Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Running Beszel in Docker is convenient, but it does not give the agent the same view of a host as a native process by default. The documented container deployment mounts the Docker API socket read-only to collect container statistics and uses host networking when host network-interface statistics are required. Those choices improve visibility while tying the agent more closely to host resources and network configuration.
Beszel is a hub-and-agent monitoring platform: the hub provides the dashboard, history and management, while an agent runs on each monitored system. The right deployment depends on the metrics you need, the access you are willing to grant and whether your network allows the hub to reach agents or agents to reach the hub.
What Beszel monitors and how its architecture works
Beszel separates monitoring into two parts. The hub serves the web interface, stores monitoring history and manages systems. An agent runs on every host you want to observe and sends measurements to the hub. This model lets one dashboard cover several servers, virtual machines or single-board computers instead of installing a complete dashboard on each machine.
The official overview lists host and container CPU and memory, disk and network measurements, load, sensors, fan speed, GPU, battery, SMART, ZFS and network monitors. Which of those appear is platform-, permission- and configuration-dependent; a feature listed by the project is not a guarantee that every operating system or containerized deployment can expose it. Beszel also provides historical data and alert functions. See Beszel’s overview of the platform for the current feature description.
#1 Best Overall
- Stratum 1 NTP with GPS Source
- Embedded View-only Webserver with Status & Graphs
- Admin Console via USB and SSH
- JSON Encoded Raw Data for Custom Integration
- I/O Connector
That architecture explains the Docker decision. A container agent can inspect other containers only when it can reach the Docker or Podman API. It can report host-level information only when the host exposes the relevant interfaces, devices or files to the agent. Containerizing the process changes its access boundary; it is not merely a different installation command.
The specific Docker tradeoff
Why the example mounts the Docker socket
Beszel’s documented Docker agent example mounts /var/run/docker.sock into the agent as a read-only volume. The socket is the control and statistics interface used by Docker. Making the mount read-only prevents the container from writing through that mounted path, but it does not turn the socket into an isolated, harmless data file or establish that the agent has no other route to host resources. Treat the mount as a deliberate host access grant and review who can modify the agent image, environment and container configuration.
Why host networking appears in the example
The official wording is explicit: “The agent must use host network mode to access the host’s network interface stats.” In host mode, the agent shares the host’s network namespace rather than receiving a separate container network interface. That is the documented way to obtain host interface statistics from the container deployment. If those interface statistics are not needed, the same documentation says host networking can be removed and a port can be mapped manually.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
This is the central tradeoff: host mode broadens the agent’s view of the host network, while a normal bridged network creates a clearer network boundary but cannot provide that particular telemetry through the documented path. The documentation does not quantify a performance cost or assign a universal security rating to either choice. Select the mode based on the data you actually need.
Why “containerized” does not mean “host-equivalent”
A native binary agent runs directly in the host’s operating-system context. A container agent sees only the host resources, devices, namespaces and sockets that its runtime makes available. Even with host networking and a Docker socket, sensors, fans, battery data, GPU information, SMART, ZFS and systemd service state may be missing or require additional configuration. This is why Beszel documents a binary agent as an option when broad host telemetry matters.
Choose an agent deployment before you install
Use the following comparison as a requirements check rather than a ranking. Beszel’s documentation supports more than one valid arrangement.
Rank #2
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
| Decision axis | Docker or Podman agent | Binary agent |
|---|---|---|
| Container metrics | Available when the agent can access the Docker or Podman socket and the runtime exposes the needed accounting data. | Can still monitor containers when the host runtime and permissions are configured, but it is not itself constrained by a container namespace. |
| Host network-interface statistics | Use host network mode as documented; otherwise those statistics are not available through the standard container arrangement. | Runs in the host context and does not need container host-network mode. |
| Sensors, fans, battery, GPU, SMART, ZFS and systemd | May be unavailable or need extra device, filesystem or permission configuration; rootless operation has additional limits. | Beszel suggests this form when those host-level metrics are important. |
| Isolation boundary | Requires an intentional Docker/Podman socket mount, network choice and any other host paths or devices you add. | Uses the host service account and operating-system permissions directly; hardening is handled through the service and account configuration. |
| Maintenance | Compose or container updates fit an existing homelab workflow. | A single binary and a system service avoid a monitoring container but add service installation and update work. |
| Best connectivity fit | Works with either hub-initiated SSH or agent-initiated WebSocket, subject to the same network requirements. | Uses the same Beszel connection choices; deployment form does not remove firewall, NAT or proxy constraints. |
Map the metrics you actually need
Before choosing an image or service file, write down the measurements that must be present in the dashboard. This prevents granting host access for data you will never use.
