mrkeyoor.com_
Wed 16 Sept 05:31 UTC
Self-Hostedevaluationupdated 26 Aug 2026

uptime-kuma review

Uptime Kuma is a self-hosted service monitor with a web dashboard, alert integrations, and public status pages. It checks websites, ports, DNS records, containers, certificates, and several other targets, giving small teams an easier alternative to assembling a monitoring stack from separate tools.

+256stars / 7d
Verdict

Our Uptime Kuma run installed 2,356 packages and built in 27 seconds, but its tests exited 1 and npm audit found 44 known vulnerabilities, so the Docker image is the better trial path than a casual source deployment. Use it when a small team wants capable monitoring, polished status pages, and many alert channels in one service. Security-sensitive operators should review the advisories, restrict port 3001, and test upgrades before making it their only outage signal.

We ran it

Lab card: what happened when we ran uptime-kumaScreenshot of uptime-kuma (uptime.kuma.pet)
Install✓ · 127s2356 packages · 622 MB
Build✓ · 27s
Tests✗ · 71sran, no count parsed
Known vulns443 critical · 23 high · 16 moderate · 2 low (npm audit)
Repo785 files~77,075 lines of source · 8.3 MB · 21 CI workflows · tests dir

Answers from our run

Does uptime-kuma build from source?

Dependencies installed in 127 seconds (2356 packages), and the build succeeded in 27 seconds. We cloned commit 34f2b6c into a clean Debian container with 3 CPUs and no project-specific setup.

Do uptime-kuma's tests pass?

The test command failed in our container, and its output did not report a pass or fail count.

Does uptime-kuma have known vulnerabilities in its dependencies?

npm audit flagged 44 known advisories in the dependency tree, including 3 critical at the time of our run.

Who should not use uptime-kuma?

Teams that require NFS-backed storage: the README explicitly says NFS and similar network filesystems are unsupported for the data directory.

What are the alternatives to uptime-kuma?

Gatus, Healthchecks, Prometheus Blackbox Exporter. Our Uptime Kuma run installed 2,356 packages and built in 27 seconds, but its tests exited 1 and npm audit found 44 known vulnerabilities, so the Docker image is the better trial path than a casual source deployment.

Setup4/5Short Docker start; source install is large and tests failed
Docs4/5Clear starts and platform limits, with deeper guidance in the wiki
Community5/5Recent push, fresh release, and busy issue and pull-request activity
Maturity4/5Broad monitoring surface, offset by advisories and migration reports

Discussed on

  1. hnA fancy open-source self-hosted monitoring tool59 points

Who it’s for

Home-lab operators who want one dashboard for websites, services, certificates, and Docker containers.
Small teams that need public status pages and alerts without buying a hosted uptime service.
Administrators comfortable running one persistent Docker service and protecting it behind a local bind or reverse proxy.
Teams that need checks as often as every 20 seconds and can manage their own notification credentials.

Who it’s NOT for

Teams that require NFS-backed storage: the README explicitly says NFS and similar network filesystems are unsupported for the data directory.
Operators on FreeBSD, OpenBSD, NetBSD, Replit, or Heroku: the non-Docker support table marks all of them unsupported.
Organizations that need a clean dependency audit before deployment: our checkout reported 44 known vulnerabilities, including 3 critical and 23 high-severity findings.
Teams expecting source tests to pass unchanged in a fresh container: our test command exited 1, and the supplied log tail did not identify a specific failing case.
Large operations that need metrics querying and alert rules across an existing observability estate: Uptime Kuma is a focused availability monitor, not a Prometheus replacement.

Setup reality

Our sandbox install succeeded in 127 seconds, adding 2,356 packages and using 622 MB. The build passed in 27 seconds, but tests exited 1 after 71 seconds. The log tail showed a passing ConditionExpressionGroup check followed by a generic failing-tests summary, without naming the failed case. npm audit reported 44 known vulnerabilities: 3 critical, 23 high, 16 moderate, and 2 low.

The README's Docker path is much shorter than a source build: download the Compose file and start it, or run the published image with a persistent /app/data volume. Monitors may need SMTP, chat-service tokens, proxy details, Docker socket access, or database credentials, depending on what you configure.

The service listens on every interface by default unless you bind port 3001 to localhost. Its data must live on a local directory or Docker volume because NFS is unsupported. A non-Docker install needs Node.js 20.4 or newer, Git, PM2, log rotation, and startup configuration.

One service covers the checks most small teams need

Uptime Kuma watches HTTP and TCP endpoints, page keywords, JSON responses, WebSockets, ping, DNS records, push signals, game servers, and Docker containers. It can alert through Telegram, email, Slack, Discord, and more than 90 other notification services. The same application publishes multiple status pages, maps them to domains, shows certificate details, and records ping history. That covers a small team that wants outage signals without first designing an observability platform.

