LogForge

LogForge Unicron

Self-hosted Docker monitoring and control in one Docker Compose deployment. Unicron is a Docker-native dashboard for local and agent-forwarded logs, metrics, Docker events, alert rules, notifications, file access, and safe remediation.

LogForge focuses on Docker alerts that fix themselves: rules catch operational signals, notifiers route incidents, and guarded actions restart, stop, start, kill, or run scripts with cooldowns, backoff, rate limits, and verification delays. AI-assisted operations can turn live Docker context into reports, incident investigation, and scoped remediation guidance while keeping the control plane self-hosted.

Open Source: Unicron source is available at log-forge/unicron-source.

Learn more on the LogForge website.

Quick Start

Recommended: installer

curl -fsSL https://www.logforge.dev/install.sh | sh

The installer clones or updates the deployment repository, checks Git, Docker, and Docker Compose, selects usable host ports, validates that Compose resolves to logforge/unicron:latest, pulls the image, updates .env if selected ports need to change, and starts Unicron.

Open the URL printed by the installer:

https://localhost:${UNICRON_APP_PORT}/unicron

The default URL is:

https://localhost:8444/unicron

Manual Docker

Use the manual path when you want explicit control over the checkout, .env, or Compose commands:

git clone https://github.com/log-forge/logforge.git
cd logforge
docker compose pull
docker compose up -d
docker compose ps unicron

Then open:

https://localhost:8444/unicron

Unraid Community Apps

Install LogForge Unicron from the Unraid Apps tab. The template stores durable state under /mnt/user/appdata/logforge-unicron, publishes the browser UI on HTTPS port 8444, and publishes the agent mTLS endpoint on port 9443. If either host port changes during installation, update its matching advanced Public port variable to the same value.

The container uses an internally generated certificate authority. Your browser may show a certificate warning until you trust that authority or configure a trusted reverse proxy.

The Community Apps template starts the appliance on Unraid's normal bridge network. Before enrolling an agent for the same Unraid host, create the shared network and connect the running appliance with its expected DNS alias:

docker network inspect logforge-unicron-network >/dev/null 2>&1 || \
  docker network create logforge-unicron-network
docker network inspect logforge-unicron-network \
  --format '{{range .Containers}}{{println .Name}}{{end}}' | \
  grep -Fxq LogForge-Unicron || \
  docker network connect \
    --alias unicron.central \
    logforge-unicron-network \
    LogForge-Unicron

Then choose the local-host enrollment option in Unicron. Its generated agent command joins logforge-unicron-network and reaches the appliance through https://unicron.central/unicron.

What You Get

The free self-hosted product includes:

• Docker container health, status, logs, metrics, events, and file access in one UI.
• Local Docker monitoring from the Unicron deployment host.
• Remote Docker monitoring through mTLS-protected Unicron-agent enrollment, traffic, and forwarded operational data.
• Log, metrics, and Docker event ingestion with storage for troubleshooting, review, trend checks, and alert rules.
• Custom rules for logs, metrics, and container events.
• Rule templates for stability, performance, logs, and security signals.
• Real-time alerts with history, acknowledgement, and delivery tracking.
• Notifications through Email, Slack, Teams, Discord, Telegram, Gotify, and webhooks.
• Safe remediation actions: restart, stop, start, kill, or run scripts with cooldowns, rate limits, backoff controls, and verification delays.
• Secure admin authentication with session protection.
• Encrypted sensitive configuration and credential redaction patterns where Unicron handles secrets.
• Self-hosted privacy so Docker monitoring data stays in your environment.

Alert Engine

Configure rules, notifications, and automation in the browser. Alert Engine turns logs, metrics, and container events into actions, while cooldowns, backoff, rate limits, and verification delays keep remediation controlled.

Cirdan

Built on LogForge Unicron - Cirdan

Cirdan is the AI-native observability and action layer built on top of LogForge Unicron. It is designed for a world where AI agents, not human dashboards, become the primary readers and operators of infrastructure state.

As logs, metrics, traces, events, alerts, configs, and live state are consumed, Cirdan continuously updates graph- based system knowledge across Docker, Kubernetes, Podman, Swarm, hosts, services, workloads, and enterprise systems. It compresses noisy operational data into connected knowledge that the model can inspect, cite, explain, report on, and use to act.

Cirdan can operate in advisory mode or, when explicitly allowed by a human operator, take scoped or full actions on their behalf: setting up monitoring, investigating incidents, changing rules, running approved remediation, and producing operational knowledge for teams and end users.

For teams building AI-operated infrastructure, see Premium.

Operations

# Host ports exposed by Unicron
UNICRON_APP_PORT=8444
UNICRON_AGENT_MTLS_PORT=9443

# Local admin account
CENTRAL_ADMIN_USERNAME=admin
CENTRAL_ADMIN_PASSWORD=
CENTRAL_ADMIN_RECOVERY_OVERRIDE=false

docker compose up -d
docker compose ps unicron

https://localhost:${UNICRON_APP_PORT}/unicron

docker compose ps
docker compose ps unicron
docker compose logs unicron

https://localhost:${UNICRON_APP_PORT}/unicron