[opensourcedex]

maintenant is a free, open source monitoring & observability project written in Go and released under Apache-2.0. It has 532 GitHub stars, 25 forks and 3 open issues, and was last pushed 4 days ago. On this registry it ranks #265 of 270 tracked projects in Monitoring & Observability, with 5 head-to-head comparisons available. It gained 14 stars over the last 30 tracked days.

What is maintenant?

maintenant is a self-hosted monitoring tool for Docker, Kubernetes and uptime checks that ships as a single Go binary and is aimed at homelab operators and small operations teams who want one container instead of a ten-component observability stack.

What it is

maintenant is an open-source monitoring server written in Go and licensed under AGPL-3.0. It lives in the container and cloud-native operations ecosystem: it connects to a Docker socket or to a Kubernetes API, discovers what is already running, and reports container state, resource use, logs, certificate expiry, cron deadlines and image updates from one process. The project positions itself as a grafana-alternative and as the single replacement for the stack a team would otherwise assemble from Prometheus, Grafana, Alertmanager, node-exporter, cAdvisor, blackbox-exporter, an ssl_exporter, Loki, Promtail, Trivy, Diun or Watchtower, Dozzle and Pushgateway.

The concrete problem it solves is the operational weight of that assembly. Ten-odd components each carry their own configuration, upgrades and dashboards, and they exist to answer one question: is the stack up, and what is burning? maintenant answers the same question with one container and no PromQL, no exporters and no dashboards to build. Docker discovery is automatic rather than declared: the entrypoint reads the mounted socket's group and grants it to the unprivileged user, which also covers Swarm, where docker stack deploy silently ignores group_add.

Key capabilities

  • Container state, health checks and restart loops are auto-discovered, along with CPU, memory, network and disk use per container and per host.
  • HTTP and TCP endpoint checks are declared as Docker labels, and TLS certificate expiry and chain validation are monitored alongside them.
  • Cron and heartbeat deadlines are tracked directly instead of through a Pushgateway plus hand-written alert rules.
  • Live container logs are shown with stdout and stderr demuxed, replacing Dozzle or Loki with Promtail.
  • Image update detection comes with compose-aware update and rollback commands, the role Diun or Watchtower would fill.
  • A network exposure audit reports 0.0.0.0 binds, exposed database ports, host network use and privileged containers, for which the README notes there is no standard equivalent.
  • Alerts route to Discord, webhooks, email, Telegram, Slack and Teams with escalation, and the whole binary idles under 30 MB of RAM.

Who uses it and how

  • Homelab operators, a use case reflected in the project's homelab topic, run it as one entry in a compose file and get container, resource and log visibility without deploying exporters.
  • Small DevOps teams use it to retire a self-built monitoring stack, replacing cAdvisor, node-exporter and Grafana dashboards they would otherwise maintain and upgrade separately.
  • Kubernetes users apply it with kubectl apply -f deploy/kubernetes/; the in-cluster API is auto-detected, RBAC is read-only, namespace filtering is available, and Deployments, DaemonSets and StatefulSets are treated as first-class citizens.
  • Bare Linux hosts without any container runtime run the statically linked systemd build for amd64 and arm64, where endpoints, certificates and heartbeats work immediately and container monitoring switches on by itself when a runtime appears.
  • Cloud deployments start from a single cloud-init file on Hetzner Cloud, DigitalOcean, Scaleway, OVHcloud or Vultr.

Getting started

The documented path is a docker-compose.yml using the image ghcr.io/kolapsis/maintenant:latest, followed by docker compose up -d and opening http://localhost:8080. Kubernetes and bare-Linux installs are also documented, the latter through curl -fsSL https://install.maintenant.dev | sudo bash.

How it compares

Within this registry it stands as a single-binary alternative to the multi-component open-source monitoring stack named in its own README, covering the roles of Prometheus, Grafana, Alertmanager, cAdvisor, node-exporter, blackbox-exporter, an ssl_exporter, Loki, Promtail, Trivy, Diun, Watchtower, Dozzle and Pushgateway in one Go process. Its distinguishing axes are deployment shape and effort: one container in place of roughly ten services, label-driven checks in place of per-target configuration files, and no PromQL or dashboard authoring required.

