL-3.0-or-later.