{ "markdown": "
\n\n\"Oriel\"\n\n# Oriel\n\n**The local Docker GUI an AI can drive, safely.**\n\nManage containers, images, volumes, networks, and Compose from a clean browser UI. Or hand the job to an AI: any MCP client (Claude, Cursor, a local LLM) drives the same tools the UI does, with the same secret masking and destructive-action grant. It works with **any Docker engine on macOS and Linux** (Colima, Docker Engine, OrbStack, Podman, or a remote daemon). A free, open-source Docker Desktop alternative in one ~13 MB binary that idles at 15–30 MB of RAM, with no Electron, no account, and an Apache-2.0 license.\n\n[![CI](https://github.com/ParadoxInfinite/oriel/actions/workflows/ci.yml/badge.svg)](https://github.com/ParadoxInfinite/oriel/actions/workflows/ci.yml)\n[![Go Report Card](https://goreportcard.com/badge/github.com/ParadoxInfinite/oriel)](https://goreportcard.com/report/github.com/ParadoxInfinite/oriel)\n[![Release](https://img.shields.io/github/v/release/ParadoxInfinite/oriel?sort=semver)](https://github.com/ParadoxInfinite/oriel/releases)\n[![License: Apache-2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)\n\n
\n\n

\n Try it live ↗ · the full UI in your browser, mock data, no install.\n

\n\n

\n \"Oriel\n \"Oriel\n

\n\n## Drive it with AI\n\nPoint any MCP client at Oriel and ask in plain English. It calls the same validated, secret-masked tools the UI does, and it can chain several to actually answer a question instead of firing just one:\n\n> **you:** why does `api` keep restarting?\n>\n> **assistant:** *reads `container.list`, `container.inspect`, then the logs.* It's exiting **137 (OOM)**: the container is capped at 256 MB and the Node heap runs past it. Raise the memory limit or fix the leak in `worker.js`.\n\n```sh\noriel mcp # stdio MCP server for Claude, Cursor, or a local LLM\n```\n\nNo model ships in the binary; your client brings its own. Reads run anytime, and destructive actions stay locked behind a grant. [Setup & tool list ↓](#ai-control-mcp)\n\n## Install\n\n**Homebrew** (macOS & Linux):\n\n```sh\nbrew install ParadoxInfinite/oriel/oriel\n```\n\n**Script** (detects your platform and verifies the checksum):\n\n```sh\ncurl -fsSL https://raw.githubusercontent.com/ParadoxInfinite/oriel/main/install.sh | sh\n```\n\nAdd `-s -- --edge` to track pre-releases (newest builds first), or `-s -- --uninstall` to remove it:\n\n```sh\ncurl -fsSL https://raw.githubusercontent.com/ParadoxInfinite/oriel/main/install.sh | sh -s -- --edge\n```\n\n> ⚠️ **Piping a script to `sh` runs code from the internet on your machine.** [Read `install.sh`](https://github.com/ParadoxInfinite/oriel/blob/main/install.sh) before you run it, or download a binary from [releases](https://github.com/ParadoxInfinite/oriel/releases/latest) instead.\n\n
\nManual binary, Go, or source\n\nDownload a binary from [releases](https://github.com/ParadoxInfinite/oriel/releases/latest) (`oriel-darwin-arm64` for Apple Silicon, `oriel-darwin-amd64` for Intel, `oriel-linux-arm64`, or `oriel-linux-amd64`), then `chmod +x`. Or:\n\n```sh\ngo install github.com/ParadoxInfinite/oriel@latest # with Go\nmake build # from source (builds + embeds the UI)\n```\n\n
\n\n## Run\n\n```sh\n./oriel # opens http://127.0.0.1:4321\n```\n\nFlags: `--port ` (default 4321), `--no-open`. Run on login: `./oriel service install` (launchd / systemd; also `status`, `uninstall`).\n\nNeeds any Docker Engine–compatible runtime + the `docker` CLI. [Colima](https://github.com/abiosoft/colima) is first-class (adds VM start/stop); Docker Engine, OrbStack, Rancher/Docker Desktop, Podman, and remote daemons also work ([docs/DAEMONS.md](docs/DAEMONS.md)). For remote access over a private network, see [docs/REVERSE-PROXY.md](docs/REVERSE-PROXY.md); read the [security note](#security) first.\n\n## Features\n\n- **Containers:** live CPU/mem, exit codes, bulk actions, streaming logs, full inspect.\n- **In-browser shell:** open an interactive terminal into any running container, straight from its details drawer.\n- **AI control (MCP):** any MCP client drives Docker/Colima through the same validated, secret-masked tools, with destructive actions behind a grant. [More ↓](#ai-control-mcp)\n- **Images:** pull with registry search, prune, one-click tag.\n- **Compose:** manage stacks, plus discover & deploy projects from disk.\n- **Dashboard:** CPU history, memory, disk, uptime/outage tracking.\n- **Command palette** (`⌘K`): fuzzy-run any action or jump to any view.\n- **Editions, themes & languages:** swap the whole UI (Studio, or drop in your own), light/dark/system, custom accents, and a translatable interface (English ships; other languages load on demand).\n- **Light & live:** ~15–30 MB RAM, one SSE stream (no polling), checksum-verified self-update.\n\n## How it compares\n\nThe usual ways to run containers on a Mac or Linux box, and where Oriel fits. (Figures drift; treat as a snapshot.)