Uptime Kuma can monitor Docker containers directly, but a Dockerized Kuma server needs access to the Docker daemon. For containers on the same host, that usually means mounting /var/run/docker.sock. For another machine, use a Docker TCP endpoint—preferably protected with mutual TLS. The local method is easier, while the remote method requires more configuration and certificate management. In both cases, treat Docker access as highly privileged and keep the Kuma interface on a trusted network or VPN rather than exposing it to the public internet.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What Uptime Kuma’s Docker monitor actually checks
Uptime Kuma is a self-hosted monitoring tool with a Docker-container monitor, ordinary HTTP and TCP checks, ping checks, keyword checks, status pages, two-factor authentication, and notifications through Telegram, Discord, Gotify, Slack, Pushover, SMTP email, and more than 90 notification services. The current project README documents a 20-second monitoring interval. That interval is the polling cadence, not a guarantee that an alert will arrive exactly 20 seconds after a failure: notification delivery, retries, and your configured heartbeat settings can add delay.
As an Amazon Associate I earn from qualifying purchases.
A Docker monitor observes information exposed by the Docker daemon, such as whether a container is running and its reported state. That answers the process question: is Docker keeping this container alive? It does not prove that the application inside the container is serving useful responses. A web server can remain “running” while returning errors, listening on the wrong interface, or failing its database connection.
For important services, pair checks:
- Container-level check: detects a stopped, exited, or otherwise unhealthy Docker workload as reported by the daemon.
- Application-level check: an HTTP, TCP, ping, or keyword monitor verifies that users can reach the service and that the response is acceptable.
This combination catches both a dead process and a live process that is functionally broken.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Choose local or remote Docker monitoring
| Decision point | Local socket mount | Remote TCP with TLS |
|---|---|---|
| Where Kuma runs | On the same Docker host as the containers | On one machine while the monitored daemon runs on another |
| Connection method | Bind-mount /var/run/docker.sock into the Kuma container |
Connect to a Docker TCP endpoint configured on the remote daemon |
| Network exposure | No Docker API network port is required, but the socket is inside Kuma | Requires a reachable Docker TCP listener; firewall it tightly |
| Credentials and certificates | No separate Docker certificate files | Secure deployments use a CA, client certificate, and client key |
| Compromise impact | Kuma can control the local Docker daemon | Kuma can control the remote daemon permitted by the endpoint |
| Operational complexity | Lowest; one volume mapping and a restart | Higher; daemon configuration, firewalling, TLS files, and certificate rotation |
Use the local method when the monitoring server and workloads share a host and you accept the security boundary. Use remote TLS when you need one Kuma instance to observe another host and can operate certificates correctly. Do not treat an unauthenticated Docker TCP listener as a normal internet deployment.
Install Uptime Kuma with Docker Compose
The official README describes Uptime Kuma as “an easy-to-use self-hosted monitoring tool.” A basic Compose installation creates a directory, downloads the project’s Compose file, and starts the service:
mkdir uptime-kuma
cd uptime-kuma
curl -o compose.yaml https://raw.githubusercontent.com/louislam/uptime-kuma/master/compose.yaml
docker compose up -dThe downloaded Compose file is the project-maintained starting point. After the containers start, open Kuma on port 3001 on the host running it and complete the initial account setup in the browser.
The equivalent Docker CLI command from the README is:
docker run -d --restart=always -p 3001:3001 -v uptime-kuma:/app/data --name uptime-kuma louislam/uptime-kuma:2/app/data must be persistent. It stores your monitors, notification settings, users, and other Kuma state; deleting it means rebuilding that configuration. The README specifically warns that NFS (Network File System) is not supported for this data path. Use a local Docker volume or a local directory on the host instead.
Before adding monitoring, make sure:
- Docker Engine and the Compose plugin are installed on the Kuma host.
- Port
3001is reachable from the administration network, but not unnecessarily from the public internet. - The data volume is local and included in your backup plan.
- You have permission to change the Docker service configuration if you plan to monitor a remote daemon.
Configure monitoring for containers on the same host
1. Add the Docker socket mapping
A container is isolated from the host by default. To let Kuma query the local Docker daemon, add this volume mapping to the Kuma service in compose.yaml:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
volumes:
- /var/run/docker.sock:/var/run/docker.sockKeep your existing persistent data mapping as well; the socket mapping is an additional volume, not a replacement for /app/data. A typical service therefore has one volume for Kuma’s data and one for the Docker socket. If you launch Kuma with Docker CLI instead, add:
-v /var/run/docker.sock:/var/run/docker.sock2. Recreate the Kuma container
From the directory containing compose.yaml, apply the change:
docker compose up -dCompose recreates the service when its volume configuration changes. Confirm that it is running with docker ps and inspect startup messages with docker compose logs uptime-kuma if the web interface does not return.
