Beszel is a hub-and-agent monitoring platform. The hub provides the web dashboard and management, while an agent runs on each monitored system and reports historical host and container data, with alerting available through the platform. The key deployment choice is not simply “Docker or binary.” It is how much host access the agent needs, how it reaches the hub, and whether your network and security boundaries can support that design.
Beszel’s documented Docker agent uses host networking and mounts the Docker API socket read-only. That combination makes container statistics convenient and permits host network-interface statistics, but it also ties the agent more closely to the host’s network namespace and Docker control socket. If you only need container metrics, you may be able to remove host networking and publish an agent port instead. If you need sensors, SMART, ZFS, GPU, battery, or systemd data, a binary agent may provide better coverage.
As an Amazon Associate I earn from qualifying purchases.
What Beszel monitors and how its architecture works
Beszel separates monitoring into two components:
- Hub: the web dashboard, system management, historical data and alert functions.
- Agent: a process on each monitored machine that collects host and, when configured, container statistics.
The official overview lists CPU and memory data for hosts and containers, disk and network metrics, load, sensors, fan speed, GPU, battery, SMART, ZFS and network monitors. Actual availability depends on the operating system, permissions, hardware and the way the agent is deployed. A containerized agent does not automatically see everything a native process can see.
This distinction matters in a homelab because “the monitor is running in Docker” describes where the process lives, not what it can observe. Access to the Docker socket can expose container information; host networking can expose host-interface statistics; other host telemetry may require devices, paths, permissions or a native installation.
#1 Best Overall
- WIFI ENABLED TO CONTROL FROM ANYWHERE – Transform your home into a smart home with the Feit Electric Smart Wi-Fi Plug. Remotely turn on or off lights, fans, coffee makers, or other home appliances from your smartphone or tablet. Works seamlessly with Alexa and Google Home, giving you effortless voice control without needing a separate hub. Manage your devices anytime, whether you’re at home, at work, or traveling.
- SIMPLE SETUP, NO HUB REQUIRED – Enjoy the convenience of smart home automation without extra equipment. The plug connects directly to your 2.4 GHz Wi-Fi network, making installation fast and easy. Plug it in, download the Feit Electric app, follow the simple steps, and your devices are instantly connected. Perfect for beginners or anyone looking to expand their smart home ecosystem with minimal hassle.
- SET YOUR ROUTINE & SAVE ENERGY – Save energy, stay organized, and automate daily routines with customizable schedules and timers. Set your lamps, heaters, or appliances to turn on and off automatically at specific times, ensuring your home is always comfortable and efficient. Ideal for morning routines, evening wind-downs, or holiday lighting, giving you peace of mind and energy savings without constant manual operation.
- ENHANCED SAFETY & CONVENIENCE – Protect your home and appliances with the Feit Electric Smart Plug’s durable design and safety features. Its compact size fits easily into standard indoor outlets without blocking other sockets. With real-time app control and notifications, you can monitor appliance activity and prevent energy waste. Ideal for families, pet owners, or anyone seeking a smarter, safer, and more convenient home setup.
- RELIABLE 2.4GHz WI-FI PERFORMANCE – Designed to work exclusively on 2.4 GHz networks, this smart plug provides stable connectivity for smooth operation of all your devices. Avoid interruptions caused by incompatible networks, ensuring your appliances respond instantly when controlled via the app or voice commands. Perfect for indoor home use, it supports up to 15 amps, handling heavy-duty appliances safely and reliably.
Beszel’s own agent documentation states: “The agent must use host network mode to access the host’s network interface stats.” Read the Agent Installation documentation for the current configuration examples.
The Docker agent tradeoff: convenience versus boundary
The documented Docker example grants the agent two notable forms of access:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors- Host networking: the container shares the host network namespace, which is required for host network-interface statistics.
- Docker socket access:
/var/run/docker.sockis mounted read-only so the agent can query Docker for container statistics.
This is a deliberate visibility choice. It can give a single container enough information to monitor both the host’s interfaces and its containers without installing a separate binary. The cost is a tighter deployment boundary: the agent depends on host network configuration and on a host API socket.
Read-only mounting is the mode shown in Beszel’s example, but :ro should not be described as complete isolation or as proof that socket access is harmless. Treat the Docker socket as a privileged host interface, review which process receives it, and grant only the paths, devices and permissions your metrics require. The documentation does not quantify a security risk, resource overhead or performance penalty, so those should not be inferred from the example.
