All clear
The container answers on its own Docker IP and the control plane lists the service as approved. Slow answers are flagged as slow, not counted as fine.
● up · 8ms · approved
Hosted monitoring for your entire stack
Stop checking if it's still up.
Every DockTail host and service in one view. Cloud ties container health, Docker events, and Tailscale control-plane state into incidents you can act on.
30-day trial · cancel any time · one environment variable
Diagram: DockTail Cloud watches every hop of a published service — host, container, local reachability, and tailnet exposure — across every host in the fleet.
Every host, every service, monitored. Zero config.
- host up heartbeat · vitals
- container oom killed docker event
- local refused tcp check :3000
- tailnet approved control plane
Verdict · container problem
grafana broke, not its exposure.
OOM-killed by Docker, exit 137. The tailnet still advertises the service, so re-publishing it changes nothing. 40 log lines captured at the moment of failure.
db-01 postgres, redis, +4 services all clear
edge-01 nginx, traefik, +2 services all clear
watched, healthy problem, with evidence
watching3 hosts · 28 services · 35 containers
DockTail Cloud in 60 seconds
Watch it name the layer that broke.
One service down, two possible culprits: the container or its Tailscale exposure. Cloud checks from both sides and says which one.
No monitors to define
You already wrote the config.
Every docktail.* label you've already written is a monitor definition. Cloud never asks you for a URL, a port, or an interval — the target is read from Docker, on the host, on every pass.
What you wrote docker-compose.yml
grafana:
image: grafana/grafana:11.3.0
labels:
- docktail.service.enable=true
- docktail.service.name=grafana
- docktail.service.port=3000 What Cloud watches live
grafana on prod-01
grafana.tailnet.ts.net
- target
- 172.18.0.4:3000 from docker
- check
- tcp · every 30s
- vantages
- local · tailnet
- project
- monitoring
Nothing to keep in sync
Start a labeled container and it's watched on the next pass. Remove it and its monitor goes with it.
New hosts bring their catalog
Set the key on another machine and every service it publishes shows up, described by its own labels.
Cloud cannot aim a probe
Config picks the shape of a check. The target always comes from the agent's own Docker discovery.
The useful distinction
Two vantages. One answer.
A plain uptime check has one opinion: down. Cloud probes the container from inside the host and asks the Tailscale control plane whether the service is published, then reads both answers together.
Exposure problem
The app is healthy and nobody can reach it. Tailscale isn't publishing the service: awaiting approval, never advertised, or gone. Restarting the app fixes nothing.
● local up · unapproved
Container problem
The service is still advertised and approved, so re-publishing it is wasted effort. The process behind it stopped answering, and the Docker event that killed it is attached.
● refused · exit 137 · oom
Both at once
Nothing answers locally and the control plane doesn't list the service. Usually a deploy that never came up. There is nothing running to restart.
● local down · not_advertised
When a host says nothing at all
A dead machine can't page you.
Detection runs in Cloud, so it works whether your machine does or not. When a host's heartbeats stop, Cloud already knows from its peers whether the device is still there.
Agent down
Peers still see prod-01 in their netmap. The machine is fine. The DockTail process isn't.
Host down
No peer sees the device any more. Last seen 4m ago. The machine is gone.
Incidents
The alert already contains the answer.
You don't get a red dot and a graph to interpret. You get the failure, the vantages that disagreed, and the last thing the container said before it died.
Evidence, not a graph
Exit code, OOM kill, restart count, health transition — the Docker event that caused the outage, attached to the outage it caused.
Logs from the moment it broke
Captured when the failure fires, not scraped minutes later from a container that has already restarted. Secrets are redacted on the host and the tail is capped at 40 lines.
Delivered where you already are
Slack, Telegram, ntfy, webhook, email — recoveries included, so you know it's over without going to look.
grafana on prod-01
incident #182 · opened 14:22:09
- 14:22:07docker event die · exit 137
- 14:22:07docker event oom · killed by docker
- 14:22:11local check refused · 172.18.0.4:3000
- 14:22:11tailnet advertised · approved — exposure is fine
- 14:22:12alert slack #ops · telegram
Log tail · captured at failure 40 lines · 8 KiB cap
14:22:04 lvl=eror msg="query failed" ds=prometheus
14:22:05 lvl=info msg="alerting refresh" auth=[redacted]
14:22:06 fatal: runtime: out of memory
14:22:06 goroutine stack exceeds 1000000000-byte limit 14:26:40 · recovered confirmed after 2 consecutive checks
The whole machine
And the rest of the box.
Services aren't the only thing that goes wrong. Every host reports CPU, memory, load and temperature over the connection it already holds.
No metrics stack
No node_exporter, no Prometheus, no second dashboard. The agent reads /proc itself.
Every container, not just the published ones
A read-only inventory of everything else running on the host, with opt-in failure alerts on the ones that matter.