When to use it — and when not to

A self-hoster must operate the Docker socket mount, the read-only /proc mount and the SQLite database file at /data/maintenant.db, and the README states plainly that the UI and API carry no authentication of their own, so an authenticating reverse proxy must sit in front or the port must be bound to 127.0.0.1. Teams that need built-in multi-user authentication, or that have already invested in PromQL and custom dashboards, should look elsewhere, and CVE enrichment with a per-container risk score is listed only for the Personal edition rather than for every install.

project readme (upstream, from github) — read inline

maintenant

Drop a container. Your stack is monitored.
Docker, Kubernetes, uptime, TLS, cron jobs, live logs, image updates, CVEs: auto-discovered, alerting on every one of them,
from a single Go binary that idles under 30 MB of RAM. No PromQL, no exporters, no dashboards to build.

Release Docker License Stars

Quick Start  •  Why maintenant  •  Features  •  Documentation  •  Editions  •  Pricing

Quick Start

# docker-compose.yml
services:
  maintenant:
    image: ghcr.io/kolapsis/maintenant:latest
    ports:
      # ⚠️  SECURITY: publishes the UI/API (no authentication of their own) on
      # every interface; put an auth reverse proxy in front, or bind "127.0.0.1:8080:8080". See https://docs.maintenant.dev/security/#reverse-proxy-setup.
      - "8080:8080"
    read_only: true
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:noexec,nosuid,size=64m
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /proc:/host/proc:ro
      - maintenant-data:/data
    environment:
      MAINTENANT_ADDR: "0.0.0.0:8080"
      MAINTENANT_DB: "/data/maintenant.db"
    restart: unless-stopped

volumes:
  maintenant-data:

docker compose up -d

Open http://localhost:8080. Your containers are already there, with their health, restart loops, resources and logs. Nothing to configure.

Docker socket access is automatic: the entrypoint reads the mounted socket's group and grants it to the unprivileged user, on Compose and on Swarm (where docker stack deploy silently ignores group_add). If containers do not show up, see Troubleshooting.

Kubernetes

kubectl apply -f deploy/kubernetes/

In-cluster API auto-detected, read-only RBAC, namespace filtering, workloads (Deployments, DaemonSets, StatefulSets) as first-class citizens. Kubernetes guide.

Bare Linux, no Docker at all (systemd, amd64 and arm64, statically linked)

curl -fsSL https://install.maintenant.dev | sudo bash

Endpoints, certificates and heartbeats work without any container runtime. Container monitoring switches on by itself the moment a runtime shows up. Install documentation for pinned versions, air-gapped installs and supply-chain verification.

Cloud: one cloud-init file boots a hardened host with maintenant running on Hetzner Cloud, DigitalOcean, Scaleway, OVHcloud or Vultr.

Why maintenant?

Monitoring your own infrastructure with the standard stack means running Prometheus, Grafana, Alertmanager, node-exporter, cAdvisor, blackbox-exporter, a certificate exporter, Loki, Promtail, Trivy and something for image updates. Ten-odd components, each with its own config, upgrades and dashboards, to answer one question: is my stack up, and what is burning?

maintenant answers that question with one container.

Built into maintenant What you would assemble instead
Container state, health checks, restart loops cAdvisor + node-exporter + alert rules you write
CPU, memory, network and disk, per container and per host cAdvisor + node-exporter + Grafana dashboards you build
HTTP / TCP endpoint checks, declared as Docker labels blackbox-exporter + a config file per target
TLS certificate expiry and chain validation ssl_exporter
Cron and heartbeat deadlines Pushgateway + alert rules you write
Live container logs, stdout/stderr demuxed Dozzle, or Loki + Promtail
Image update detection, with compose-aware update and rollback commands Diun or Watchtower
Network exposure audit: 0.0.0.0 binds, exposed database ports, host network, privileged containers nothing standard
CVE enrichment and per-container risk score (Personal) Trivy + its exporter
Alerts routed to Discord, webhooks, email, Telegram, Slack and Teams, with escalation (Pro) Alertmanager
Public status page with incidents and subscribers Cachet, Uptime Kuma, or a SaaS
One real-time dashboard for all of the above Grafana + dashboards you build and maintain

Do I still need Prometheus? maintenant monitors your infrastructure. Prometheus monitors your application. There is no PromQL here, no custom exporters, no panels to design: maintenant already knows what a container, a certificate, an endpoint, a cron job and a CVE are, and starts watching them the moment they appear. If you ship business metrics and write your own queries, keep Prometheus for that. The two answer different questions, and plenty of people run both.

Against the tools usually stacked up next to it:

maintenant Uptime Kuma Portainer Dozzle
Container auto-discovery Yes No Yes Yes
Live container logs Yes No Yes Yes
HTTP/TCP endpoint checks Yes Yes No No
Cron/heartbeat monitoring Yes Yes No No
SSL certificate tracking Yes Yes No No
CPU/memory/network metrics Yes No Limited No
Image update detection Yes No Yes No
Network security insights Yes No No No
CVE enrichment, risk scoring Personal No No No
Public status page Yes Yes No No
Alerting with routing Yes Yes Limited No
Kubernetes native Yes No Yes No
Single binary, zero deps Yes Node.js Docker API Docker API
Runs without a runtime Yes No No No

One container. One dashboard. Everything monitored.

Screenshots


Dashboard: uptime, response times, resources, unified monitors

Unified alerts across every source
Security posture with CVE enrichment and risk scoring (Personal)
More screenshots

Container auto-discovery
Resources per container and per host

Endpoint monitoring
Heartbeat and cron monitoring

TLS certificate tracking
Update intelligence

Network security insights
Your AI assistant, plugged in over MCP

Status page, all operational
Status page, degraded

Features

Every section links to its full documentation.

Container monitoring

Zero-config auto-discovery for Docker, Docker Swarm and Kubernetes. Every container is tracked the moment it starts: state changes, health checks, restart loops, live log streaming with stdout/stderr demux. Compose projects are grouped automatically. Read-only: maintenant observes, it never touches your containers.

Multi-host monitoring

One central server, lightweight read-only agents on your other hosts, a persistent mutually-authenticated gRPC stream between them. No shared database, no message queue, no PKI to run: an agent enrolls with a one-time token and an Ed25519 keypair generated locally, and every stream is challenge-response authenticated. Revoke it from the UI at any time.

# On each remote host, one command, generated for you in the UI
docker run -d --name maintenant-agent --restart unless-stopped \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -v /proc:/host/proc:ro \
  -v maintenant-agent-data:/var/lib/maintenant \
  ghcr.io/kolapsis/maintenant:latest \
  --mode=agent --server=grpcs://monitoring.example.com \
  --enrollment-token=mnt_enr_XXXXXXXXXXXXXXXX --label="prod-worker-01"

Agents detect their local runtime (Docker, Swarm or Kubernetes), stream container state, endpoints, certificates, host CPU/memory/disk, and reconnect on their own. Every entity is attributed to its host, so nothing gets mixed across machines. Personal: up to 20 remote machines. Pro: unlimited.

Update intelligence

Scans OCI registries and compares digests, so you know which images have an update before you docker pull blindly. Compose-aware update and rollback commands, with the right --project-directory. No Diun, no Watchtower, no extra container: it is part of the monitor.

Endpoint monitoring

HTTP and TCP checks declared as Docker labels, picked up when the container starts. Response times, uptime history, 90-day sparklines, failure and recovery thresholds.

labels:
  maintenant.endpoint.http: "https://api:3000/health"
  maintenant.endpoint.interval: "15s"
  maintenant.endpoint.failure-threshold: "3"

Heartbeat and cron monitoring

Create a monitor, get a URL, add one curl to the job. maintenant tracks start and finish, duration, exit code, and alerts when the deadline is missed.

curl -fsS -o /dev/null https://now.example.com/ping/{uuid}/$?

TLS certificate monitoring

Auto-detected from your HTTPS endpoints, plus standalone monitors for any domain. Full chain validation, alerts at 30, 14, 7, 3 and 1 day before expiry, OCSP stapling checks (Personal).