If host-interface statistics are not important, Beszel says host networking can be removed and an agent port mapped manually. That reduces the network coupling, but it changes how the hub reaches the agent and does not by itself remove the Docker socket requirement if container metrics remain part of the plan.
Choose the agent form by the metrics you actually need
| Deployment | What it suits | Access and limitations |
|---|---|---|
| Docker or Podman agent | Container statistics plus the host metrics available from the container configuration | Beszel’s example uses host networking for host-interface statistics and a read-only Docker socket for container data |
| Rootless Docker or Podman agent | Container statistics when the correct rootless socket and cgroup delegation are configured | Host-level sensors, fans, battery, GPU, ZFS, SMART and systemd monitoring may be unavailable or need extra configuration |
| Binary agent | Broader host telemetry where hardware, storage or service details matter | Runs outside the container boundary and is the documented alternative when the container agent cannot access required host metrics |
The deciding question is therefore not which installation is universally better. Ask which metrics must appear in the dashboard, what host access is acceptable, and which side of the network can initiate a connection.
When a container agent is a good fit
A container agent is practical when your priority is a compose-managed deployment, container statistics, ordinary CPU, memory, disk and network visibility, and a straightforward upgrade path alongside the rest of your stack. It is also useful when you prefer the agent to initiate a WebSocket connection through an existing outbound path.
When the binary agent is the safer operational choice
Use the binary option when sensors, fan speeds, battery state, GPU data, SMART, ZFS or systemd service monitoring are important and the containerized agent cannot see the required interfaces. Beszel’s documentation specifically points to the binary agent for cases where those host-level metrics are needed. That recommendation is about metric coverage, not a blanket claim that a binary installation is always safer.
Rank #2
- equipped with atom n2600 d2700 processor, compatible with many freebsd based router systems, linux distros, or win.os supported, easy configuration and management
- Please note, this is a barebone only. A system memory, a storage drive and an operating system are needed to complete this system
- 13-19 inches 1u, 50w power, with power cord, make sure to use a big brand memory and ssd/hdd with quality assurance
- Designed with console, 2 x usb, 4 x lan, vga, power switch, size at 290 x 180 x 44mm
- There are 2 inside reserved fans on chassis, which could be removed freely or be turned on in a high temperature environment to ensure the best function of the product
Install the hub first
Beszel supports a hub installed with Docker, Podman or a single binary. The official container examples expose the dashboard on port 8090 and persist hub data in /beszel_data. Follow the current Getting Started guide for the image and complete compose definition, because image tags and environment names can change.
- Deploy the hub with its persistent
/beszel_datavolume and publish port8090to the interface where you intend to use the dashboard. - Open the dashboard and create or sign in to the hub account described by the setup guide.
- Start the agent using either the local combined-compose pattern or a separate agent deployment.
- In the hub’s system-add screen, enter the generated public key and token supplied by the agent setup.
- Restart the agent after adding the system, then verify that the first samples arrive before expanding the deployment.
The exact key and token values are generated for your installation; do not copy credentials from an example into production.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Option 1: hub and agent on the same machine
Two containers on one host do not automatically share a loopback interface. In particular, localhost inside the hub container refers to the hub container, not to a separate agent container. Beszel’s combined local compose example solves this with a shared Unix-socket directory.
The documented pattern shares a socket directory between the containers, sets the agent listener to /beszel_socket/beszel.sock, and has the agent connect to http://localhost:8090 through host networking. When you add the system in the UI, use the generated public key and token, restart the agent, and enter the Unix socket path as the host or IP:
/beszel_socket/beszel.sockThis local socket arrangement avoids trying to route between two container loopback interfaces. It is most appropriate when the hub and agent are on the same Docker or Podman host and you want a local, filesystem-backed connection rather than a published TCP endpoint.
Checks for a local Unix-socket setup
- Both containers must mount the same socket directory at the paths expected by the compose configuration.
- The agent must be able to create and access
/beszel_socket/beszel.sock. - The host/IP field in the hub must contain the Unix socket path, not a container name or
localhost. - After entering the key and token, restart the agent so it loads the new configuration.
Option 2: a separate Docker agent
For a separate Docker agent, Beszel’s official example uses host networking, listens on port 45876, mounts /var/run/docker.sock read-only, and receives the key, token and hub URL through environment variables. Use the current Agent Installation page for the complete example and image reference.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The important configuration decisions are:
- Network mode: host mode is required for host network-interface statistics.
- Listener: the documented example uses
LISTEN=45876. - Container visibility: the Docker socket is mounted at
/var/run/docker.sockread-only. - Authentication: the generated key and token identify the system to the hub.
