Dockpeek on Ubuntu 24.04 on Azure User Guide

Overview

Dockpeek gives you a single web page that shows every Docker container on your host: which are running, the ports they expose, quick links to open those services in a browser, the image each container runs, and whether a newer image is available upstream. It is a read-only window onto Docker, so it is a natural home dashboard for a container host without handing anyone control of the engine.

The cloudimg image installs Docker CE from the official Docker repository and runs Dockpeek 1.7.3 as a container (managed by Docker with a restart policy), bound to the loopback connector 127.0.0.1:8000 behind an nginx reverse proxy on port 80. Dockpeek reads the Docker API read-only through a restricted socket-proxy rather than touching the raw Docker socket directly, so the dashboard can enumerate your containers without being able to start, stop or create anything on the host. Dockpeek has its own sign-in, and a unique admin password is generated on the first boot of every VM, so there is no default login to change. Backed by 24/7 cloudimg support.

What is included:

• Dockpeek 1.7.3 running as a container managed by Docker (pinned by image digest)
• Docker CE preinstalled from the official Docker apt repository
• The Dockpeek web dashboard on :80, fronted by nginx
• A restricted socket-proxy that exposes the Docker API read-only (containers/images/info only); the raw Docker socket is never mounted into Dockpeek
• Dockpeek published to the loopback interface only; nginx is the single public front door
• A unique admin password generated on first boot and recorded in a root-only file (username admin)
• docker.service + nginx.service as systemd units, enabled and active
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting point. NSG inbound: allow 22/tcp from your management network and 80/tcp for the dashboard. Dockpeek serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain (see Maintenance) and restrict 80/tcp to trusted networks, since the dashboard reveals your container and port layout.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Dockpeek by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name dockpeek \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name dockpeek --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active docker.service nginx.service
sudo docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'

Both services report active. Docker manages two containers: dockpeek (the dashboard, bound to the loopback connector 127.0.0.1:8000) and dockpeek-socket-proxy (the read-only Docker API gateway). nginx fronts the dashboard on port 80.

Step 5 - Retrieve your admin password

The Dockpeek admin password is generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/dockpeek-credentials.txt

This file contains DOCKPEEK_USERNAME (always admin), DOCKPEEK_PASSWORD and the URL to open. Store the password somewhere safe.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/healthz

It returns ok. This endpoint never requires authentication, so it is safe for an Azure Load Balancer health probe. Dockpeek's own /health endpoint (curl -s http://localhost/health) returns a small JSON status object as well.

Step 7 - Understand the security posture (read-only Docker socket)

Dockpeek reads the Docker API, which is powerful: a container with write access to the Docker socket is effectively root on the host. This image is deliberately built so Dockpeek can only ever read. The raw Docker socket is never mounted into Dockpeek; instead it is mounted read-only into a small socket-proxy that exposes only the read endpoints the dashboard needs, and every write verb is refused.

# Dockpeek itself has NO Docker socket mounted
sudo docker inspect dockpeek --format 'Dockpeek socket mounts: {{range .Mounts}}{{.Source}} {{end}}'
# The socket-proxy holds the socket READ-ONLY (RW=false)
sudo docker inspect dockpeek-socket-proxy --format 'socket-proxy docker.sock RW={{range .Mounts}}{{if eq .Destination "/var/run/docker.sock"}}{{.RW}}{{end}}{{end}}'
# Only read GET endpoints are enabled; POST and all start/stop/restart flags are 0
sudo docker inspect dockpeek-socket-proxy --format '{{range .Config.Env}}{{println .}}{{end}}' | grep -E '^(CONTAINERS|IMAGES|INFO|VERSION|PING|NETWORKS|POST|ALLOW_)='

Dockpeek socket mounts: is empty, RW=false, and POST=0. Because of this, Dockpeek's optional container action buttons (start/stop/restart/update/prune) are intentionally inert on this image. If you want those actions and accept that they give the dashboard write access to Docker, see Maintenance.

