Web interface

Install the lightweight interface behind its HTTPS proxy. It runs alongside the serve agent.

1. Install read-only

From the root of the v0.0.64 checkout, on a fresh installation:

cd examples/ui
python3 prepare.py --self-signed
docker compose up -d

The script requests a username and password and prepares secrets.local. Open https://localhost:8443 on the host machine. The self-signed certificate lasts seven days and is for local testing; the browser will report that it is not trusted.

This stack starts its own agent. Stop a previous agent if its port conflicts. Only the agent receives the Docker socket.

2. Manual-action variant

On another fresh installation, use this preparation instead of the previous one:

cd examples/ui
python3 prepare.py --actions --self-signed

Set the exact origin in .env, without a trailing slash:

UI_ORIGIN=https://localhost:8443

docker compose -f compose.yaml -f compose.actions.yaml up -d

To convert an existing installation, stop the stack and back up secrets.local to a private location outside the repository before preparing new secrets. The script refuses to overwrite existing secrets.

3. Verify operation

The interface refreshes every five seconds. Unknown values display a dash; stale data disables actions. Stopped/created containers can be started; running containers can be stopped or restarted.

HTTP 202 means accepted, not completed. Check the action result. The queue holds one pending operation; an action expires after 60 seconds and the manual cooldown is 30 seconds per container. Recent results are kept in memory.

4. Use a real domain

Run preparation without --self-signed and provide a trusted certificate and key using the example’s expected tls.crt and tls.key names. Set UI_BIND, UI_PORT and, for actions, UI_ORIGIN to your exact HTTPS domain. Keep the agent on the private network.

The action token stays in the proxy and must never reach the browser. Actions explicitly require --allow-actions, --action-origin, --action-token-file and --state-file; they are incompatible with --dry-run. The dedicated Compose file configures these together.

Stop and update

Use the same -f options as at startup for docker compose down. Keep volumes and secrets. When updating, align agent/UI versions, pull images and recreate both services to refresh proxy DNS resolution.

Protect a container from manual actions

Since version 0.0.64, add this label under the relevant service in your Compose file:

labels:
  monit-docker.protected: "true"

Apply the change with docker compose up -d SERVICE_NAME. The agent reads labels from the recreated container. Its metrics remain visible with a “Protected” badge, but Start, Stop and Restart buttons are disabled. The API also rejects these actions with HTTP 403 and container_protected.

Without this label, manual actions remain available. Explicit false, 0, no and off values disable protection; other values protect the container. Automatic rules remain active. This label does not restrict direct access to the Docker API.

Try the public demo

The live demo uses real containers in a shared environment. Every visitor sees the effects of your actions. Only monit-demo-web and monit-demo-worker can be controlled; the agent, interface and HTTPS proxy are protected.

A stopped test container is automatically started after five minutes stopped, on the next check (once a minute). Running containers are left as they are. This recovery is specific to the demonstration server and is not enabled on your installations. It does not delete containers or volumes or clear the agent’s recent activity.

The offline simulation remains available in French and English with fictional data.