maintenant

maintenant

Drop a container. Your stack is monitored.

When something breaks, fixed rules catch it, the alert is pushed to you, and your AI agent investigates through the built-in MCP server.

Docker, Kubernetes, uptime, TLS, cron jobs, live logs, image updates, CVEs: auto-discovered, alerting on every one of them,

from a single Go binary that fits in a few tens of MB of RAM when freshly started (about 100 MB after several days on a busy host). No PromQL, no exporters, no dashboards to build.

Try the live demo →

A Pro instance monitoring a real stack, read-only. Nothing to install, nothing to sign up for.

Live demo • Quick Start • Why maintenant • Agents • Features • Documentation • Editions • Pricing

---

Quick Start

# docker-compose.yml

services: maintenant: image: ghcr.io/kolapsis/maintenant:latest ports:

⚠️ SECURITY: publishes the UI/API (no authentication of their own) on

every interface; put an auth reverse proxy in front, or bind "127.0.0.1:8080:8080". See https://docs.maintenant.dev/security/#reverse-proxy-setup.

• "8080:8080" read_only: true security_opt:
• no-new-privileges:true tmpfs:
• /tmp:noexec,nosuid,size=64m volumes:
• /var/run/docker.sock:/var/run/docker.sock:ro
• /proc:/host/proc:ro
• /etc/os-release:/host/etc/os-release:ro
• maintenant-data:/data environment: MAINTENANT_ADDR: "0.0.0.0:8080" MAINTENANT_DB: "/data/maintenant.db" restart: unless-stopped

volumes: maintenant-data:

docker compose up -d

Open http://localhost:8080. Your containers are already there, with their health, restart loops, resources and logs. Nothing to configure.

Docker socket access is automatic: the entrypoint reads the mounted socket's group and grants it to the unprivileged user, on Compose and on Swarm (where docker stack deploy silently ignores group_add). A socket owned by group root needs DOCKER_GID=0. If containers do not show up, see Troubleshooting.

Kubernetes

kubectl create namespace maintenant

kubectl apply -f deploy/kubernetes/

In-cluster API auto-detected, read-only RBAC, namespace filtering, workloads (Deployments, DaemonSets, StatefulSets) as first-class citizens. Kubernetes guide.

Bare Linux, no Docker at all (systemd, amd64 and arm64, statically linked)

curl -fsSL https://install.maintenant.dev | sudo bash

Endpoints, certificates and heartbeats work without any container runtime. Container monitoring switches on by itself the moment a runtime shows up. Install documentation for pinned versions, air-gapped installs and supply-chain verification.

Cloud: one cloud-init file boots a hardened host with maintenant running on Hetzner Cloud, DigitalOcean, Scaleway, OVHcloud or Vultr.

---

Why maintenant?

Monitoring your own infrastructure with the standard stack means running Prometheus, Grafana, Alertmanager, node-exporter, cAdvisor, blackbox-exporter, a certificate exporter, Loki, Promtail, Trivy and something for image updates. Ten-odd components, each with its own config, upgrades and dashboards, to answer one question: is my stack up, and what is burning?

maintenant answers that question with one container.

Do I still need Prometheus?

maintenant monitors your infrastructure. Prometheus monitors your application. There is no PromQL here, no custom exporters, no panels to design: maintenant already knows what a container, a certificate, an endpoint, a cron job and a CVE are, and starts watching them the moment they appear. If you ship business metrics and write your own queries, keep Prometheus for that. The two answer different questions, and plenty of people run both.

Against the tools usually stacked up next to it:

One container. One dashboard. Everything monitored.

---

Screenshots

Dashboard: uptime, response times, resources, unified monitors

Unified alerts across every source

Security posture with CVE enrichment and risk scoring (Personal)

More screenshots

Container auto-discovery

Resources per container and per host

Endpoint monitoring

Heartbeat and cron monitoring

TLS certificate tracking

Update intelligence

Network security insights

Your AI assistant, plugged in over MCP

Status page, all operational

<img src="./docs/screen-captures/8-status-page-d