Everything shipped, newest first.

The morning log review has had the warmest response of anything shipped here, and it is also the most expensive thing Dozzle Cloud does. Every scan is an LLM call, one per connected instance per morning, and running that for every free instance costs more than Cloud brings in. That is my problem to solve, not yours — but the two honest ways to solve it are to change the cadence or to make the scan cheaper and worse. This is the first one.

Every new account gets 7 days with the whole Pro tier on. Findings every morning with the suggested fix, triage that inspects your containers before deciding whether to page you, and full investigations on demand. No card, and nothing to switch on. The clock starts when your first instance connects, not when you sign up — a trial you never got to use is not a trial.

After that, Free settles into a weekly review. The scan runs once a week instead of every morning, and the report leads with a single finding: the most severe, and among equals the one that has been open longest, because "still happening, week 3" is the line worth having. Anything else that week is still found and still listed on your Findings page — the diagnosis behind it is the part Pro shows.

The window did not change, only how often it is read. Each scan still looks at the last 24 hours. Free log retention is one day, so a weekly instance is looked at less often, never further back.

Everything that was real time still is. Alert rules fire, triage groups and silences them, log search and metrics are unchanged, and the Telegram and Discord bots answer as they always did. This only ever applied to the proactive review — the pass over what nobody had set up a rule for.

If the weekly cadence is the thing you would miss, that is exactly what Pro is for, and the trial is there so the choice is made on evidence rather than on a feature list.

Two things in Dozzle Cloud were quietly working against you, and both were mine to fix.

The event limits go up: Free 500 → 2,000, Pro 10,000 → 50,000, Team 50,000 → 250,000. The monthly event count was doing two jobs at once — catching a genuine runaway crash loop, and being the wall you were supposed to hit. Only the first one is honest. One container looping on one host can produce 200,000 events and cause you no trouble at all, and a Pro user who went past 10,000 was put back into sampled, ungrouped alerts — the exact thing the upgrade was meant to end. Nothing is priced on events now. The cap is a backstop against a firehose, and it sits where a firehose actually starts.

The email that warned you at 95% of the limit is gone too. With the ceiling this far up it was a nag about a number that no longer means anything.

And no alert email is ever dropped. Past 20 emails in a day to one address, the rest of the day used to be discarded — you were told about the first twenty problems and silently not told about the twenty-first. Now they are held and arrive as one batched email instead. Nothing is lost, it just stops arriving one line at a time.

If you have not opened Dozzle Cloud in a month, your email goes weekly. A connected instance keeps sending events long after its owner has stopped reading — and an inbox getting an alert a day from something you have not looked at since June is how a product ends up in a spam filter. Alerts are still triaged, still stored, still on the dashboard; email arrives as a weekly digest. Open Dozzle Cloud again and the held batch is sent immediately and email goes straight back to normal. Every other channel — Telegram, Discord, ntfy, webhooks, web push — is untouched and keeps delivering in real time.

Triage also reads image changes now. If a container was updated shortly before it started failing, the alert says so, with the tag it moved from and to. It is usually the first question worth asking and the alert should not make you go and look it up.

Small one: dates and times across the app now render in your account's timezone, and stop changing a moment after the page loads.

After running Cloud for a while I noticed something uncomfortable in the data: most people connect their Dozzle instance and then never set up a single alert rule. That is not a mistake on their part — it is a perfectly reasonable thing to do. But it meant Cloud had nothing to work with. Triage only ever ran on events an alert rule produced, so if you had no rules, Cloud watched your stack in complete silence and told you nothing. You had connected it and got back an empty dashboard.

The thing that bothered me is that the information was already there. Your logs are already streaming into Cloud. I just wasn't reading them unless a rule told me to.

So now Cloud goes through your error logs every morning and tells you what is worth fixing. No rules to configure, nothing to set up — if your instance is connected, it is already happening.

It groups before it reads. Three hundred lines of connection refused to 10.0.0.4:5432 are one problem, not three hundred. Cloud collapses the parts that vary — numbers, ids, IP addresses, timestamps — so a crash loop shows up as one pattern with a count instead of drowning everything else.

It remembers what it told you yesterday. This is the part I care most about, because a daily report that restates the same thing every morning is one you mute by Thursday. Each finding now has a life:

• New — this appeared today, something changed.
• Still happening, day 4 — with what it was yesterday, so you can tell whether your fix worked.
• Resolved — it stopped, and Cloud says so. A problem going away is worth one line.

Findings have their own page. There is a new Findings section in the sidebar: open problems first, recently resolved below, each with the containers involved, links into the logs and metrics, and a thumbs up/down so I can tell whether any of this is actually useful. Every finding in your email links straight to it.

And the report goes wherever you already are. If you have Telegram or Discord connected, it arrives there too — and you can just reply to ask about it, with the agent already holding the context.

