Dockpeek

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting size.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the dashboard.

Dockpeek serves plain HTTP on port 80. For production, terminate TLS in front of it with your own domain (see Maintenance) and restrict 80/tcp to trusted networks, because the dashboard reveals your container and port layout.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Dockpeek by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:dockpeek:default:latest
az vm create \
  --resource-group <your-rg> \
  --name dockpeek \
  --image sac1647283583153:dockpeek:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name dockpeek --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active docker.service nginx.service
sudo docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'

Both services report active. Docker manages two containers: dockpeek (the dashboard, bound to the loopback connector 127.0.0.1:8000) and dockpeek-socket-proxy (the read-only Docker API gateway). nginx fronts the dashboard on port 80.

Step 5 - Retrieve your admin password

First boot generates a unique Dockpeek admin password for your VM and writes it to a root-only file:

sudo cat /root/dockpeek-credentials.txt

The file contains DOCKPEEK_USERNAME (always admin), DOCKPEEK_PASSWORD and the URL to open. Store the password somewhere safe.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes. Request it with:

curl -s http://localhost/healthz

The endpoint returns ok. It never requires authentication, so it is safe to use for an Azure Load Balancer health probe. Dockpeek's own /health endpoint (curl -s http://localhost/health) also returns a small JSON status object.

Step 7 - Understand the security posture (read-only Docker socket)

Dockpeek reads the Docker API, which is powerful: a container with write access to the Docker socket is effectively root on the host. This image is deliberately built so that Dockpeek can only ever read.

The raw Docker socket is never mounted into Dockpeek. Instead, it is mounted read-only into a small socket-proxy that exposes only the read endpoints the dashboard needs, and every write verb is refused. Inspect the setup with:

# Dockpeek itself has NO Docker socket mounted
sudo docker inspect dockpeek --format 'Dockpeek socket mounts: {{range .Mounts}}{{.Source}} {{end}}'
# The socket-proxy holds the socket READ-ONLY (RW=false)
sudo docker inspect dockpeek-socket-proxy --format 'socket-proxy docker.sock RW={{range .Mounts}}{{if eq .Destination "/var/run/docker.sock"}}{{.RW}}{{end}}{{end}}'
# Only read GET endpoints are enabled; POST and all start/stop/restart flags are 0
sudo docker inspect dockpeek-socket-proxy --format '{{range .Config.Env}}{{println .}}{{end}}' | grep -E '^(CONTAINERS|IMAGES|INFO|VERSION|PING|NETWORKS|POST|ALLOW_)='

Dockpeek socket mounts: is empty, RW=false, and POST=0. As a result, Dockpeek's optional container action buttons (start/stop/restart/update/prune) are intentionally inert on this image. If you want those actions and accept that they give the dashboard write access to Docker, see Maintenance.

Step 8 - Verify authentication from the command line

Dockpeek carries its own sign-in. The upstream default admin/admin is rejected, and only the per-VM password authenticates. The dashboard data lives at /data, which requires a login.

The command below reads your unique password from the credentials file, so you never have to type it:

PW=$(sudo grep '^DOCKPEEK_PASSWORD=' /root/dockpeek-credentials.txt | cut -d= -f2-)
J=$(mktemp)
# the upstream default admin/admin is denied (no access to /data)
curl -s -c "$J" --data 'username=admin&password=admin' http://127.0.0.1/login -o /dev/null echo "default admin/admin -> /data HTTP $(curl -s -b "$J" -o /dev/null -w '%{http_code}' http://127.0.0.1/data)"
# the per-VM password authenticates and lists this host's containers curl -s -c "$J" --data "username=admin&password=$PW" http://127.0.0.1/login -o /dev/null echo "per-VM password -> /data HTTP $(curl -s -b "$J" -o /dev/null -w '%{http_code}' http://127.0.0.1/data)" rm -f "$J"

The default admin/admin returns a redirect, not 200. The per-VM password returns 200, and the JSON body lists the running containers on the host.

Step 9 - Sign in to the dashboard

Browse to http://<vm-public-ip>/. Dockpeek shows a sign-in page. Enter the username admin and the password from Step 5.

After you sign in, the dashboard lists every container on the host with its exposed ports, the image it runs and its status.

Step 10 - Find containers and open exposed services

Use the search box to filter by name, image, stack, #tag or :port. For example, type :8000 to show only containers exposing port 8000. Exposed ports appear as clickable links, so you can open a service in a new tab straight from the dashboard.

Step 11 - Check for image updates

Click Check for updates to have Dockpeek compare each running container's image against its registry. Dockpeek flags any container that has a newer image available.

Step 12 - Add a remote Docker host (optional)

Dockpeek can aggregate several Docker hosts on one dashboard. You do not install Dockpeek on the remote machine. Instead, expose its Docker API read-only (for example with a socket-proxy on that host) and point Dockpeek at it with environment variables.

To add a second host, recreate the Dockpeek container with the extra variables. Substitute your remote host's read-only API address:

# on the REMOTE host, run a read-only socket-proxy that listens on tcp://<remote-ip>:2375
# then, on this VM, recreate dockpeek with the remote host added:
sudo docker rm -f dockpeek
sudo docker run -d --name dockpeek --restart=always \
  --network dockpeek-net -p 127.0.0.1:8000:8000 \
  --security-opt no-new-privileges --cap-drop ALL \
  -e USERNAME=admin -e PASSWORD='<your-existing-password>' -e SECRET_KEY='<your-existing-secret>' \
  -e DOCKER_HOST=tcp://dockpeek-socket-proxy:2375 -e DOCKER_HOST_NAME=local \
  -e DOCKER_HOST_2_URL=tcp://<remote-ip>:2375 -e DOCKER_HOST_2_NAME='Production' \
  dockpeek/dockpeek:v1.7.3

Only ever expose the remote Docker API read-only, and restrict it to Dockpeek's source address. A writable Docker API on the network is equivalent to remote root.

Maintenance

• Password: first boot sets the admin password and stores it in /root/dockpeek-credentials.txt. To rotate it, recreate the dockpeek container with a new PASSWORD environment variable.
• Upgrades: Dockpeek runs from the pinned dockpeek/dockpeek:v1.7.3 image (referenced by digest). To upgrade, pull a newer tag, run docker rm -f dockpeek, and re-run the container with the same environment variables.
• Enabling container actions: this image ships the socket-proxy read-only, so Dockpeek cannot start, stop, restart or update containers. If you accept the risk, recreate the dockpeek-socket-proxy container with POST=1, ALLOW_START=1, ALLOW_STOP=1 and ALLOW_RESTARTS=1. This gives the dashboard write access to Docker, so restrict the dashboard tightly first.
• TLS: Dockpeek serves plain HTTP on port 80; before you run it in production, front it with TLS (for example certbot with your own domain), and restrict 80/tcp at the NSG to trusted networks.
• Docker: docker.service manages the host's Docker engine. The containers Dockpeek shows run directly on this host.
• Security patches: unattended-upgrades stays enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Dockpeek on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com