Every DockTail host and service in one view. Cloud ties container health, Docker events, and Tailscale serve state into incidents you can act on.
Same DockTail agent · one environment variable · no second binary
No monitors to define
Every docktail.* label you've already written is a monitor definition. Cloud never asks you for a URL, a port, or an interval — the target is read from Docker, on the host, on every pass.
grafana:
image: grafana/grafana:11.3.0
labels:
- docktail.service.enable=true
- docktail.service.name=grafana
- docktail.service.port=3000Start a labeled container and it's watched on the next pass. Remove it and its monitor retires with it. No dashboard to prune.
Set the key on another machine and every service it publishes describes itself — FQDN, image, ports, compose project, Funnel exposure.
Config picks the shape of a check — TCP or HTTP, a path, an expected status. The destination always comes from the agent's own Docker discovery.
The useful distinction
A plain uptime check has one opinion: down. Cloud probes the container from inside the host and asks the Tailscale control plane whether the service is actually published — then reads the two answers together.
The container answers on its own Docker IP, and the control plane lists the service as advertised and approved. Latency is recorded either way, so a service that answers slowly is flagged as slow rather than quietly counted as fine.
The app is healthy and nobody can reach it. Tailscale is not publishing the service — it's waiting for approval in the admin console, this host never advertised it, or the definition is gone. Restarting the app fixes nothing.
The service is still advertised and approved, so re-publishing it is wasted effort. The process behind it stopped answering — and the Docker event that killed it is already attached.
Nothing answers locally and the control plane doesn't list the service either. Usually a deploy that never came up, or a definition removed while its container was already down — there is nothing running to restart.
When a host says nothing at all
Detection runs in Cloud, so it keeps working whether your machine does or not. Agents report their view of the tailnet every 30 seconds — when the heartbeats stop, Cloud already knows whether that device is still there.
Peers still see prod-01 online in their netmap. The machine is fine — the DockTail process isn't.
No peer sees the device any more — last seen 4m ago. The machine itself is gone.
Incidents
You don't get a red dot and a graph to interpret. You get the failure, the vantages that disagreed, and the last thing the container said before it died.
Exit code, OOM kill, restart count, health transition — the Docker event that caused the outage, attached to the outage it caused.
Captured when the failure fires, not scraped minutes later from a container that has already restarted. Bearer tokens, passwords, API keys and private-key blocks are redacted on the host, then capped at 40 lines and 8 KiB. Opt-in per workspace or per service.
Slack, Telegram, ntfy, webhook, email — recoveries included, so you know it's over without going to look.
14:22:04 lvl=eror msg="query failed" ds=prometheus
14:22:05 lvl=info msg="alerting refresh" auth=[redacted]
14:22:06 fatal: runtime: out of memory
14:22:06 goroutine stack exceeds 1000000000-byte limitThe whole machine
Services aren't the only thing that goes wrong. Every host reports its own vitals over the same connection — CPU, memory, swap, load average, and temperature where the hardware exposes it.
No node_exporter, no Prometheus, no scrape config, no second dashboard. The agent reads /proc and /sys itself and sends the numbers down the connection it already holds.
A read-only inventory of everything else running on the host — image, state, ports, CPU and memory — with opt-in failure alerts on the ones that matter to you.
Setup
Create a workspace key, add one environment variable, and restart DockTail. Hosts register themselves by Docker engine identity.
services:
docktail:
environment:
- DOCKTAIL_CLOUD_KEY=dtc_7f3a...c91ePrivacy
The software next to your containers should be inspectable. The data it sends should stay yours.
The whole DockTail client — Cloud reporting included — is open source.
Everything to Cloud rides an encrypted WebSocket (WSS).
Incident log capture is bounded and configurable for the whole workspace or individual services.
Cloud asks exactly one credentialed host per tailnet, and every agent enforces its own 60-second floor no matter what Cloud requests.
Paid plans
Flat pricing by host count. Services are not metered — a host reports every service it publishes.
A few machines you care about.
Shared operations across a growing fleet.
More capacity for larger environments.
Set DOCKTAIL_CLOUD_KEY on the DockTail agent you already run. Every host and service shows up in the dashboard — no second binary, nothing dialing in.