- Container operations: per-container CPU and memory, container state and runtime statistics. Plan for a correctly mounted Docker or Podman socket and functioning memory accounting.
- Basic host health: host CPU and memory, load, disk use and network activity. Availability depends on the platform and the agent’s permissions.
- Hardware and storage telemetry: temperature sensors, fan speed, battery, GPU, SMART or ZFS. These commonly require host devices, filesystems or privileges that a rootless container does not receive automatically.
- Service state: systemd service monitoring is a host-level function and may not be visible from a restricted container.
- Interface counters: if you need statistics for the host’s physical or virtual interfaces, plan for host network mode in the documented Docker setup.
If the list ends at container CPU, memory and basic disk data, a container agent may be sufficient. If it includes hardware sensors, storage health or systemd state, evaluate the binary agent or the additional permissions required by a container before deployment.
Install the hub
Beszel supports installing the hub with Docker or Podman, or running a single binary. The official container examples publish the web interface on port 8090 and persist hub data in /beszel_data. Persist that directory outside the disposable container layer so system records and configuration survive replacement.
- Choose a host for the hub and ensure its chosen web port is reachable from your administration network.
- Create persistent storage mapped to
/beszel_data. - Publish port
8090according to the container example, or select another external port if your reverse proxy or firewall requires it. - Start the hub and open its web interface.
- Use the hub’s system-adding flow to create an agent entry. The interface generates a public key and token that the agent must receive.
The hub can be in the same machine as an agent or on a separate host. That distinction changes the most convenient connection path and, for a same-host compose deployment, whether a Unix socket should replace a network address.
Run hub and agent together on one machine
Two containers on one machine do not automatically share a network namespace. Consequently, localhost in the agent container refers to that container, not to the hub container. Beszel’s combined local compose example avoids this by sharing a Unix-socket directory between the services.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How the shared-socket arrangement works
- Create a directory that both the hub and agent containers can mount, using the same path inside each container.
- Configure the agent listener as
LISTEN: /beszel_socket/beszel.sockso it creates the Unix socket in that shared directory. - Use the example’s host-network arrangement for the agent, which lets it connect to the hub at
http://localhost:8090from the host network namespace. - Start the hub and agent together, then open the hub’s add-system screen.
- Copy the generated public key and token into the agent configuration.
- Restart the agent so it loads those credentials.
- When the hub asks for the host or IP, enter the Unix socket path
/beszel_socket/beszel.sock, not a container name and notlocalhost.
The socket path must be identical from the hub’s point of view and from the agent’s listener configuration. A typo, a missing shared volume or mismatched permissions produces an offline system even though both containers appear to be running.
Rank #3
- Product Type :System Power Device
- Package Dimensions :23.114 Cm L X 16.764 Cm W X 5.08 Cm H
- Country Of Origin :Italy
- Package Weight :0.62Lbs
Run a separate Docker agent
For an agent on another host, Beszel’s official container example uses host networking, listens on port 45876, mounts /var/run/docker.sock read-only and receives the key, token and hub URL through environment variables. Keep those values in the deployment’s secret mechanism rather than placing them in a publicly readable file.
The required settings are:
LISTEN=45876for the agent’s listening port in the documented example.- Host network mode when host network-interface statistics are required.
- A read-only mount of
/var/run/docker.sockwhen Docker container statistics are required. - The public key generated by the hub.
- The token generated when adding the system.
- The hub URL that the chosen connection mode will use.
After starting the container, add the system in the hub and verify that the reported host and container metrics populate. If you omit host networking because you do not need interface counters, publish and route the agent port manually instead, as described in the agent installation guide.
