Web interface — monit-docker

Install the lightweight interface behind its HTTPS proxy. It runs alongside the serve agent.

After a failed cycle, the dashboard shows the time and contents of the last complete snapshot in read-only mode. There is no history before the first successful cycle.

1. Install read-only

From the root of the v1.3.3 checkout, on a fresh installation:

cd examples/ui
python3 prepare.py --self-signed
docker compose up -d

The script requests a username and password and prepares secrets.local. Open https://localhost:8443 on the host machine. The self-signed certificate lasts seven days and is for local testing; the browser will report that it is not trusted.

This stack starts its own agent. Stop a previous agent if its port conflicts. Only the agent receives the Docker socket.

2. Manual-action variant

On another fresh installation, use this preparation instead of the previous one:

cd examples/ui
python3 prepare.py --actions --self-signed

Set the exact origin in .env, without a trailing slash:

UI_ORIGIN=https://localhost:8443

docker compose -f compose.yaml -f compose.actions.yaml up -d

To convert an existing installation, stop the stack and back up secrets.local to a private location outside the repository before preparing new secrets. The script refuses to overwrite existing secrets.

3. Verify operation

The interface refreshes every five seconds. Unknown values display a dash; stale data disables actions. Stopped/created containers can be started; running containers can be stopped or restarted.

HTTP 202 means accepted, not completed. Check the action result. The queue holds one pending operation; an action expires after 60 seconds and the manual cooldown is 30 seconds per container. Recent results are kept in memory.

4. Use a real domain

Run preparation without --self-signed and provide a trusted certificate and key using the example’s expected tls.crt and tls.key names. Set UI_BIND, UI_PORT and, for actions, UI_ORIGIN to your exact HTTPS domain. Keep the agent on the private network.

The action token stays in the proxy and must never reach the browser. Actions explicitly require --allow-actions, --action-origin, --action-token-file and --state-file; they are incompatible with --dry-run. The dedicated Compose file configures these together.

Stop and update

Use the same -f options as at startup for docker compose down. Keep volumes and secrets. When updating, align agent/UI versions, pull images and recreate both services to refresh proxy DNS resolution.

Protect a container from manual actions

Since version 0.0.64, add this label under the relevant service in your Compose file:

labels:
  monit-docker.protected: "true"

Apply the change with docker compose up -d SERVICE_NAME. The agent reads labels from the recreated container. Its metrics remain visible with a “Protected” badge, but Start, Stop and Restart buttons are disabled. The API also rejects these actions with HTTP 403 and container_protected.

Without this label, manual actions remain available. Explicit false, 0, no and off values disable protection; other values protect the container. Automatic rules remain active. This label does not restrict direct access to the Docker API.

Try the public demo

The live demo uses real containers in a shared environment. Every visitor sees the effects of your actions. Only monit-demo-web and monit-demo-worker can be controlled; the agent, interface and HTTPS proxy are protected.

A stopped test container is automatically started after five minutes stopped, on the next check (once a minute). Running containers are left as they are. This recovery is specific to the demonstration server and is not enabled on your installations. It does not delete containers or volumes or clear the agent’s recent activity.

Persistent journal

Open the demo Journal to browse real actions and outcomes, filter events and download the displayed page as CSV or JSONL. Manual demo actions are anonymous and visible to everyone.

Version 0.0.66 introduced a private Journal page with filters and CSV/JSONL downloads. See the journal activation guide.

Temporary maintenance

The demo also offers 15-minute and one-hour maintenance pauses on its test containers. These pause this agent’s automatic rule actions, not Docker policies or the five-minute host recovery timer. The demo has no automatic remediation rules; it demonstrates the controls, persisted state and audit. See the maintenance guide to enable the feature on your installation.

Since 0.0.74, click a container, Manual action / Automatic action, or result label to combine journal filters. Active filters appear above the events and can be removed individually; Clear removes them all. Each change returns to the newest page. Queued and In progress both select Pending. Container labels use the full ID when available, otherwise the name. Exports follow the current page and applied filters. Clicking a label replaces unsubmitted form edits with the applied filters.

Since 0.0.75, View action opens the retained stages of an action in a separate window, oldest first. The window includes source, actor, host, container, reason and recorded duration, independently of the journal filters. Load older events continues the search on demand; Refresh action starts a new snapshot. Missing stages do not establish the current action state. The display is limited to 500 events. Closing the window preserves the journal page and filters. Events without a correlation ID have no action link.

Since 0.0.76, action history immediately shows matching events already loaded in the journal while checking retained history. This preview is clearly labeled and replaced by the agent response. On failure, it remains visible with an incomplete or outdated warning. Ordinary audit text validation is also faster, with the same escaping rules.