\n\n| | **Oriel** | Docker Desktop | OrbStack | lazydocker | Portainer |\n|---|---|---|---|---|---|\n| License | **Apache-2.0, free** | Proprietary (paid for larger orgs) | Proprietary (paid for commercial use) | MIT, free | Free (CE) |\n| Interface | Graphical web UI | Desktop app | Native app | Terminal (TUI) | Web UI (server) |\n| Footprint | **~15–30 MB RAM, ~13 MB binary** | Heavy (~3–4 GB VM) | Light (native) | Light | Container, ~200–300 MB |\n| Install | **Single static binary** | Installer | Installer | Single binary | Run a container |\n| Bring-your-own engine | **Colima · Docker · OrbStack · Podman · remote** | Bundled engine | Bundled engine | Any Docker socket | Any Docker socket |\n| Runs locally, no account | **Yes** | Account/sign-in | Account | Yes | Server + auth |\n| AI control (MCP) | **Built-in, safety-gated** | MCP Toolkit (runs *other* servers) | No | No | No |\n\nIt's the only one here an AI can drive directly, through the same checks the UI gives you. Reach for it over Docker Desktop / OrbStack (no paid license, bundled VM, or menu-bar app), over lazydocker (a real graphical UI, not a terminal one), or over Portainer (a binary you run for yourself, not a server to deploy and lock down).\n\nFor the full breakdown, including where Oriel loses (Windows, Kubernetes, multi-host), see the exhaustive comparison in the live demo.\n\n## AI control (MCP)\n\n`oriel mcp` runs Oriel as a [Model Context Protocol](https://modelcontextprotocol.io) server, so an MCP client (Claude Desktop, Claude Code, Cursor, a local LLM) manages your Docker/Colima in plain English, headless, with no GUI needed. Same tools, same guardrails:\n\n- **Secrets stay masked.** `container.inspect` and `container.logs` redact secret-shaped values before they reach a model; an MCP client never gets fully-raw env or logs (the \"off\" setting applies only to the local UI). Log redaction is best-effort over free-form text.\n- **Destructive actions are locked** until you open a short, time-boxed window (`oriel ai allow-destructive --for 15m`). Reads always work; remove/prune don't, until you say so.\n- **Every action is logged.** An audit log records each tool call an assistant makes: what ran, with which arguments, and when (Settings → AI activity). Your own clicks aren't.\n- **No model in the binary.** Your client brings the model, so Oriel stays vendor-neutral.\n\nPoint any MCP client at it. With Oriel installed:\n\n```json\n{ \"mcpServers\": { \"oriel\": { \"command\": \"oriel\", \"args\": [\"mcp\"] } } }\n```\n\nOr with no install, via the published image (Linux hosts; mounts the Docker socket):\n\n```json\n{ \"mcpServers\": { \"oriel\": { \"command\": \"docker\", \"args\": [\"run\", \"-i\", \"--rm\", \"-v\", \"/var/run/docker.sock:/var/run/docker.sock\", \"ghcr.io/paradoxinfinite/oriel\"] } } }\n```\n\nClaude Code: `claude mcp add oriel -- oriel mcp`. Setup, HTTP, scoping, and the full tool list: [docs/MCP.md](docs/MCP.md).\n\n## Editions & themes\n\nThe UI is a swappable plugin on a stable platform SDK: **Studio** (light/dark/system, custom accents). Recolor it, or drop in your own edition (see [docs/THEMES.md](docs/THEMES.md)).\n\n## Security\n\nOut of the box Oriel has **no login**, and driving Docker is effectively **root on the host**. An optional bearer token gates remote and MCP-over-HTTP access (off by default), but the safe default is local use, or a **private network only** (Tailscale, ZeroTier, WireGuard, and the like). **Never the public internet.** Full trust model: [SECURITY.md](SECURITY.md).\n\n## FAQ\n\n**Is there a GUI for Colima?** Yes. Colima ships CLI-only by design, and Oriel is the browser UI it never shipped. It also drives Docker Engine, OrbStack, Podman, and remote daemons.\n\n**A free Docker Desktop alternative?** Yes. Apache-2.0 licensed, no license fees, no account. Point it at any Docker-compatible engine.\n\n**Can an AI manage my containers?** Yes. Run `oriel mcp` and point any MCP client (Claude, Cursor, a local LLM) at it. It gets the same validated, secret-masked tools as the UI, and destructive actions stay locked until you grant them.\n\n**How is it different from lazydocker?** lazydocker is a terminal UI; Oriel is a graphical browser UI with dashboards, streaming logs, registry search, Compose discovery, and themeable editions.\n\n**Footprint and platforms?** ~15–30 MB RAM, ~13 MB binary, no Electron. macOS (Apple Silicon + Intel) and Linux (amd64 + arm64).\n\n## Develop\n\n`make dev` + `make dev-web` (Vite hot reload), `make test`. See [CONTRIBUTING.md](CONTRIBUTING.md).\n\n## License\n\n[Apache-2.0](LICENSE) © The Oriel contributors. See [NOTICE](NOTICE).\n", "bytes": 9941, "sha": "41da2f3e789f2a543f2dc9b31cdf3e959438f6d6562d56c439cccbef325ab07d", "repo_slug": "paradoxinfinite/oriel", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/mcp_io_github_paradoxinfinite_oriel_882c812d/readme" }