Step 8 - Verify authentication from the command line

Dockpeek carries its own sign-in. The upstream default admin/admin is rejected, and only the per-VM password authenticates. The dashboard data lives at /data, which requires a login. The command below reads your unique password from the credentials file, so you never have to type it:

PW=$(sudo grep '^DOCKPEEK_PASSWORD=' /root/dockpeek-credentials.txt | cut -d= -f2-)
J=$(mktemp)
# the upstream default admin/admin is denied (no access to /data)
curl -s -c "$J" --data 'username=admin&password=admin' http://127.0.0.1/login -o /dev/null
echo "default admin/admin -> /data HTTP $(curl -s -b "$J" -o /dev/null -w '%{http_code}' http://127.0.0.1/data)"
# the per-VM password authenticates and lists this host's containers
curl -s -c "$J" --data "username=admin&password=$PW" http://127.0.0.1/login -o /dev/null
echo "per-VM password -> /data HTTP $(curl -s -b "$J" -o /dev/null -w '%{http_code}' http://127.0.0.1/data)"
rm -f "$J"

The default admin/admin returns a redirect (not 200); the per-VM password returns 200, and the JSON body lists the running containers on the host.

Step 9 - Sign in to the dashboard

Browse to http://<vm-public-ip>/. Dockpeek shows a sign-in page; enter the username admin and the password from Step 5.

Once signed in, the dashboard lists every container on the host with its exposed ports, the image it runs and its status.

Step 10 - Find containers and open exposed services

Use the search box to filter by name, image, stack, #tag or :port. For example, type :8000 to show only containers exposing port 8000. Exposed ports render as clickable links, so you can open a service in a new tab straight from the dashboard.

Step 11 - Check for image updates

Click Check for updates to have Dockpeek compare each running container's image against its registry and flag any that have a newer image available.

Step 12 - Add a remote Docker host (optional)

Dockpeek can aggregate several Docker hosts on one dashboard. You do not install Dockpeek on the remote machine; you expose its Docker API read-only (for example with a socket-proxy on that host) and point Dockpeek at it with environment variables. To add a second host, recreate the Dockpeek container with the extra variables (substitute your remote host's read-only API address):

# on the REMOTE host, run a read-only socket-proxy that listens on tcp://<remote-ip>:2375
# then, on this VM, recreate dockpeek with the remote host added:
sudo docker rm -f dockpeek
sudo docker run -d --name dockpeek --restart=always \
  --network dockpeek-net -p 127.0.0.1:8000:8000 \
  --security-opt no-new-privileges --cap-drop ALL \
  -e USERNAME=admin -e PASSWORD='<your-existing-password>' -e SECRET_KEY='<your-existing-secret>' \
  -e DOCKER_HOST=tcp://dockpeek-socket-proxy:2375 -e DOCKER_HOST_NAME=local \
  -e DOCKER_HOST_2_URL=tcp://<remote-ip>:2375 -e DOCKER_HOST_2_NAME='Production' \
  dockpeek/dockpeek:v1.7.3

Only ever expose the remote Docker API read-only and restrict it to Dockpeek's source address; a writable Docker API on the network is equivalent to remote root.

Maintenance

• Password: the admin password is set on first boot and stored in /root/dockpeek-credentials.txt. To rotate it, recreate the dockpeek container with a new PASSWORD environment variable.
• Upgrades: Dockpeek runs from the pinned dockpeek/dockpeek:v1.7.3 image (referenced by digest). To upgrade, pull a newer tag, docker rm -f dockpeek and re-run it with the same environment variables.
• Enabling container actions: this image ships the socket-proxy read-only, so Dockpeek cannot start/stop/restart or update containers. If you accept the risk, recreate the dockpeek-socket-proxy container with POST=1, ALLOW_START=1, ALLOW_STOP=1 and ALLOW_RESTARTS=1 - this gives the dashboard write access to Docker, so restrict the dashboard tightly first.
• TLS: Dockpeek serves plain HTTP on port 80; front it with TLS (e.g. certbot with your own domain) before production use, and restrict 80/tcp at the NSG to trusted networks.
• Docker: the host's Docker engine is managed by docker.service; the containers Dockpeek shows run directly on this host.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.