- Hub address: the agent needs the hub URL appropriate to your routing and proxy setup.
If you remove host networking because interface statistics are unnecessary, publish and route the agent’s listening port yourself. The hub must then be able to reach that endpoint, and any firewall or reverse-proxy rules must allow the selected path.
Rootless Docker and Podman: useful, but not identical
Rootless engines can provide container statistics when the agent uses the correct rootless socket path and cgroup delegation is configured. The path is not necessarily /var/run/docker.sock; it may be located in the rootless user’s runtime directory. Configure the socket and filesystem permissions for the account running the engine rather than assuming a rootful layout.
Rank #3
- Shelly Plus 1 PM is a Wi-Fi smart relay switch with 1 channel, up to 16A with power metering that can be used also as a WiFi repeater and Bluetooth gateway. Shelly Plus 1PM can be used to monitor the consumption and take control of home appliances, electric circuits, and office equipment individually.
- Automate electrical appliance and control - With Shelly Plus 1PM you can automate any electrical appliance in your home and control it remotely. Shelly Plus 1PM can control appliances with a large load which makes it perfect for kitchen appliances and domestic systems monitoring and control. You can get precise measurements of the power consumption of each appliance and switch in on/off remotely, no matter where you are.
- Set and be prepared for everything - Reveal the full potential of Shelly Plus 1PM by combining it with other devices from your home network! Set Shelly Plus 1PM to activate custom scenes based on hour, light, or various occurrences. For example, you can set Shelly Door/Window sensor to report a porch door opening and activate Shelly Plus 1PM to turn on the hot tub heaters only in the hours after 8 pm.
- Shelly Customer Service - Shelly is one of the fastest-growing Smart Home brands in the world with devices, providing solutions for the automation of private homes, buildings and businesses. We provide our customers with professional support and a 3 years device warranty.
- Shelly Smart Control App will help you control your Shelly devices remotely and will send notifications for all automated events in your home. You can easily configure devices and manage their settings individually, or you can create personalized scenes by combining Shelly devices to trigger certain actions in your home automation.
Rootless operation can leave host telemetry incomplete. Beszel documents that sensors, fans, battery, GPU, ZFS, SMART and systemd service monitoring may be unavailable or require additional configuration. If those values are central to your alerts, check them explicitly after enrollment and switch to the binary agent when the container boundary prevents access.
Do not interpret an empty graph as proof that the hardware is unsupported. Confirm the engine’s cgroup mode, delegated controllers, socket path, device permissions and host filesystem mounts first. Availability is platform- and permission-dependent.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose how the hub and agent connect
Beszel documents two connection directions. Select the one that matches your firewall, NAT and proxy topology.
| Mode | Connection direction | Best fit | Important qualification |
|---|---|---|---|
| SSH | The hub opens a TCP connection to the agent | Networks where the hub can directly reach each monitored host | Beszel’s security page says SSH mode assumes a trusted network path because the hub does not verify an agent SSH host key |
| WebSocket | The agent initiates a WebSocket connection to the hub | Agents behind NAT or firewalls that permit outbound connections to the hub | The endpoint /api/beszel/agent-connect must support WebSockets through any reverse proxy |
In SSH mode, forwarding and firewall rules can prevent the hub from reaching the agent’s listening port. In WebSocket mode, the outbound route may work while a conventional inbound connection would not, but a proxy that handles ordinary HTTP and not WebSockets will still break enrollment or updates.
Read the current Security documentation before exposing an agent beyond a trusted network. The page is on Beszel’s preview subdomain in the supplied material, so confirm the canonical current page when applying version-sensitive security details.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What the Docker socket and host network change
Docker socket access
Mounting the Docker socket lets the agent query the engine for container statistics. It also makes the agent dependent on the engine’s API endpoint and on the socket’s ownership and permissions. A read-only mount matches Beszel’s documented example; it does not turn the socket into an unprivileged data file. Keep the mount limited to the agent that needs it, and avoid adding unrelated host paths just to make a graph appear.
Host networking
Host mode is the documented requirement for host network-interface statistics. It removes the container’s separate network namespace, so the agent observes interfaces in the host’s networking context. If those statistics are not part of your monitoring plan, removing host mode and mapping a port manually can preserve a narrower network arrangement, provided the hub can still reach the mapped endpoint.
Additional host telemetry
Sensors, fan speed, battery, GPU, SMART, ZFS and systemd data can require access beyond the Docker socket and network namespace. A missing metric may indicate an unsupported platform, absent device or filesystem permissions, rootless restrictions, or a configuration omission. The binary agent is the documented fallback when that access is required.