Rootless Docker and Podman: useful, but narrower
Rootless runtimes can provide container statistics when the agent uses the correct rootless socket path and the host has appropriate cgroup delegation. The socket is often not the system-wide /var/run/docker.sock in a rootless setup, so mounting the wrong path yields an agent with no container data even though the runtime itself works.
Beszel documents that rootless operation can leave host-level telemetry unavailable or require extra configuration. Sensors, fans, battery, GPU, ZFS, SMART and systemd monitoring are the main examples. A rootless container may therefore be a good fit for container-focused dashboards while being a poor fit for hardware and service-health monitoring. If those metrics are mandatory, consider the binary agent rather than progressively adding host privileges without a clear requirement.
Check cgroup delegation as well as socket permissions. Without usable memory accounting, container memory values can be absent or misleading even when CPU statistics appear. The runtime’s rootless documentation and the host distribution’s cgroup configuration determine the exact fix; Beszel cannot infer metrics that the runtime does not expose.
Choose how the hub and agent connect
SSH mode: hub to agent
In SSH mode, the hub initiates a TCP connection to the agent. This is appropriate when the hub can route to the monitored host and a firewall can allow the agent’s listening port. Network forwarding may be needed across VLANs, NAT or an external hosting provider.
Rank #4
- Features Humidity monitoring; Temperature monitoring
Beszel’s security documentation warns that SSH mode assumes a trusted network path because the hub does not verify an agent SSH host key. Treat that as a design constraint: use SSH where the path and hub are under your control, and do not mistake successful authentication for independent host-identity verification. See the security guidance for the documented assumption.
Free tools Windows power users keep installed
One-click scans. No signup required.
WebSocket mode: agent to hub
In WebSocket mode, the agent initiates a connection to the hub at /api/beszel/agent-connect. This is often easier when the monitored host can make outbound connections but the hub cannot reach it inbound through a firewall or NAT.
A reverse proxy in front of the hub must support WebSocket upgrades for that endpoint. A proxy that handles ordinary HTTP but strips the upgrade request leaves the agent unable to connect. Check the proxy’s WebSocket support and route the exact endpoint before changing agent credentials.
Use topology, not habit, to decide
| Network situation | Usually fits | Check first |
|---|---|---|
| Hub can open a direct connection to each host on a trusted LAN | SSH | Agent port, firewall rules and the trusted-path assumption. |
| Agents are behind NAT or restrictive inbound firewalls but can reach the hub | WebSocket | Outbound DNS/HTTPS access and WebSocket proxy upgrades. |
| Hub and agent are separate containers on one host | Shared Unix socket for the local compose pattern | Shared volume, exact socket path and agent restart after credentials are added. |
| Hub and agent are on isolated networks with no permitted route | Neither mode until routing is designed | Firewall policy, VLAN routes and the direction of the first connection. |
Troubleshoot missing systems and metrics
The system stays offline
- Confirm that the public key, token and hub URL are from the same system entry.
- For SSH, test that the hub can reach the agent’s address and listening port; inspect firewall and forwarding rules.
- For WebSocket, confirm that the agent can reach the hub and that the reverse proxy forwards
/api/beszel/agent-connectwith WebSocket support. - For a local Unix-socket setup, verify that both containers mount the same directory and that the hub uses
/beszel_socket/beszel.sockas the host/IP value. - Restart the agent after changing credentials or listener settings.
Container statistics are absent
- Check that the socket path inside the agent matches the runtime: a rootless socket is normally different from the system-wide Docker path.
- Verify that the socket is actually mounted and readable by the agent’s user.
- Check Docker or Podman memory accounting and cgroup delegation; CPU data can work while memory data is unavailable.
- Remember that a read-only socket mount still grants API visibility. Do not “fix” a missing metric by adding broader privileges without deciding why they are needed.
Host network counters are missing
Use the documented host-network mode for the container agent when those counters matter. If host mode is intentionally disabled, the absence is expected rather than a connection failure. If your requirements do not justify host networking, leave it disabled and monitor the metrics available through the chosen network namespace.
Hardware or service metrics are missing
Check platform support and permissions first. Rootless containers commonly cannot see sensors, fans, batteries, GPUs, SMART, ZFS or systemd state without additional configuration. If those measurements are central to your alerts, a binary agent is the documented alternative.
