Get desktop application:
View/edit binary Protocol Buffers messages
Dozzle-initiated unary call: search log lines this instance has streamed to Cloud (gated by streamLogs opt-in). Cloud scopes the query server-side to the (user_id, api_key_id) derived from the authenticated connection; Dozzle does NOT pass any identity fields in the request.
Cloud log search.
Substring/word-filter query. Empty -> empty result. Whitespace-only is rejected client-side; server treats as empty.
Result cap. Default 20, server-capped at 50.
Pagination cursor: return only hits with timestamp_ns < this value. 0 = newest. Reserved for future use.
Optional filter — narrow to a specific Docker host inside the instance. Empty = all hosts under this instance.
Optional filter — narrow to a specific container.
For pagination: pass back as before_ts_ns to fetch the next page.
Dozzle sends ToolResponse, cloud sends ToolRequest
Unsolicited server-push: batched container log lines streamed from Dozzle to Cloud for ingestion into VictoriaLogs. request_id is empty for log batches — they are not replies to a ToolRequest.
Container action result
Used in:
Used in:
Used in:
Used in:
Container information
Used in:
Container stats
Used in:
Used in:
Deploy compose result
Used in:
Used in:
Host information
Used in:
Container inspect result
Used in:
Used in:
Used in:
Used in:
(message has no fields)
Used in:
Batch of log lines from one or more containers. Dozzle pushes these continuously while connected. Cloud routes them to VictoriaLogs scoped to the owning user (derived from the connection's auth).
Used in:
Used in:
unix nanoseconds
"stdout" or "stderr"
"info", "warn", "error", etc. (best-effort)
Deterministic FNV-32a hash of the raw log line, the same id Dozzle stamps on LogEvent.Id. Cloud indexes this as a non-stream field so search results can produce a stable permanent link (/container/:id/time/:datetime?logId=...) that lands the user on exactly the matching line in the local log viewer.
Container logs
Used in:
"stdout" or "stderr"
"info", "warn", "error", etc.
Notification/alert tool result (list, create).
Used in:
Used in:
Full log line as indexed.
FNV-32a hash of the raw log line — same id Dozzle assigns LogEvent.Id and exposes via "Copy permalink". Lets the search-result row deep-link straight to the matching line.
Used in:
scope tells the cloud router how to multiplex calls to this tool. Dozzle itself has no notion of "multiple instances"; this field lets the router decide whether to fan out (default), target a specific container/host inferred from the existing host_id/container_id params, or target the whole Dozzle instance (in which case the router injects an instance_id argument into the LLM-facing schema and strips it before forwarding).
read_only = true means the tool has no side effects and is safe to fan out across every connected Dozzle instance when the scope's routing argument is missing (e.g. list_notifications without instance_id queries all instances and merges results). Mutating tools (create/delete/deploy/ restart/etc.) must leave this false — the router will require the scope argument and error if it's missing, so a write never fans out by mistake.
Used in:
Default — treated as INSTANCE. Exists so forward-compat clients without a scope field don't misroute.
Applies to the whole Dozzle instance (list_hosts, notifications, etc.). Requires instance_id in the args.
Targets a specific Docker host (deploy_compose, list_deploy_versions). Requires host_id in the args.
Targets a specific container (logs, actions, inspect). Requires container_id in the args (host_id is typically also present for the Docker API call inside Dozzle but isn't used for routing).