Dozzle: The Complete Guide to Real-Time Docker Log Viewing

Really useful walkthrough. I like that this goes beyond the usual “run this Docker command and you’re done” approach.

The distinction between Dozzle being a real-time log viewer rather than a log store is especially important. It’s easy to assume that because you can search what’s on screen, you’re getting proper historical log analysis too. The sections on /data, log rotation, reverse-proxy buffering, and the Docker socket security implications are the kind of details that save a lot of headaches later.

The MCP section also caught my attention. Giving an AI assistant access to logs sounds convenient, but logs can contain credentials, tokens, and personal data, so the access boundary matters just as much as whether the tools are technically “read-only.”

Overall, this feels like a guide written from actual operational experience rather than just documenting the happy path. The troubleshooting checklist alone is worth bookmarking.

plot twist: capacity charts without a signed tip are just a prettier slide.

1 cut: when the dispute hits, can a buyer GET proof of what ran, or only another compliance badge?

local flags help. receipts settle arguments.

plot twist: dashboards are not dispute-ready proof.

1 cut: can the buyer check what actually ran, or only another compliance badge?

local-by-default helps. cloud hops still need receipts when they happen.

Good point. “Read-only” only protects against mutation; it doesn’t limit what data the MCP client can actually see.

The important distinction is whether MCP requests inherit the same per-user filters and role restrictions as an authenticated web session, or whether the MCP credential represents a broader fixed identity. If it’s the latter, then the blast radius is much larger than the wording suggests.

I’ll clarify that distinction in the MCP/security section, because container visibility and authorization scope matter more here than simply calling the tools read-only.

The MCP section is the part I'd want a straighter answer on before turning it on. It says every tool is read-only, but read-only doesn't really close the exposure your own security section already flags: logs carry tokens and personal data, and an assistant that can fetch and search them can paste a secret into its own context or a downstream call just as easily as a shell command could delete something. The built-in auth section describes per-user filter and role restrictions (shell, actions, download, notifications, cloud), but nothing here says whether an MCP client inherits one specific user's filter and roles the way a logged-in web session does, or whether it authenticates as a single fixed identity with full container visibility regardless of who issued the credentials. If it's the latter, turning MCP on for an assistant that only needs one service's logs quietly hands it read access to every other container on the host too.