The hub works but agents cannot reconnect after a proxy change
Inspect the proxy’s upgrade handling and endpoint routing, not just its ordinary page response. WebSocket mode depends on the upgrade handshake reaching /api/beszel/agent-connect; an HTTP-only proxy configuration is insufficient.
Best Value
- 【Excellent performance+fanless design】 The Mini PC is powered by a 2.8GHz quad core Pentium Silver J5005 processor and UHD graphics processor. The fanless design ensures complete noise free and maintenance free operation. Faster CPUs can meet your various needs.
- 【4*Intel I226-V】 4 * Intel i226-V network card chip is fully UDE2.5G, with filter connectors, and can be used for servers, monitoring equipment, VPN, monitors, projectors, televisions, etc.
- 【Storage+Memory】Scalable to 2TB (not included) through 2.5-inch SATA HDD/SSD drives. M. 2x4 interface supports expansion of Msat x1 adapter boards, 2 * SO-DIMM DDR4 memory 2400MHz Max 8GB, compatible with 2400/2666/2933/3200MHz
- 【Packaging content+warranty 】 1x fanless mini computer, 1x power adapter, 1xSATA data cable and power cable. We provide lifelong technical support and 12 months of satisfactory service. If there are any problems, please feel free to contact us at any time.
These checks align with Beszel’s common-issues guidance, which also calls out firewall rules, Docker memory accounting, socket configuration and proxy support.
Review the access boundary before going live
Make a short inventory of every host capability the agent receives:
- Docker or Podman socket path and whether it is mounted read-only.
- Network mode: bridge, host or another runtime-specific mode.
- Devices, filesystem paths or system sockets added for hardware and storage telemetry.
- User and group IDs used by the agent process.
- Inbound listening ports and outbound destinations.
- Whether SSH or WebSocket is used, and which side initiates the connection.
Keep the inventory with your compose file or service unit. It makes later troubleshooting faster and prevents an emergency metric fix from quietly expanding the deployment’s privileges. Beszel’s documentation does not publish an independent security audit, resource-use benchmark or universal claim that one deployment is always safer; your configuration determines the practical boundary.
Three practical deployment patterns
Container-focused homelab
Use a Docker or Podman agent with the runtime socket, bridge networking if host interface counters are not needed, and WebSocket when inbound routing is difficult. This keeps the deployment compact while concentrating on per-container CPU, memory and basic host measurements.
Hardware-aware server
Use the binary agent when temperatures, fans, GPU, battery, SMART, ZFS or systemd state are requirements. This avoids trying to reproduce the host’s device and filesystem view inside a restricted container. If you still choose a container, document every additional mount and permission and verify each metric individually.
Single-box all-in-one compose
Use the combined local pattern: shared socket directory, LISTEN: /beszel_socket/beszel.sock, the documented hub URL through host networking, and the generated key and token. Enter the Unix socket path in the hub instead of using localhost between separate containers.
A decision checklist
- List the exact metrics that must trigger alerts.
- Mark whether any requirement needs host network mode, hardware devices, storage interfaces or systemd access.
- Identify the correct Docker or Podman socket, including the rootless path if applicable.
- Choose SSH when the hub can reliably reach agents on a trusted path; choose WebSocket when agents can initiate outbound connections more easily.
- Test the chosen path through every firewall, NAT boundary and reverse proxy.
- Deploy with only the socket mounts, network mode and privileges required by the metric list.
- Verify container, host and hardware measurements separately instead of treating an online status as proof that every collector works.
The practical conclusion
Beszel in Docker is a sensible choice when container statistics and straightforward host measurements are the priority, especially if your existing homelab is already managed with Compose or Podman. The price of that convenience is an explicit access decision: container statistics require a runtime socket, and host network-interface statistics require host networking in the documented setup.
Recommended Free Tools
Choose the binary agent when the monitoring requirement reaches hardware, storage-health or systemd details that a rootless or restricted container cannot reliably expose. Then choose SSH or WebSocket according to the direction your network permits. There is no universal winner; metric coverage, host access and topology determine which Beszel deployment is the honest fit.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
