LogForge (the current release is branded Unicron) is a self-hosted observability appliance for Docker. One deployment gives you container health, status, logs, metrics, Docker events, file access and a browser terminal in a single interface, keeps the telemetry in your own environment, and — the part most dashboards leave out — can run guarded remediation against the containers it watches. The application source is Apache-2.0 licensed in the log-forge/unicron-source repository; the deployment files and installer live separately in log-forge/unicron-be.

What the interface covers

Open a workload and the page stays in that context, with tabs for Summary, Logs, Metrics, Alerts, Health, Files and Terminal. Summary reports the current state of the container; Logs searches retained history and can follow live output; Metrics charts resource use over a selected window next to the latest reported value, with CPU measured so that 100% equals one fully used core; Files browses the container filesystem. Terminal opens a shell inside the container when the signed-in account is permitted to, which is what makes the same screen usable for both investigation and a quick fix.

Monitoring a fleet, not one host

The appliance watches Docker on the host it is deployed to out of the box. Remote Docker hosts join through a Remote Agent you enrol with a command generated in the UI; enrolment issues an mTLS identity, and the agent forwards logs, metrics and container events back over the published agent port. Kubernetes clusters connect through a separate agent. You still need a way to run the enrolment command on the far host, but it does not have to publish its Docker API to the appliance to be monitored.

Alerts that can act

Rules are written against logs, metrics and container events, either from scratch or from the shipped templates grouped into stability, performance, log and security signals. A firing rule produces an alert with history, acknowledgement and delivery tracking, and notifications go out through email, Slack, Microsoft Teams, Discord, Telegram, Gotify and generic webhooks. The distinguishing feature is the remediation side: a rule can restart, stop, start or kill a container, or run a script, with cooldowns, backoff, rate limits and verification delays so that a flapping container is not restarted in a loop. Access to the appliance itself is protected by local operator authentication with session handling, and credentials it holds are encrypted and covered by redaction patterns.

Deployment and requirements

Installation is a clone of the deployment repository followed by its installer: git clone https://github.com/log-forge/unicron-be.git, then run install.sh from inside the checkout. The installer pulls the signed release images and records the exact version, so there is no registry login and no source build. The host must be a native Linux AMD64 Docker host with Git, Docker Engine, Compose v2, systemd and outbound access to GitHub and the image registries; a separate air-gapped procedure covers isolated servers, and ARM hardware qualification is documented as separate work. Defaults are https://localhost on ports 443 and 9443 with the data directory inside the clone. To change that, create .env before the first start and set CENTRAL_PUBLIC_URL plus CENTRAL_DEPLOYMENT_DNS_NAMES to a reachable hostname, CENTRAL_HTTPS_PORT and CENTRAL_MTLS_PORT for the ports, and CENTRAL_OPERATOR_DATA_ROOT for storage elsewhere. The appliance issues its own certificate, so its root CA has to be trusted on client devices. The stack bundles PostgreSQL, MongoDB, Redis, Step CA, Traefik, VictoriaMetrics, VictoriaLogs and an OpenTelemetry collector, so size the host for that plus the log retention you want. The documentation is at http://www.logforge.dev/docs.

Editions

LogForge ships in two editions: Community, which is free, and Business, which is activated with a licence. The free self-hosted product is the one described above — Docker and Kubernetes visibility, agents, retained logs and metrics, alert rules, notifications and the guarded actions all belong to it. Above the appliance the vendor also sells Cirdan, an AI-native layer that builds a graph of system knowledge from the same telemetry and can investigate incidents and carry out operator-approved remediation. The appliance does not depend on it.