3. Add a Docker monitor in the web interface
- Sign in to the Kuma web interface on port
3001. - Choose the control for adding a monitor.
- Select the Docker monitor type.
- Choose the Docker host and the container information exposed by the daemon. Select the target container rather than assuming that a name shown in another host’s Docker installation is available locally.
- Save the monitor and deliberately test a notification channel if the interface offers a test action.
The exact container list depends on what the mounted daemon reports. If no host or container appears, troubleshoot the socket mapping, container recreation, and permissions before changing application settings.
Free tools Windows power users keep installed
One-click scans. No signup required.
Understand the Docker socket security boundary
The socket mapping is convenient because it avoids a network listener, but it is not a read-only status feed. The official Docker-monitoring guidance states: “Exposing the Docker socket or TCP port to Uptime Kuma, gives that full control over the Docker daemon on the host.” It also warns: “If the container is compromised, an attacker could gain control over it.” In practical terms, anyone who gains effective control of the Kuma container may be able to ask Docker to start privileged workloads, mount host paths, read secrets, or otherwise take over the host.
For that reason, the same guidance says it is “NOT recommended to expose Uptime Kuma to the Internet when using this monitor type.” Put the administrative UI behind a trusted LAN, private management network, or VPN. Restrict inbound access with a firewall or reverse-proxy access policy, use strong unique credentials, enable Kuma’s two-factor authentication, and keep the host and image patched. A reverse proxy that merely adds HTTPS does not remove the Docker-daemon privilege; it only protects the web connection.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Use the smallest practical blast radius:
- Run Kuma on a dedicated monitoring host or a host whose workloads you are prepared to expose to this trust boundary.
- Do not share the socket with unrelated applications.
- Limit who can reach port
3001and who can sign in to Kuma. - Back up
/app/datasecurely, because notification credentials and monitor configuration can be sensitive. - Review container and host logs for unexpected restarts, image pulls, mounts, or privileged processes.
Do not assume that changing the socket mount to read-only solves the problem. Docker’s Unix socket is an API endpoint; the relevant risk is the daemon operations available through that endpoint, not merely whether a file can be written.
Monitor a Docker host somewhere else
For a remote host, Kuma’s Docker monitor connects to the remote Docker daemon over TCP. This requires a TCP host entry in the daemon configuration, a Docker restart, and a matching Docker host definition in Kuma. The daemon’s configuration format varies by operating system and installation, so use the syntax appropriate to your Docker Engine rather than copying a Linux-only file path into another platform.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Why port 2375 is not a safe default
The monitoring guide shows port 2375 as an insecure example for a closed, controlled network. An unauthenticated Docker API on that port should never be bound to a public interface or forwarded through the internet. Anyone who can reach it may be able to control the daemon. If you use such an endpoint temporarily in a lab, bind it to a private interface, firewall it to the Kuma host, and remove it when testing ends.
Use port 2376 with mutual TLS
The safer configuration enables TLS, commonly on port 2376, and supplies a certificate authority, client certificate, and client key. The Docker daemon must be configured to require and validate client certificates; merely encrypting a connection without client authentication does not provide the same access control.
- Issue a CA and a client certificate whose identity is restricted to the monitoring use case. Keep the private key readable only by the Kuma process.
- Configure the remote Docker daemon with its TLS certificate and key, require client verification, and listen only on the private address needed by Kuma.
- Permit the Kuma host’s address through the remote host firewall. Deny all other sources and avoid internet-wide exposure.
- Restart Docker after changing its daemon configuration, then verify locally on the remote host that the daemon came back up before troubleshooting Kuma.
- In Kuma, add a Docker host and select the TCP connection option. Enter the remote address and port, enable TLS, and provide the certificate files.
Place certificates where Kuma can load them
For TLS connections, Kuma looks under data/docker-tls/ by default. You can change that location with the DOCKER_TLS_DIR_PATH environment variable. Under the selected directory, Kuma can load ca.pem, key.pem, and cert.pem from a directory matching the host configuration. Mount this certificate directory into the Kuma container without exposing it through a public web path, and set ownership and permissions so the Kuma process can read the files but ordinary users cannot.
Certificate rotation is an operating task, not a one-time setup detail. Record expiration dates, replace the CA or client files before they expire, restart or reload the component that caches them as required, and test a Docker monitor after each change. If you revoke a client certificate, remove the old files from Kuma as well.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Set up the monitor after the connection works
First establish that Kuma can see the Docker host; then select the individual container to monitor. Avoid trying to diagnose a missing container by changing alert settings. A missing host, a failed TLS handshake, and a stopped container are different failure classes.
