Monitoring Docker

Node64 monitors Docker containers on its own host and on remote hosts – without an agent. State, health, restarts, CPU, RAM, network and I/O with history, plus rules and alerts like for Proxmox VE. The page lives under Health checks → Docker and runs while the Health checks module is switched on.

Overview

There are two ways for Docker: Docker monitoring for all containers of a host – like Proxmox VE – and the docker check type for single containers.

Docker monitoring

Docker monitoring under Health checks → Docker (/healthchecks/docker): the page always starts with the overview of Docker hosts – tiles and a table with state, containers, CPU/RAM, edit, off and delete –, even with only one host or none. The local Docker socket is not monitored automatically: it is only added with Add this machine (local socket) in the overview or via the Add Docker host form; after that Node64 monitors all containers of the host. Hosts already set up stay. Add further hosts remotely via SSH or TLS.

• Every 30 seconds: state, health, restarts, exit code and OOM, CPU (relative to the CPU limit or all cores), RAM without page cache like docker stats (relative to the limit or the host's RAM), network and block I/O – with history from 1 hour to 30 days.
• Immediate incident on unhealthy, restart loop (3 restarts in 10 minutes or status restarting), exit with an error, OOM or dead. Exited containers only count if they're supposed to run (ran before or set explicitly); exit codes 0, 130 and 143 count as a normal stop.
• Rules with inheritance host → container (incident, stopped, paused, restart, CPU and RAM thresholds, delay), plus channels, quiet hours and maintenance windows – like Proxmox VE.
• Container page with values, graphs, labels and rules. Keep as a check also creates a check of type docker (status pages, sync, uptime); existing Docker checks are assigned automatically.
• The label node64.nomonitor=true excludes a container.
• Checks without a container appear as “container missing”. Without a host the overview shows a starting point and links to existing Docker checks in the check list.
• Host page with the host's name in the title and a delete button; afterwards you're back at the overview. State of a host: OK, partly impaired (some containers faulty) or unreachable.
• API: GET /api/healthchecks/docker/containers and /api/healthchecks/docker/systems/{id}/… like Proxmox VE; Prometheus node64_docker_*. Export and import include the Docker host.
• Alerts from Docker hosts carry the subject “Docker: …” and go through the channels from the rules.

Check type docker

Asks the Docker Engine API for the state of a container. The target is the container's name or ID. Docker checks appear as normal rows in the health check list.

Creating one: under Health checks → New check, pick the type Docker container, then the Docker host and the container from the last poll – created like with Keep as a check (interval, group and channels from the rules, name optional), see Check from a monitored system. Monitor a container on a Docker host's page preselects the host (/healthchecks/new?type=sys:docker&sys=ID). Entering the container name by hand is no longer offered for new checks; existing Docker checks stay editable, API and import are unchanged.

Docker checks only run on the node where the container lives. They can't be checked online or moved to another node. When connected to ipv64.net, their state is still reported and visible in the portal.

Examples: Vaultwarden monitors the container vaultwarden including its Docker health check, Jellyfin monitors the container jellyfin.

Access to the Docker socket

The simplest way is to mount the socket directly. Find the socket's group with stat -c %g /var/run/docker.sock:

services:
  node:
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    group_add:
      - "996"   # socket group: stat -c %g /var/run/docker.sock

With the widely used docker-socket-proxy, it looks like this. Node64 only needs CONTAINERS=1, INFO=1 is optional:

services:
  socket-proxy:
    image: tecnativa/docker-socket-proxy
    container_name: socket-proxy
    restart: unless-stopped
    environment:
      CONTAINERS: 1          # only allow container queries
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    # don't publish a port – only Node64 on the same network connects

  node:
    image: ghcr.io/ipv64net/node64:latest
    container_name: node64
    restart: unless-stopped
    depends_on:
      - socket-proxy
    ports:
      - "8080:8080"
    volumes:
      - node64-data:/data
    environment:
      NODE64_DOCKER_HOST: tcp://socket-proxy:2375

volumes:
  node64-data:

The public Node64 image is coming soon. Instead of setting the Docker host globally, you can also enter it per check in the Docker host field.

Remote Docker hosts

Besides the local host, Node64 monitors further Docker hosts – without an agent. Under Health checks → Docker → Add Docker host (/healthchecks/docker/new) you choose the connection; the overview at /healthchecks/docker shows tiles (hosts, containers, running, faulty, load) and a table of all hosts.

Setup via SSH – the form guides you through five steps, with ready-made commands to copy:

1. Create a user
   On the Docker host, create a user with access to Docker:
   bash

   sudo useradd -m -s /bin/sh node64
   sudo usermod -aG docker node64

2. Generate a key
   Click Generate key in the form (ed25519). Alternatively paste your own private key without a passphrase; it's stored encrypted.
3. Add the key
   Run the commands shown on the Docker host. The line in authorized_keys only allows the Docker API, no shell:
   bash

   sudo mkdir -p /home/node64/.ssh
   echo 'restrict,command="docker system dial-stdio" ssh-ed25519 AAAA… node64' | sudo tee -a /home/node64/.ssh/authorized_keys
   sudo chown -R node64:node64 /home/node64/.ssh
   sudo chmod 700 /home/node64/.ssh
   sudo chmod 600 /home/node64/.ssh/authorized_keys

   After Generate new key, repeat this step and delete the old line.
4. Test the connection
   Enter user and host, click Test connection and compare the host key shown with the output of this command; if it matches, confirm:
   bash

   sudo ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

5. Save
   The host's containers then appear.

• Node64 stores the credentials encrypted. Keep as a check uses the same connection for SSH and TLS.
• You add the local socket with Add this machine (local socket); edit hosts under /healthchecks/docker/system/{id}/edit.
• Host off: checks of an SSH or TLS host (“keep as a check”) are paused while the host is switched off. Deleting a host only deletes those checks; other Docker checks stay.
• Changing the address: the checks move along. If the new address points to a different machine, the history starts over. When you switch the connection type, enter credentials and fingerprint again.
• SSH host key: Node64 prefers Ed25519 – compare on the host with ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub. If Node64 has to fall back to docker system dial-stdio, it stays with it for 10 minutes and then tries socket forwarding again.
• API: POST /api/healthchecks/docker/systems with addresses, pin_sha256 and secret – as JSON {"key", "cert", "ca"} or simply the private SSH key as PEM.

Something unclear, missing, or a question about Node64? Ask in the official forum v64.tech.