Docker Inventory Tour

Overview

Once the Docker integration is enabled on one or more hosts, PatchMon aggregates the discovered containers, images, volumes, and networks into a fleet-wide Docker Inventory. The inventory answers "what's running where" questions: which hosts have Docker, which containers are running, which images are out of date, and which volumes and networks exist across the estate.

This page is a guided tour of /docker (the fleet view), /docker/hosts/:id (per-host view), and the detail pages for containers, images, volumes, and networks.

Each Docker report from a host replaces that host's containers, volumes and networks, so anything removed on the host disappears from PatchMon on the next report. If the agent cannot read one of these lists from Docker, the previous entries are kept rather than cleared. Images are shared between hosts. Each report also records which images are present on that host, and the daily inventory cleanup removes an image once no container uses it and no host still has it.

Module required: docker. Plans without the module show a tier-badge prompt on the Docker tab and the /docker routes. Contact your PatchMon administrator to enable it.

Permission required: can_view_hosts to view the inventory; can_manage_docker to delete Docker resources and to run Check for updates across the fleet; can_manage_hosts to run Check for updates on a single host.

Getting to the Docker Page

Click Docker in the left navigation. You land on /docker with Stacks selected by default. The URL accepts a ?tab= parameter (stacks, containers, images, volumes, networks, hosts) so you can deep-link to a specific tab.

If no hosts have the Docker integration enabled, the list sections are empty. See Enabling Docker Integration to turn it on for a host.

Top-of-Page Statistics

Four summary cards sit above the tabs:

These figures come from the /docker/dashboard endpoint and are refreshed every 30 seconds automatically while the page is open.

Tab Strip

Six tabs. Each has a counter badge to show at a glance how big the fleet is across that dimension:

• Stacks: containers grouped by their Compose project / stack label.
• Containers: every container on every host.
• Images: every image on every host.
• Volumes: every volume on every host.
• Networks: every network on every host.
• Hosts: a directory of hosts with Docker enabled.

Clicking a tab resets the page's search field and sets a sensible default sort for that view (status on containers, repository on images, name elsewhere).

Stacks tab

Groups running containers by their Compose project / stack label. Each group card shows:

• Stack name.
• Number of containers in the stack, broken down by status.
• Host the stack runs on (stacks are scoped per host; a stack of the same name on two hosts appears twice).
• Links to the individual containers and their images.

Use this tab when you think in terms of "my wordpress stack" rather than "individual containers".

Containers tab

One row per container. Columns include:

• Name: click to open the container detail page (/docker/containers/:id).
• Image: the image tag, with registry-aware linking (click a Docker Hub image to jump to Docker Hub, GHCR to GitHub, etc.).
• Status: colour-coded badge: running (green), exited (red), paused (yellow), restarting (blue), or plain for other states.
• Host: friendly name of the host the container lives on. Click to jump to the per-host Docker view.
• Optional columns: created timestamp, ports, state transitions.

Filters:

• Search across name, image, and host.
• Status filter: All, Running, Exited, Paused, Restarting.
• Sort by name, image, status (with secondary sort by name within status), or host.

Actions:

• Delete (trash icon): deletes the container via the agent. Requires can_manage_docker. Errors are surfaced in an alert.

Images tab

One row per image. Rows show:

• Repository + tag (and registry link when recognised).
• Size.
• Source (Docker Hub, GHCR, GitLab, Quay, ECR, ACR, GCR, local, private, unknown) as a coloured badge.
• Container count: how many containers on which hosts reference this image.
• Update status: a badge such as Update available or Up to date, plus a Recreate needed badge when containers on some host are still running an older copy. See Image Update Checks for what each status means.

Filters include source type and an update status filter: Update available, Recreate needed, Up to date, Unknown, and Not checked. The top Updates Available card opens the same view filtered to Update available.

Users with can_manage_docker see a Check for updates button at the top of the page. It asks every connected Docker host to run its image update check now, and a message tells you how many hosts were asked and how many were skipped because their agent is offline. Results appear as each agent reports back.

Clicking an image opens /docker/images/:id: the image detail page with a list of the hosts that have the image and the containers using it.

Volumes tab

One row per volume with:

• Name, driver (local, nfs, custom).
• Mountpoint on the host.
• Host the volume lives on.
• Container count: how many containers mount it.

Filter by Driver and search. Click a volume name to open /docker/volumes/:id, which shows which containers currently mount it, along with the host.

Networks tab

One row per network with:

• Name, driver (bridge, host, overlay, macvlan, none, custom), scope.
• IPAM subnet / gateway.
• Host the network exists on.
• Container count.

Filter by Driver and search. Click a network name to open /docker/networks/:id with container membership.

Hosts tab

A compact directory of hosts that have the Docker integration enabled, sorted alphabetically by friendly name. Each row summarises container / image counts for that host and links to the per-host Docker view at /docker/hosts/:id.

Use this tab as the starting point when you want to focus on a single host rather than pivot by resource type.

Per-Host Docker View

The URL /docker/hosts/:id (and the row link on the Hosts tab) opens a view scoped to one host. It shows:

• The host's friendly name, hostname, and a link back to the main Host Detail page.
• Container and image counts, running / exited / paused breakdowns.
• The host's container list, grouped by stack where available, with each container's update status.
• Every image on the host, including images no container uses, with the update status this host reported for each.
• A Check for updates button (requires can_manage_hosts) that runs the image update check on this host now. The agent must be connected.

