Docker monitoring that fits in an SSH connection.

Most Docker VPS setups don't need a full monitoring stack. Seeing your monitoring tool use more resources than the thing it's watching is painful when all you really need is just to be alerted when something breaks at 3am, or find that one log line during debugging.

tori is that tool. Single binary, SSH-only, no dashboards, no stack.

• You run Docker on 1–10 servers
• You care deeply about attack surface
• You don’t want to maintain a big stack like Prometheus + Grafana
• You want alerts when something goes wrong
• You prefer terminal tools over dashboards

curl -fsSL https://raw.githubusercontent.com/thobiasn/tori-cli/main/deploy/install.sh | sudo sh

Edit /etc/tori/config.toml to get notified when something breaks:

[docker]
# include = ["myapp-*"]    # auto-track containers matching a pattern
# include = ["*"]          # auto-track all containers (use cautiously)

[alerts.container_down]
condition = "container.state == 'exited'"
for = "30s"
severity = "critical"
actions = ["notify"]

# add [notify.email] or [[notify.webhooks]] — see Configuration docs

Start the agent:

sudo systemctl enable --now tori

tori is now collecting host metrics. Containers matching the include patterns are tracked automatically — the rest are visible in the TUI but need to be tracked manually with t.

curl -fsSL https://raw.githubusercontent.com/thobiasn/tori-cli/main/deploy/install.sh | sh -s -- --client
tori user@your-server.com

Or add servers to ~/.config/tori/config.toml for persistent config:

[servers.prod]
host = "user@prod.example.com"

• No exposed ports — all communication over SSH to a Unix socket. No HTTP server, nothing to firewall
• Single binary, minimal footprint — one process, typically under 50MB of memory, SQLite for storage. No stack to deploy
• Alerting — configurable rules for host metrics, container state, and log patterns. Email and webhook notifications, even when you're not connected
• Host metrics — CPU, memory, disk, network, swap, load averages
• Docker container monitoring — status, stats, health checks, restart tracking
• Log tailing with regex search, level filtering, match highlighting, and date/time range filters
• Multi-server support — monitor multiple hosts from one terminal, switch instantly

• Installation
• Usage Notes
• Requirements
• Configuration
  • Agent config
  • Alert reference
  • Client config
• How It Works
  • Connecting
  • Security
  • Storage
  • Troubleshooting
• Keybindings

The agent runs on Linux only (it reads from /proc and /sys).

curl -fsSL https://raw.githubusercontent.com/thobiasn/tori-cli/main/deploy/install.sh | sudo sh

curl -fsSL https://raw.githubusercontent.com/thobiasn/tori-cli/main/deploy/install.sh | sudo sh -s -- --version v1.0.0

# configure alerts, notifications
sudo vim /etc/tori/config.toml

# start the agent
sudo systemctl enable --now tori

# check it's running
systemctl status tori

# follow agent logs
journalctl -u tori -f

# reload config without restart (SIGHUP)
sudo systemctl reload tori

yay -S tori-cli-bin

curl -O https://raw.githubusercontent.com/thobiasn/tori-cli/main/deploy/docker-compose.yml
# edit the TORI_CONFIG section to configure alerts, notifications
docker compose up -d

docker run -d --name tori \
  --restart unless-stopped \
  --pid host \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -v /proc:/host/proc:ro \
  -v /sys:/host/sys:ro \
  -v /run/tori:/run/tori \
  -v tori-data:/var/lib/tori \
  -v ./config.toml:/etc/tori/config.toml:ro \
  ghcr.io/thobiasn/tori-cli:latest

[socket]
mode = "0666"    # required for Docker — allows host users to reach the socket

[host]
proc = "/host/proc"
sys = "/host/sys"

go build -o tori ./cmd/tori
sudo ./tori agent --config /etc/tori/config.toml

curl -fsSL https://raw.githubusercontent.com/thobiasn/tori-cli/main/deploy/install.sh | sh -s -- --client

curl -fsSL https://raw.githubusercontent.com/thobiasn/tori-cli/main/deploy/install.sh | sh -s -- --client

go build -o tori ./cmd/tori

Re-run the same install command to update to the latest version. Existing configs are preserved.

# Agent (then restart the service)
curl -fsSL https://raw.githubusercontent.com/thobiasn/tori-cli/main/deploy/install.sh | sudo sh
sudo systemctl restart tori

# Client
curl -fsSL https://raw.githubusercontent.com/thobiasn/tori-cli/main/deploy/install.sh | sh -s -- --client

sudo systemctl disable --now tori
sudo rm /usr/local/bin/tori
sudo rm /etc/systemd/system/tori.service
sudo rm -rf /etc/tori /var/lib/tori /run/tori
sudo userdel tori
sudo groupdel tori 2>/dev/null   # may remain if other users were added to it

For client-only installs, just remove the binary (~/.local/bin/tori or /usr/local/bin/tori) and config (~/.config/tori/).

• Linux (the agent reads from /proc and /sys)
• Docker (for container monitoring)
• SSH access to the server (for remote connections)
• Go 1.25+ (build from source only)

Built by thobiasn