- Host connection failure: check the remote address, firewall rule, listener address, and whether Docker restarted successfully.
- TLS failure: check that the CA signs the daemon certificate, the certificate names match the address Kuma uses, the client certificate is accepted, and the files are mounted at the path Kuma expects.
- Container not listed: confirm that the selected Docker endpoint is the daemon where the container actually runs and that the container has not been removed or renamed.
- Container reports stopped: inspect the container’s exit state and logs on the Docker host; Kuma is reporting what the daemon says rather than repairing the workload.
After saving the Docker monitor, stop a disposable test container or use a maintenance window to verify that Kuma changes state and sends the expected notification. Restore the service and verify recovery notifications if you rely on them for operations.
Pair container state with service health
A practical production setup often uses two monitors for one service:
- Create a Docker monitor for the container, so a crash or stop is visible even when the application endpoint is unavailable.
- Create an HTTP monitor for the public or internal URL, with an expected status and, where appropriate, a keyword check for a response element that proves the application rendered correctly.
- For a non-HTTP service, use a TCP monitor against the service port or a ping monitor for host reachability.
- Route both monitors to the notification channels your on-call staff actually watches.
This avoids a common blind spot: a container can stay in a running state while its application thread is wedged, its database is unavailable, or its reverse proxy returns an error. Conversely, an application check can fail because of a network path while the container itself remains healthy; seeing both signals shortens diagnosis.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Notifications and operating cadence
Kuma supports Telegram, Discord, Gotify, Slack, Pushover, SMTP email, and more than 90 notification services according to the current README. Configure at least one primary channel and, for important services, a separate fallback channel. Send a test message before relying on it.
The documented 20-second interval is useful for responsive detection, but tune notification behavior to the service. A flapping container may generate noise if every short restart creates an alert. Use maintenance windows for planned deployments, make recovery messages visible, and document which team owns each monitored container. Status pages can communicate an outage without granting visitors access to the Docker host or the Kuma administration interface.
Troubleshoot common failures
Kuma starts, but no Docker containers appear
- Confirm the running Kuma container has the socket mapping with
docker inspect uptime-kuma. - Check that the source path exists on the host and is the Docker socket used by that Docker installation.
- Recreate the container after editing Compose; editing a file without applying it does not change an already-running container.
- Read Kuma’s logs and verify that the process can access the socket.
The local monitor worked until a Docker or host upgrade
Check whether the daemon socket path, Docker installation, or container permissions changed. Reconfirm the mapping after upgrades and verify that the Kuma data volume is still the same persistent local volume. Do not “fix” the symptom by exposing an unauthenticated TCP endpoint.
The remote host refuses the connection
On the remote machine, verify that Docker is listening on the intended private address and that its service restarted without a configuration error. Then test firewall reachability from the Kuma host. A refused connection usually indicates a listener or firewall issue; a timeout commonly points to filtering or routing.
TLS certificates are rejected
Check the complete chain: Kuma’s ca.pem must trust the daemon certificate; the daemon must trust the client certificate; the certificate subject or SAN must match the hostname or address used by Kuma; and the key and certificate must belong together. Confirm that the files are inside Kuma’s mounted data/docker-tls/ directory or the directory named by DOCKER_TLS_DIR_PATH, with the expected filenames and permissions.
Alerts arrive, but the service is still broken
Add an application-level HTTP, TCP, ping, or keyword monitor. A Docker state monitor is not an end-to-end test and cannot validate every dependency behind the container.
Deployment checklist
- Choose local socket monitoring only when its daemon-level authority fits your trust model.
- Keep Kuma’s
/app/dataon a local Docker volume or directory, never NFS. - Restrict port
3001to a trusted management network or VPN. - Mount
/var/run/docker.sockonly when monitoring the local daemon and understand that it grants full daemon control. - For another host, use a private, TLS-protected Docker endpoint with client certificates.
- Firewall the remote Docker listener to the Kuma host and do not expose port
2375to the internet. - Store and rotate CA, client certificate, and key files securely.
- Pair container checks with application checks for services where “running” is not enough.
- Test both alert and recovery paths before putting the monitor on call.
The Bottom Line
Uptime Kuma can monitor local Docker containers through a mounted Docker socket and remote containers through a Docker TCP endpoint. The socket is simplest but gives Kuma full control of the local daemon, so protect the Kuma interface and host. For remote monitoring, use TLS with client certificates, strict firewall rules, and an application-level monitor alongside the Docker-state check.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors
