maintenant is a self-hosted monitoring tool for Docker, Kubernetes and uptime checks that ships as a single Go binary and is aimed at homelab operators and small operations teams who want one container instead of a ten-component observability stack.

What it is

maintenant is an open-source monitoring server written in Go and licensed under AGPL-3.0. It lives in the container and cloud-native operations ecosystem: it connects to a Docker socket or to a Kubernetes API, discovers what is already running, and reports container state, resource use, logs, certificate expiry, cron deadlines and image updates from one process. The project positions itself as a grafana-alternative and as the single replacement for the stack a team would otherwise assemble from Prometheus, Grafana, Alertmanager, node-exporter, cAdvisor, blackbox-exporter, an ssl_exporter, Loki, Promtail, Trivy, Diun or Watchtower, Dozzle and Pushgateway.

The concrete problem it solves is the operational weight of that assembly. Ten-odd components each carry their own configuration, upgrades and dashboards, and they exist to answer one question: is the stack up, and what is burning? maintenant answers the same question with one container and no PromQL, no exporters and no dashboards to build. Docker discovery is automatic rather than declared: the entrypoint reads the mounted socket's group and grants it to the unprivileged user, which also covers Swarm, where docker stack deploy silently ignores group_add.

Key capabilities

• Container state, health checks and restart loops are auto-discovered, along with CPU, memory, network and disk use per container and per host.
• HTTP and TCP endpoint checks are declared as Docker labels, and TLS certificate expiry and chain validation are monitored alongside them.
• Cron and heartbeat deadlines are tracked directly instead of through a Pushgateway plus hand-written alert rules.
• Live container logs are shown with stdout and stderr demuxed, replacing Dozzle or Loki with Promtail.
• Image update detection comes with compose-aware update and rollback commands, the role Diun or Watchtower would fill.
• A network exposure audit reports 0.0.0.0 binds, exposed database ports, host network use and privileged containers, for which the README notes there is no standard equivalent.
• Alerts route to Discord, webhooks, email, Telegram, Slack and Teams with escalation, and the whole binary idles under 30 MB of RAM.

Who uses it and how

• Homelab operators, a use case reflected in the project's homelab topic, run it as one entry in a compose file and get container, resource and log visibility without deploying exporters.
• Small DevOps teams use it to retire a self-built monitoring stack, replacing cAdvisor, node-exporter and Grafana dashboards they would otherwise maintain and upgrade separately.
• Kubernetes users apply it with kubectl apply -f deploy/kubernetes/; the in-cluster API is auto-detected, RBAC is read-only, namespace filtering is available, and Deployments, DaemonSets and StatefulSets are treated as first-class citizens.
• Bare Linux hosts without any container runtime run the statically linked systemd build for amd64 and arm64, where endpoints, certificates and heartbeats work immediately and container monitoring switches on by itself when a runtime appears.
• Cloud deployments start from a single cloud-init file on Hetzner Cloud, DigitalOcean, Scaleway, OVHcloud or Vultr.

Getting started

The documented path is a docker-compose.yml using the image ghcr.io/kolapsis/maintenant:latest, followed by docker compose up -d and opening http://localhost:8080. Kubernetes and bare-Linux installs are also documented, the latter through curl -fsSL https://install.maintenant.dev | sudo bash.

How it compares

Within this registry it stands as a single-binary alternative to the multi-component open-source monitoring stack named in its own README, covering the roles of Prometheus, Grafana, Alertmanager, cAdvisor, node-exporter, blackbox-exporter, an ssl_exporter, Loki, Promtail, Trivy, Diun, Watchtower, Dozzle and Pushgateway in one Go process. Its distinguishing axes are deployment shape and effort: one container in place of roughly ten services, label-driven checks in place of per-target configuration files, and no PromQL or dashboard authoring required.

When to use it — and when not to

A self-hoster must operate the Docker socket mount, the read-only /proc mount and the SQLite database file at /data/maintenant.db, and the README states plainly that the UI and API carry no authentication of their own, so an authenticating reverse proxy must sit in front or the port must be bound to 127.0.0.1. Teams that need built-in multi-user authentication, or that have already invested in PromQL and custom dashboards, should look elsewhere, and CVE enrichment with a per-container risk score is listed only for the Personal edition rather than for every install.

# docker-compose.yml
services:
  maintenant:
    image: ghcr.io/kolapsis/maintenant:latest
    ports:
      # ⚠️  SECURITY: publishes the UI/API (no authentication of their own) on
      # every interface; put an auth reverse proxy in front, or bind "127.0.0.1:8080:8080". See https://docs.maintenant.dev/security/#reverse-proxy-setup.
      - "8080:8080"
    read_only: true
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:noexec,nosuid,size=64m
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /proc:/host/proc:ro
      - maintenant-data:/data
    environment:
      MAINTENANT_ADDR: "0.0.0.0:8080"
      MAINTENANT_DB: "/data/maintenant.db"
    restart: unless-stopped

volumes:
  maintenant-data:

docker compose up -d

kubectl apply -f deploy/kubernetes/

curl -fsSL https://install.maintenant.dev | sudo bash