Rank #4
- Portable 100M/1G Network TAP Appliance for remote capture of data traffic
- Integrated with a Raspberry Pi 4 module (8GB RAM and 64GB Micro SD Card)
- Can be used as a standalone 100M/1G network TAP with the external monitor port
- Dual DC power inputs for enhancing overall system availability
Troubleshoot missing connections and metrics
The agent never appears or stays offline
- Verify the generated public key and token in the hub and restart the agent after entering them.
- For a local two-container deployment, use the shared Unix socket path rather than
localhost. - For SSH, confirm that the hub can reach the agent over TCP and that forwarding and firewall rules permit the connection.
- For WebSocket mode, confirm that the reverse proxy passes upgrade requests and permits
/api/beszel/agent-connect. - Check that the hub URL resolves from the agent’s network and that the selected listener port is exposed when host networking is not used.
Container statistics are absent
- Confirm that the Docker or Podman socket path is correct for rootful or rootless operation.
- Check socket ownership and the agent process permissions.
- Verify that cgroup accounting is enabled and delegated where the engine requires it, especially with rootless containers.
- Ensure the agent is monitoring the engine that actually runs the workloads; a socket for a different engine or host will return the wrong view.
Host graphs work but hardware metrics do not
- Check whether the host exposes the relevant sensor, GPU, SMART, ZFS or battery interfaces.
- Review device and filesystem permissions rather than changing unrelated container privileges.
- For systemd monitoring, confirm that the agent has a supported way to inspect the host service manager.
- If the required telemetry remains unavailable in a container, install the binary agent for that system.
Memory values look wrong
Beszel lists Docker memory accounting and cgroups among its troubleshooting checks. A graph that appears capped, empty or inconsistent can result from engine-level accounting rather than from the dashboard itself. Inspect the container runtime’s cgroup configuration and memory limits before treating the displayed value as a host-wide measurement.
Recommended Free Tools
A practical decision framework
- List required metrics. If container CPU and memory plus ordinary host disk and network data are enough, a container agent may fit. Mark sensors, GPU, SMART, ZFS, battery and systemd as explicit requirements rather than assuming they will be visible.
- Choose the access boundary. Decide whether the agent may use host networking, a Docker socket, additional device paths or host filesystems. Do not grant an access merely because a sample compose file contains it.
- Map the network direction. Use SSH when the hub can reach each agent over a trusted path. Use WebSocket when agents can initiate outbound connections to the hub through NAT, firewalls or a reverse proxy.
- Select rootful or rootless deliberately. Rootless can work for container metrics with the correct socket and cgroup setup, but plan for reduced host telemetry.
- Validate after enrollment. Check one host, one container and each required hardware or storage metric before rolling the configuration out to every machine.
This process avoids the common mistake of equating a successful container deployment with complete host observability. Beszel gives you multiple supported paths; the right one follows from your metrics and topology.
Bottom line for a homelab
Beszel’s Docker agent is convenient because it can be managed with the rest of your containers and can report container statistics through the Docker API. Host networking is the documented way to obtain host network-interface statistics, while rootless or tightly bounded containers may not expose every hardware, storage or service metric. Use the smallest access that covers your monitoring goals, choose SSH or WebSocket according to who can reach whom, and use the binary agent when the container boundary prevents the host telemetry you need.
Frequently Asked Questions
Can Beszel’s Docker agent run without host networking?
Yes, if host network-interface statistics are not required. Beszel says host networking can then be removed and an agent port mapped manually; the hub must be able to reach that endpoint.
Why does localhost fail when the hub and agent are separate containers?
Each container has its own loopback interface. Beszel’s local compose pattern shares a Unix-socket directory and uses /beszel_socket/beszel.sock instead.
Does a read-only Docker socket eliminate the security concern?
No. Read-only is the mode shown in Beszel’s example, but the socket remains a host API interface. Review which process receives it and avoid treating :ro as complete isolation.
When should I use WebSocket instead of SSH?
Use WebSocket when the agent can initiate an outbound connection to the hub but inbound hub-to-agent access is blocked by NAT or firewalls. The reverse proxy must support WebSockets at /api/beszel/agent-connect.
What can rootless operation fail to show?
With the correct rootless socket and cgroup delegation, container statistics can work. Sensors, fans, battery, GPU, ZFS, SMART and systemd metrics may be unavailable or require additional configuration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →
