Which DSM versions does this apply to?

Any DSM with Docker or Container Manager. Container Manager is the renamed Docker package in DSM 7.2 and later; its Project feature takes a docker-compose file directly.

Why does it need elevated permissions?

On DSM the Docker socket belongs to root:root and there is no docker group, so Maintenant, which runs as an unprivileged user, cannot read it by default. Setting DOCKER_GID to 0 grants it that group. The mount stays read-only and Maintenant never modifies your containers, but group 0 is root-level access to Docker: where you can, put a docker-socket-proxy in front of it instead.

Which port should I use?

8080 is often already taken on DSM. Publish Maintenant on a free high port instead and map it to 8080 inside the container.

Docker Monitoring for Synology NAS

A Synology NAS ends up running more than it was bought for: a media server, a database, a couple of web applications, a reverse proxy, and a backup script nobody has checked since it was written. Container Manager will show you they exist. It will not tell you when one of them stops working.

Maintenant is a single container that adds the watching part.

Install through Container Manager

In Container Manager, create a Project, choose to paste a docker-compose file, and use:

services:
  maintenant:
    image: ghcr.io/kolapsis/maintenant:latest
    ports:
      - "9080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /proc:/host/proc:ro
      - /volume1/docker/maintenant:/data
    environment:
      MAINTENANT_ADDR: "0.0.0.0:8080"
      MAINTENANT_DB: "/data/maintenant.db"
      DOCKER_GID: "0"
    restart: unless-stopped

Three DSM-specific adjustments are baked into that file:

Port 9080 on the host. DSM reserves a long list of ports and 8080 is frequently one of them. Any free high port works; the container still listens on 8080 internally.
/volume1/docker/maintenant for data. Create the folder first, in the docker shared folder DSM already uses for container data. Adjust the volume number if yours differs.
DOCKER_GID: "0". DSM’s socket is owned by root:root with no docker group, and Maintenant runs as an unprivileged user, so without this line no container shows up. The mount stays read-only, but group 0 is root-level access to Docker: a docker-socket-proxy is the safer route if the NAS is exposed.

Reach it at http://your-nas:9080. If you want it available outside the LAN, put it behind DSM’s reverse proxy with authentication, or a VPN. Maintenant ships no login of its own, deliberately.

What it covers on a NAS

every container Container Manager runs: state, health checks, restart loops, logs;
HTTP and TCP endpoints, including DSM services and anything else on the network;
SSL/TLS certificate expiry, auto-detected from those endpoints — DSM’s own certificate renewals included, if you point a check at it;
backup and cron deadlines, through heartbeat URLs, so a script that silently stopped running raises an alert instead of being discovered during a restore;
per-container CPU, memory, network and disk metrics;
image updates, by comparing registry digests against your running tags.

Resource cost

Maintenant is a single Go binary with an embedded frontend and SQLite as its only datastore — no Redis, no Postgres, no message queue. On a NAS whose RAM is mostly spoken for by the file system cache, that matters more than on a server.

Community is free and open source, covers the machine it runs on, and is the right starting point. If the NAS is one of several machines you watch, Personal adds up to 20 remote machines for 149 € incl. VAT once, for life.

Monitor a Synology Docker Stack

Install through Container Manager

What it covers on a NAS

Resource cost

Ready to switch to Maintenant ?