The 20-second minimum interval is a useful dividing line. It is responsive enough for public services, while remaining an availability checker rather than a system for querying application metrics. Uptime Kuma tells you that an endpoint stopped answering or a certificate is nearing expiry. It does not replace traces, log search, capacity dashboards, or Prometheus alert rules.

The Docker start is the product's strongest argument

The README's preferred setup is short: fetch its Compose file and run docker compose up -d. A single-container command is also documented, with port 3001 and a named volume for /app/data. There is no database cluster to provision, and a temporary demo lets you inspect the interface before installing anything.

The published commands expose port 3001 on every interface, so bind it to 127.0.0.1 when a reverse proxy will provide access. Keep the data on a local directory or Docker volume. The README states that NFS is unsupported, which rules out placing the service directory on a network share. Backups must include the persistent data volume.

A source install is a different proposition. Major Linux distributions and current Windows releases are supported, while the BSD family, Replit, and Heroku are explicitly excluded. You need Node.js 20.4 or newer, Git, and PM2. The background setup adds PM2 log rotation and startup persistence.

What happened when we ran it

Our sandbox installed the repository in 127 seconds. npm added 2,356 packages and the checkout consumed 622 MB on disk. The build completed in 27 seconds. The repository contained 785 files and about 77,075 lines of source at commit 34f2b6c, so the source path is much heavier than the Docker quick start suggests.

The test command failed with exit code 1 after 71 seconds. Its final output showed ConditionExpressionGroup.fromMonitor passing, including a check that tries all nodes before failing, followed by a generic failing tests line. It did not name the failed case in the supplied tail, so there is no honest basis for blaming a package, Node version, or application defect.

npm audit found 44 known vulnerabilities: 3 critical, 23 high, 16 moderate, and 2 low. That result does not prove that every advisory is reachable through the server. An operator exposing a dashboard, storing notification tokens, and possibly connecting to Docker or databases should still inspect the dependency report and current image before deployment.

Status pages are useful, while access still needs care

Multiple status pages and custom-domain mapping make Uptime Kuma more useful than a private checker. An agency can separate customer services, and a product team can publish only the monitors customers should see. Proxy support and two-factor authentication help with administration. The localhost-only port binding is the right starting point when a gateway will terminate TLS.

Monitor configuration can carry SMTP passwords, notification tokens, proxy credentials, database logins, and Docker access. The README cannot decide whether mounting the Docker socket is acceptable or whether a public page reveals internal names. For critical services, keep a second alert path outside the same host so a server failure does not silence the application and its monitor.

Active maintenance does not erase the upgrade queue

The repository was pushed on August 26, 2026, and release 2.5.3 arrived on August 22. Recent activity includes dependency updates and fixes around proxy authorization, gRPC deadlines, and PostgreSQL connections. Its GitHub total of 790 combines issues and pull requests, so it is a busy work queue rather than 790 confirmed defects.

That queue matters during upgrades. One open report describes group monitors remaining pending after a move from version 1.x to 2.4.0. Another reports Teams webhook changes breaking notifications. Pin the deployed image, read release notes, back up /app/data, and verify every important notification after an upgrade. A green dashboard means little if its alert route stopped delivering.

Choose it for clarity, then operate it like infrastructure

Uptime Kuma succeeds because an administrator can understand the product quickly. Gatus is better when configuration must live in Git. Blackbox Exporter fits an existing Prometheus estate. Healthchecks is narrower for scheduled jobs alone.

For its audience, Uptime Kuma is the easiest recommendation of those options. Use the Docker route, keep port 3001 behind a trusted gateway, store data locally, and test alerts after every change. The failed source test exit and 44 advisories prevent a carefree recommendation, especially where the monitor holds powerful credentials. Its practical advantage remains: one understandable service can replace scattered uptime checks and status-page scripts.

Alternatives

ProjectWhat it isPick it when
GatusA configuration-driven status dashboard and health checker suited to Git-managed operations.pick this instead when monitors should live in version-controlled YAML and a GUI editor is unnecessary.
HealthchecksA self-hosted dead-man's-switch service for cron jobs and scheduled tasks.pick this instead when missed jobs are the problem and broad HTTP, DNS, port, and container monitoring would be excess.
Prometheus Blackbox ExporterA probe exporter for teams already collecting metrics and alerts with Prometheus.pick this instead when availability checks must join an existing Prometheus metrics, rules, and Alertmanager setup.

What people are saying

  1. [github-trending] louislam/uptime-kuma

Sources

  1. Uptime Kuma README
  2. Uptime Kuma 2.5.3 release
  3. Group monitors pending after 1.x migration
  4. Teams webhook notification report

More self-hosted reviews

newsnow · forem · octo-server · runtime · openfang · SparkyFitness · the whole board →