A few things I want to be straight about:

• This is not real time, and it is not trying to be. It runs once a day. If you want to know the moment a container dies, set up alert rules in Dozzle — that is still exactly what they are for. This is the review that catches what nobody was watching for.
• Free gets the finding; Pro gets the fix. On Free, Cloud names the problem from your logs. On Pro it investigates — live container state, restart history, resource trends — and tells you what to do about it.
• Warnings are read but never promoted on their own. A certificate nearing expiry or retries climbing will show up if it matters; four hundred deprecation notices will not.
• If you are over your monthly log limit, ingest stops — so no investigation happens. You will still get your report if your alert rules caught something, and it will say plainly that nothing was investigated, rather than pretending the day was quiet.
• Your first report will be the noisiest one you ever get, because on day one everything is new. It settles from day two.

And since this only works if your logs actually reach us, the log limits go up: Free 5 GB → 10 GB, Pro 25 GB → 50 GB. When the old caps were set, running out of log budget only affected alerting. Now it stops the daily review too, which felt like the wrong thing to ration — so there is more room. Team stays at 100 GB; nothing on it is close.

I build Dozzle for my own stack first. When something makes my life harder, I fix it for me — and if it looks like it would help everyone else too, it ships. This one started with my own containers spiking CPU while I was away from my computer. By the time I looked, the spike was gone and I had no idea whether it had lasted ten seconds or two hours. Two things came out of that.

Metrics are kept, not just watched. CPU, memory, network and disk are now stored as history the way you'd expect from Prometheus — so a spike that happened while you were asleep is still there when you wake up, with the shape of it intact instead of a number that has already moved on. Free keeps the last 24 hours; Pro and Team keep 30 days. The range picker only offers what your plan actually retains, and metrics still cost you nothing against your event limits.

And alerts now appear inside the log stream itself. This is the part I'm most excited about, because it came from the thing that annoyed me most: reading logs in one window while cross-referencing alerts and metrics in another, trying to line up timestamps by eye.

• Scroll back through a container's logs and the alerts that fired in that window are right there — not in a separate tab, not a marker floating near roughly the right time, but attached to the exact log line that tripped them.
• It works while you watch, too. If a CPU alert fires on a container you have open, it lands in the stream as the logs keep moving, so you see the alert and the lines around it in one place.
• Each alert costs one line: level, headline, event count and how long the incident has been going. Details expands the triage investigation and what was held back; View in Dozzle Cloud opens the full alert.
• Events that triage deliberately held back are marked on the line itself with a 🔕, so you can see what was quiet rather than wondering what was missing.
• Metric and container alerts, which have no log line of their own, get their own row at the moment they fired.
• If Dozzle Cloud is slow or unreachable, your logs still load — the alerts simply don't show up.

You'll need your Dozzle instance linked to Dozzle Cloud and running a recent version. Alerts reach back as far as your plan's retention, so on Free, scrollback older than 24 hours will look quiet even if it wasn't.

Searching your logs no longer waits on the whole window. A search for a single word used to read every stored line before it could return the first match, which is how a one-word query on a busy account reached the 30-second timeout and showed you nothing at all. Searches now go through the index, and the results are the same ones — just sooner.

• Measured against a day of real traffic: a rare term went from 0.73s to 0.06s, a level filter from 0.13s to 0.05s, and the histogram above an empty query from 0.21s to 0.01s.
• Each page searches the most recent stretch first and reaches further back only as you scroll, sized to how much you actually write — so a busy account gets a fast first page instead of a scan across 30 days of retention. The histogram follows the rows, so the chart always describes the page under it.
• A query that is still too broad now comes back with advice — narrow the range, pick a container — instead of a connection that dies on you.
• LogsQL queries work in the search box again. Valid queries were being rejected before they ever ran.

Metrics links now open on the moment that mattered. Every container is its own page at /metrics/…, and the link on an alert — in email, Slack, Telegram, Discord and ntfy — opens the charts centred on when that alert fired, with a marker on the instant. If your plan's retention doesn't reach that far back, the page tells you what window it actually served instead of quietly showing you the last 24 hours.

• Docker Swarm services link to a container that exists. The link used to carry the task id, which changes on every redeploy — so it was dead on arrival. Links already sitting in your inbox now resolve to the live container too.

Metrics are here. Your Dozzle instances now stream CPU, memory, network and disk for every container, and the new Metrics page draws them: a card per container with the live number, its peak, and a sparkline, grouped by host so two machines' api containers never sit side by side pretending to be the same thing. Click any card for full charts — average and peak on the same axis — over 6 hours, 24 hours, 7 days, or 30.

• Free keeps 24 hours; Pro and Team keep 30 days. The picker only offers the ranges your plan actually retains, so there's nothing locked to click.
• Metrics cost you nothing against your limits — they don't count as triaged events and don't touch your log volume.
• Rolling out gradually. If you don't see Metrics in the sidebar yet, it's on its way.

