What
The Dozzle package (#160) works, but its per-container CPU and memory graphs are blank: GET /containers/{id}/stats is outside the container-logs@1 grant and answers
403 not permitted by the container-logs grant
Confirmed on a VM, probing the proxy from inside the deployment:
GET /containers/<id>/json 200 (redacted)
GET /containers/<id>/logs 200
GET /containers/<id>/stats?stream=0 403 <-- this
Everything Dozzle needs to function works — it streams every app's logs, grouped by sh.hola.app. This is the one feature that degrades.
The decision
Widening a grant is the kind of thing worth doing deliberately, so recording the case rather than just doing it.
For allowing it. Stats are resource counters — CPU, memory, network and block I/O — for containers the caller can already enumerate and read the logs of. They describe load, not configuration: no environment, no mounts, no network topology, no secrets. A log viewer showing "this container is pinned at 100% CPU" next to its logs is genuinely useful, and any log/metrics collector packaged later (Alloy, Vector, Beszel) will want the same endpoint, so this will come up again.
Against. Nothing needs it. The grant is deliberately the smallest thing that serves log collection, and "useful to have" is exactly the pressure that turns a narrow capability into a broad one. Stats also stream continuously, which is a different traffic profile from the request/response calls the proxy mostly serves.
Middle option. Allow it as a stream kind like logs and events, but only the non-streaming form (?stream=0), so it stays a request/response read.
Where the change would go
try-hola/hola, in packages/server/src/lib/docker-proxy.ts — one line in decide() plus a test, the same shape as try-hola/hola#468. Not an app-side change at all; this issue exists because the symptom is in this package and the next collector packaged here will hit it too.
Related
🤖 Generated with Claude Code
https://claude.ai/code/session_01Vck5KSX2CLxhohx14nb5Sh
What
The Dozzle package (#160) works, but its per-container CPU and memory graphs are blank:
GET /containers/{id}/statsis outside thecontainer-logs@1grant and answersConfirmed on a VM, probing the proxy from inside the deployment:
Everything Dozzle needs to function works — it streams every app's logs, grouped by
sh.hola.app. This is the one feature that degrades.The decision
Widening a grant is the kind of thing worth doing deliberately, so recording the case rather than just doing it.
For allowing it. Stats are resource counters — CPU, memory, network and block I/O — for containers the caller can already enumerate and read the logs of. They describe load, not configuration: no environment, no mounts, no network topology, no secrets. A log viewer showing "this container is pinned at 100% CPU" next to its logs is genuinely useful, and any log/metrics collector packaged later (Alloy, Vector, Beszel) will want the same endpoint, so this will come up again.
Against. Nothing needs it. The grant is deliberately the smallest thing that serves log collection, and "useful to have" is exactly the pressure that turns a narrow capability into a broad one. Stats also stream continuously, which is a different traffic profile from the request/response calls the proxy mostly serves.
Middle option. Allow it as a
streamkind like logs and events, but only the non-streaming form (?stream=0), so it stays a request/response read.Where the change would go
try-hola/hola, in
packages/server/src/lib/docker-proxy.ts— one line indecide()plus a test, the same shape as try-hola/hola#468. Not an app-side change at all; this issue exists because the symptom is in this package and the next collector packaged here will hit it too.Related
/info, inspect), all fixed./containers/jsonpasses through unredacted).consumes: container-logsvocabulary; feat(dozzle): live log viewer — the first container-logs@1 provider (0.1.0) #160 supersedes its approach and should probably close it once merged.🤖 Generated with Claude Code
https://claude.ai/code/session_01Vck5KSX2CLxhohx14nb5Sh