This view is equivalent to the Docker tab on the host's main Host Detail page (see Host Detail Page). Either works. Pick whichever route you land on.

Resource Detail Pages

Each Docker resource has its own detail page. They follow the same pattern: top section with identifying metadata, cards with stats, related resources, and any actions.

Container detail: /docker/containers/:id

Shows the container's name, image, status, ports, host, created and started timestamps, restart count, restart policy, command and entrypoint, labels, mounts, and networks. The Update Status field shows Recreate needed when a newer image for the container's tag is already on the host, otherwise the update status of the container's image on that host.

A Similar containers strip at the bottom lists other containers using the same image across the fleet, useful for "is this redis:7 running anywhere else?" questions.

Image detail: /docker/images/:id

Shows repository, tag, digest, size, architecture, OS, labels, history (layers), and the registry link.

Below, two lists:

• Hosts with this image: every host that has the image, whether or not a container uses it.
• Containers using this image: every container across the fleet referencing this image, with its update status.

An update check table lists, for each host, the status, the digest of the image on the host, the digest the registry returned, the reason when the result is Unknown, and when the check ran. Digests are shortened; hover to see the full value.

Volume detail: /docker/volumes/:id

Shows driver, mountpoint, size (when Docker reports it), labels, and options. The Containers using this volume list shows where it is mounted.

Network detail: /docker/networks/:id

Shows driver, scope, IPAM configuration, and options. The Containers attached list shows what's connected to the network.

Image Update Checks

PatchMon tells you when the tag a container runs, such as nginx:1.27 or postgres:16, now points at a different image in its registry. That is how you find out that an image was rebuilt with security fixes under the same tag. It does not suggest newer version tags: it will not tell you that nginx:1.28 exists when you run nginx:1.27.

How a check works

The agent on each host does the checking, not the PatchMon server:

• For every tagged image on the host, the agent asks the image's registry which image the tag points at now (its digest) and compares it with the digest of the copy on the host.
• It only asks for the digest. It does not pull or download the image, and the requests do not count towards Docker Hub's pull rate limits.
• It uses the host's own network connection and the registry logins already on the host (from docker login), so private registries work wherever Docker itself can pull. Credentials are never sent to PatchMon.
• Each image is checked once per run even when several containers use it.

Checks run automatically on each agent about 2 minutes after the agent starts, then every 6 hours by default. The interval, or switching the check off, is set per host in the agent's config.yml (see the Agent config.yml Reference in the Operator Guide). A check you request with Check for updates runs straight away, unless that host has the check switched off or a check is already running.

The Check for updates button appears in two places:

Hosts whose agent is offline are skipped, so check them again once they reconnect.

What the statuses mean

When different hosts report different results for the same image, the fleet-wide views show the most important one: Update available first, then Unknown, then Up to date. The image detail page shows each host's own result.

Reasons for an Unknown result:

When an image moves to Update available on a host, PatchMon raises a container_image_update_available event once for that host and image. It does not repeat on later checks while the update is still outstanding.

How the Data Stays Current

Docker data flows into PatchMon on two channels:

Periodic inventory reports

On every check-in the agent collects containers, images, volumes, and networks and compares a fingerprint of them with what the server last received. When anything has changed, it sends the full snapshot. The inventory in /docker reflects the last snapshot from each host.

To force an immediate refresh for a single host, open its Host Detail page and click Fetch Report.

Container changes

When the Docker integration is enabled, the agent also watches the Docker event stream. When a container is created, started, stopped, dies, is paused, unpaused, killed, or destroyed, the agent waits five seconds for any related events to finish, then collects and sends the whole inventory again. A container crash, or a stack brought up with docker compose up, is therefore visible in the UI within seconds, and the snapshot it sends also carries any image, volume, and network changes made at the same time.

UI refresh cadence

On top of those agent-driven pushes, the /docker page itself refreshes the dashboard summary every 30 seconds via polling, and per-tab queries refetch when you switch tabs. The manual Refresh button (top right, circular arrow) forces an immediate refetch of whichever tab is active.

Tip: Container changes appear within a few seconds. Changes that do not touch a container, such as pulling an image or creating a volume on its own, appear at the next check-in. Use Fetch Report on the Host Detail page if you can't wait.

Deleting Docker Resources

Containers, images, volumes, and networks can be deleted from their table rows (trash icon) or from their detail pages. Deletion:

• Requires can_manage_docker.
• Opens a confirmation modal listing the resource and its host.
• Sends a delete command to the agent over the WebSocket.
• The agent executes the equivalent docker rm / docker rmi / docker volume rm / docker network rm and reports the outcome back.

If Docker refuses (for example because a container is still running, or an image is still referenced by a container), the UI surfaces the error inline.

Search and Sort Persistence

Search and filter state are per-tab and reset when you switch tabs (so switching from Containers to Images doesn't carry a container-specific filter into the Images view). Sort field and direction reset to the tab's default when you switch, too.

The main Refresh button also clears any per-tab "updates available" filter that was set via the dashboard card click.

Related Pages

• Enabling Docker Integration: how to switch the integration on for a host.
• Host Detail Page: the per-host Docker tab, equivalent to /docker/hosts/:id.
• Managing the PatchMon Agent: the agent that collects the Docker data.
• Agent Config YML Reference: the integrations.docker setting in config.yml.