One instance picker for the whole dashboard. Alerts, history, logs and metrics each used to ask "which instance?" in their own way, in their own corner — or, on metrics, not at all. Now it's a single control in the sidebar, above the nav it scopes: pick prod once and every page opens on prod.

And /logs stopped asking nine questions before showing you a log line. It's down to container and query.

• The histogram is real. It was drawn from the newest 200 lines but labelled with the whole window, which is why every bar crowded into the last minute. It's now aggregated across the full range — and you zoom by dragging across the spike you can see, instead of guessing which preset contains it.
• Level filters search the whole window. "Show errors" used to mean "the errors among the newest 200 lines"; now it means the newest 200 errors.
• Scrolling loads more, the time-range and page-size dropdowns are gone, and JSON parsing is simply always on.

See for yourself whether we're up. The status page is now public and needs no login. Every surface — the API, the dashboard, the agent gateway your Dozzle connects to, and the MCP server — is probed once a minute, twice over: from the outside through the same path your browser takes, and again from inside our network. That pairing is the useful part. When the external check goes red and the internal one stays green, the problem is ingress or DNS rather than the app, and the page can say so instead of shrugging.

The page shows the last 24 hours at a glance plus 7- and 30-day uptime for each service, so you can tell a blip from a bad week without asking us.

Live log streaming is fixed. Opening a container's logs from the dashboard had been failing with a bare "Stream error" — for everyone, on every container, since the start of August. A dependency upgrade quietly changed how our WebSocket connections authenticate, and the failure mode was a connection that hung rather than one that errored, so nothing showed up in our logs or our alerts. Your Dozzle instances and your stored logs were never affected; only live streaming in the dashboard was. It works again, and the status page above exists partly so the next one of these doesn't get to hide.

Your daily digest now does real work before it reaches you. Once a day it looks across the last 24 hours of one Dozzle instance like an SRE reading over your shoulder — and surfaces the problems that never fired an alert.

• It goes and looks: searches the day's logs for errors, inspects suspicious containers, and checks live disk, memory, and restart pressure to confirm before flagging anything.
• It hunts the slow burns — a disk creeping toward full, a container quietly restart-looping, errors climbing from low to loud — not the incidents you already saw.
• High bar by design: every finding is something you could actually act on, ranked most-important first. On a healthy day it says so and stays quiet.
• Delivered as a findings-first report email.

This deeper, tool-using scan is a Pro feature. A lighter version for free accounts — which reasons over your activity summary without the live investigation — is currently rolling out slowly.

The Discord bot now works where your team already is — not just in your DMs.

• Run /start in any server channel to send alerts there, or in a DM to keep them private.
• @dozzle the bot in that channel to ask about your stack, and rate alerts 👍 / 👎 — anyone who can post can chat, all backed by your account and data.
• One Discord to set up: no more guessing between two near-identical options.

Got a recurring error you've already accepted? Mute it, and matching events are dropped before triage — they never reach you and don't count toward your usage.

• Hit Mute these on any alert or event page, ask the assistant to "mute this", or tap the new 🔇 button on alert emails, Telegram, and Discord.
• A 👎 still just means "show me fewer like this" — muting is the hard off-switch for a specific pattern.
• See and undo everything from Events → Muted.

Open any alert and you'll see the exact checks we ran before deciding to notify you — inspected the container, looked at disk space, pulled the recent logs — laid out as a timeline.

No more guessing why something reached you.

The daily briefing now opens with everything we kept quiet on your behalf, not just what got through.

A 👎 on any alert also teaches us to suppress similar noise next time.

A unified search bar now spans the dashboard — type a container, host, or alert and it figures out what you mean.

• Hit ⇧↵ to jump straight into log search.
• Tap the magnifying glass on mobile for full-screen search.
• Rate any alert 👍 / 👎 — now in email, Discord, and Telegram too.

Connect Dozzle Cloud to Claude Desktop, Cursor, or any MCP client and ask "what broke last night?" from the assistant you already use. Read-only, and free on every plan.

We also lowered Pro and Team prices, and the free tier now covers one Dozzle instance with unlimited hosts behind it.

New triage reads every event and decides whether it's worth your attention, folds duplicates into one alert with a count, and quietly updates an existing alert instead of pinging you again.

Plus: search your logs by asking in plain English.

Every log from every connected Dozzle is now indexed the moment it arrives, with a redesigned, mobile-friendly search page.

Drill into the second something broke — without opening a terminal.

A new chat assistant lives right in the dashboard — press ⌘K to open it and ask about your containers, with answers pulled from live data.

Remote access to your Dozzle is now free for everyone, so you can reach your homelab from anywhere.

Stream live logs from any connected container right in the dashboard, with a Dozzle-style viewer that works on your phone.

And Dozzle Cloud now has a Discord bot with the same two-way chat and commands as Telegram.

Connect your Dozzle instances over a live link so Dozzle Cloud can read containers and hosts in real time.

The Telegram bot also became a full AI agent — ask it questions and it pulls the answer from your actual stack.