Resource metrics

Real-time CPU, memory, network and disk I/O per container and per host, top-consumers view for instant triage, per-container thresholds with debounce. History: 7 days on Community, 30 on Personal, 90 on Pro.

Network security insights

Flags what should not be there: ports bound to 0.0.0.0, exposed database ports, host-network mode, privileged containers, Kubernetes NodePort and LoadBalancer services without a NetworkPolicy. Each image is mapped to its software ecosystem through OCI manifest inspection. Personal adds CVE enrichment, a risk score per container and a unified security posture dashboard.

Alert engine

One alert pipeline for every source: container restart loops and unhealthy checks, endpoint failures, missed heartbeats, expiring or invalid certificates, CPU and memory thresholds, available updates. Channels are silent by default and routed through triggers (severity, source, scope, tags). Silence rules for planned maintenance, exponential backoff on delivery.

Channels: Discord and webhooks (Community), email and Telegram (Personal), Slack and Microsoft Teams (Pro). Pro adds escalation policies that page the on-call, then the backup, then the lead, plus per-entity routing and maintenance windows.

Public status page

Real-time status page with severity aggregation across every monitor, live over SSE. Personal adds incident timelines, Pro adds subscriber notifications (email and webhook) and branding.

MCP server

Built-in Model Context Protocol server. Ask your AI assistant what is burning, read a container's logs, check the alert queue, acknowledge an alert, open an incident. stdio and Streamable HTTP transports, full OAuth2 for remote clients (Claude web, mobile and Desktop).

Configuration

Everything is driven by Docker labels and a handful of environment variables. No YAML to maintain.

  • Environment variables: bind address, database, base URL, PostgreSQL DSN, MCP, Kubernetes namespaces, license key, telemetry.
  • Docker labels reference: endpoints, TLS, alert severity, restart thresholds, channel routing, grouping, ignore.
  • REST API under /api/v1/, plus an SSE event stream.
Full stack example
services:
  maintenant:
    image: ghcr.io/kolapsis/maintenant:latest
    ports:
      # ⚠️  SECURITY: publishes the UI/API (no authentication of their own) on
      # every interface; put an auth reverse proxy in front, or bind "127.0.0.1:8080:8080". See https://docs.maintenant.dev/security/#reverse-proxy-setup.
      - "8080:8080"
    read_only: true
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:noexec,nosuid,size=64m
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /proc:/host/proc:ro
      - maintenant-data:/data
    environment:
      MAINTENANT_ADDR: "0.0.0.0:8080"
      MAINTENANT_DB: "/data/maintenant.db"

  api:
    image: myapp:latest
    labels:
      maintenant.group: "production"
      maintenant.endpoint.http: "http://api:3000/health"
      maintenant.endpoint.interval: "15s"
      maintenant.alert.severity: "critical"
      maintenant.alert.channels: "ops-webhook"

  postgres:
    image: postgres:16
    labels:
      maintenant.endpoint.tcp: "postgres:5432"
      maintenant.alert.severity: "critical"

  redis:
    image: redis:7-alpine
    labels:
      maintenant.endpoint.tcp: "redis:6379"

volumes:
  maintenant-data:

Security model

  • No built-in authentication, by design. Like Dozzle and Prometheus, maintenant sits behind your reverse proxy and auth middleware (Traefik or Caddy, Authelia or Authentik). /ping/{uuid} and /status/ are meant to stay public. Reverse proxy setup.
  • Read-only everywhere. Docker socket mounted :ro, read-only RBAC on Kubernetes, read-only agents. maintenant never starts, stops or modifies a container. A socket proxy is supported if you would rather not mount the socket at all.
  • Hardened container. Runs as nobody, read_only root filesystem, no-new-privileges.
  • Anonymous, opt-out telemetry. One counts-only snapshot per hour, no hostnames, IPs, names, URLs or keys, ever. MAINTENANT_DISABLE_TELEMETRY=1 turns it off with no background goroutine and no outbound packet. Exact payload and details.