Fleet 3 hosts · 28 services · 35 containers
prod-01
connected 14d 3h cpu 34%
mem 6.1 / 16 GB
load 0.82 · 0.74 · 0.61 61 °C 12 services 9 other containers
db-01 under pressure
connected 62d 11h cpu 81%
mem 29.4 / 32 GB
load 4.10 · 3.88 · 3.42 79 °C 6 services 11 other containers
edge-01 cpu 12% mem 2.4 / 8 GB 10 services 15 other containers
API + MCP
Your agent can read it too.
Everything above is available to Claude Code, Cursor, Codex or your own scripts — through a REST API and a remote MCP server, on every plan.
Debug from where you already work
Ask your agent what broke. It reads the incident, both vantages and the log tail, and names the layer — the same evidence you get.
Read by default
A read key inspects. Only a read_write key can acknowledge, resolve, or open a maintenance window, and nothing can run on a host.
Your agent · mcp: docktail connected
> Anything wrong on db-01?
● list_hosts()
● get_host(4b1e07…)
db-01 is up but under pressure: memory at 29.4 of 32 GB, load 4.1, 79 °C. All 6 services answer on both vantages, so nothing is down yet — it's the box, not a container.
Setup
One key. Fleet-wide monitoring.
Create a workspace key, add one environment variable, and restart DockTail. Hosts register themselves by Docker engine identity.
docker-compose.yml
services:
docktail:
environment:
- DOCKTAIL_CLOUD_KEY=dtc_7f3a...c91ePrivacy
Nothing hidden.
The software next to your containers should be inspectable. The data it sends should stay yours.
Open-source agent
The whole DockTail client — Cloud reporting included — is open source.
Encrypted in transit
Everything to Cloud rides an encrypted WebSocket (WSS).
Logs stay under your control
Bounded, redacted on the host, and one toggle away from off.
Your Tailscale quota stays yours
One credentialed host per tailnet, and every agent enforces its own 60-second floor.
Pricing
Plans that grow with your fleet.
Flat pricing by host count. Services are not metered, and every plan gets all three vantages and API & MCP access.
Homelab
$0 for 30 days
then $5/month
$0 for 30 days
then $30/year ($2.50/mo)
save 50% vs monthly
- Monitor 2 hosts
- 30-day retention
- 1 alert destination
- Single user
- API & MCP access
All vantages, alerts, incidents and the service catalog included.
Team
$0 for 30 days
then $29/month
$0 for 30 days
then $299/year ($24.92/mo)
save 14% vs monthly
- Monitor 10 hosts
- 30-day retention
- 5 alert destinations
- Team members & roles
- API & MCP access
All vantages, alerts, incidents and the service catalog included.
Business
$99 /mo
or $999/year · save 16%
$83.25 /mo
$999 billed yearly · save 16%
- Up to 100 hosts (30 included)
- 365-day retention
- 15 alert destinations
- Team members & roles
- Priority email support
- Advanced alert routing
- API & MCP access
All vantages, alerts, incidents and the service catalog included.
Card required at checkout, nothing charged for 30 days. Cancel any time before then and you pay nothing.
Questions
Before you connect a host.
The things people ask right after reading the prices.
- How does the trial work?
- Homelab and Team open with a 30-day trial of the full plan: health checks, incidents, alerts, and API & MCP access. It starts at checkout with a card; cancel before it ends and you are not charged. Business starts at its regular price.
- What counts as a host?
- One Docker engine running one DockTail agent. Services are not metered. Hosts beyond your plan's cap stay visible but are not monitored until you upgrade or remove one.
- Can I self-host the control plane?
- No. The agent is open source (AGPL) and stays that way. The control plane is hosted, because alerting has to live outside the blast radius of the hosts it watches.
- What does the agent send, and can Cloud reach into my hosts?
- Operational metadata over one outbound-only WebSocket: service snapshots, Docker events, check results, host vitals, control-plane state, and redacted log tails on incidents. There is no exec, deploy, or shell message type, and Tailscale credentials never leave the host. The full list →
- Can my AI agent use it?
- Yes. Cloud has a REST API and a remote MCP server on every plan, so Claude Code, Cursor, Codex or a script can list hosts and services, read incidents and their log tails, and — with a write key — acknowledge, resolve, or open a maintenance window. API and MCP →
- How is this different from Uptime Kuma?
- Uptime Kuma tells you a service is down. Cloud tells you which layer broke: the container, its exposure on the tailnet, or the host. Its monitors come from the
docktail.*labels you already wrote, and detection runs outside your network. Full comparison →
One environment variable
Start monitoring your fleet.
Set DOCKTAIL_CLOUD_KEY on the DockTail agent you already run. Every host and service shows up in the dashboard — no second binary, nothing dialing in. Homelab and Team start with a 30-day trial.