Architecture

  • One binary, three modes. Go backend, Vue 3 frontend embedded via embed.FS, SQLite inside. The same file runs embedded (single host, default), server (central ingestion) and agent (remote host).
  • Zero dependencies. SQLite is the only datastore. No Redis, no queue, nothing to administer. A fleet operator may back the server on a PostgreSQL they already run; agents always stay on SQLite.
  • Runtime optional. Endpoints, certificates and heartbeats run without any Docker socket or Kubernetes API. Container monitoring resumes on its own when a runtime becomes reachable.
  • Real-time. SSE pushes every state change to the browser and to the status page instantly.
  • Under 30 MB of RAM at idle. Runs on a Raspberry Pi, a €4 VPS or a NAS.

Full write-up in the architecture documentation.

Editions

Community is free forever and runs production infrastructure every day: it is the full product on a single host, not a crippled trial. Personal is bought once. Pro is what a team needs.

Community Personal Pro
Price Free, AGPL-3.0 €149 once, for life €29/mo or €290/yr, 14-day trial
Hosts 1 up to 20 remote machines unlimited
Endpoints 10 unlimited unlimited
Heartbeats 5 unlimited unlimited
Certificates 5 unlimited unlimited
Resource history 7 days 30 days 90 days
Alert channels Discord, webhooks + email, Telegram, advanced filters + Slack, Teams, escalation, per-entity routing, maintenance windows
Security network insights + CVE enrichment, risk scoring, security posture, OCSP same
Status page 3 components unlimited, incident timelines + subscriber notifications, branding
Use anything your own infrastructure + running it for others, priority support

Personal covers one person on infrastructure they own or run for themselves, freelancers included, and ships with one year of updates (then €59 per extra year; every version released inside a paid year stays licensed for life). Pro adds the right to monitor other people's infrastructure. Enterprise (SSO, audit logs, SLAs, on-prem support): hello@kolapsis.com.

Paid editions are the same binary, self-hosted the same way. The key is verified against the license server and the signed answer is cached, so being offline for weeks changes nothing. Your monitoring data never leaves your infrastructure.

MAINTENANT_LICENSE_KEY=your-license-key   # Personal or Pro, restart, done

Buy Personal, €149 once →  ·  Start a 14-day Pro trial →
Stripe worldwide, Mollie in the EU (SEPA, iDEAL, Bancontact). VAT invoices. Cancel Pro anytime.

Support the project

maintenant is built by one developer in Bordeaux, France. No VC, no ads, no acquisition exit. 100% of revenue funds full-time development. Ranked by impact:

  1. Buy a licence. Personal if the infrastructure is yours, Pro if you run it for others. Unlocks features and pays for the roadmap. See editions →
  2. Sponsor. Any amount, one-off or monthly, credited below. GitHub Sponsors →
  3. Spread the word. Star the repo, share on HN, Lobsters, Reddit or LinkedIn. Discoverability is oxygen for indie projects.
  4. Tell me how you use it. Two minutes, read by the developer, quoted only with your permission. Give feedback →

Backers

Every Personal owner, Pro subscriber and GitHub sponsor keeps this project independent. Thank you.

GitHub Sponsors

Want your company logo here? Become a corporate sponsor: visibility for you, runway for the project.

Contributing

Code contributions are welcome. Open an issue first for bigger changes; small fixes, typos and docs, just send the PR.

License

Copyright 2025-2026 Benjamin Touchard / kOlapsis, Bordeaux, France.

Licensed under the GNU Affero General Public License v3.0 (AGPL-3.0) or a commercial license.


Lauréat de l'AAP Hyper Open X. Ce projet a été financé par le gouvernement dans le cadre de France 2030.
Winner of the Hyper Open X call for projects, funded by the French government under France 2030.

Frequently asked questions

Is maintenant free to use?

maintenant is open source under the Apache-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does maintenant do?

Self-hosted monitoring for Docker, Kubernetes and uptime. Single Go binary, no agent config, live alerts. Drop a container, your stack is monitored.

What is maintenant written in?

maintenant is primarily written in Go. Its source is publicly available at https://github.com/kOlapsis/maintenant, and it has 532 GitHub stars.