Build an image with docker build. Needs confirm=true.

context is a folder on the host (in an allowed folder) or an https git URL such as https://github.com/example/repo.git#main. tag is the image name, for example myapp:latest. dockerfile is a path inside the context. Build args are visible in the image history: do not put real secrets in them.

Run any docker command, for things the other docker tools do not cover.

Give the arguments after "docker", for example: "system df" or "compose -p demo ps". Read commands (ps, images, inspect, logs, info, version, stats --no-stream, network ls ...) run right away. Anything else shows a preview first. background=true starts it as a background job (builds, pulls, big compose runs). Check it with server_job.

Start, stop, restart, pause or unpause one container. Needs confirm=true.

Copy files between a container and the Docker host (docker cp). Needs confirm=true.

direction: to_container (host_path -> container_path) or from_container (container_path -> host_path). host_path must be in an allowed folder. Existing files at the destination are overwritten. keep_owner uses docker cp -a.

Create a network or a volume. Needs confirm=true.

kind: network or volume. Network: driver (bridge, macvlan ...), subnet, gateway, ip_range, parent (the host interface for macvlan, for example eth0.20), internal. Volume: driver (default local) and options, for example an NFS volume: options {"type": "nfs", "o": "addr=192.0.2.10,nfsvers=3,hard", "device": ":/export/share"}.

Show how much disk space images, containers, volumes and build cache use.

Run one command inside a running container (no terminal, no input).

Destructive, because the command can do anything inside the container. Shows a preview first. Run again with confirm=true after the user says yes. By default the command is split like a shell would, but no shell is used (no pipes). Set shell=true to run it with sh -c (pipes, &&, redirects). workdir sets the folder inside the container. user sets the user.

List images: name, tag, size, age.

Show details of a container, volume, network or image (kind).

For a volume this shows its driver and options, such as the NFS address. Secret values in environment variables are hidden.

Show the last lines of a container's log. since like 10m, 2h, or 2026-10-11.

Secrets that look like password or token values are hidden.

List networks: name, driver, scope.

Clean up unused things. what: containers (stopped), images (unused, untagged only), networks (unused), volumes (not used by any container), builder (build cache).

Destructive. Shows a preview first. Run again with confirm=true after the user says yes.

List containers: name, image, state, status, ports, networks.

all=true includes stopped containers. name_contains filters by name.

Download an image, for example ghcr.io/example/app:latest. Needs confirm=true.

Delete one container, image, volume or network (kind).

Destructive. Shows a preview first. Run again with confirm=true after the user says yes. A running container is not removed. Stop it first. Removing a volume deletes the data inside it. A volume with an NFS setting only holds the setting, not the files on the NAS.

Start a new container in the background (docker run -d). Needs confirm=true.

For anything that should stay, a compose stack (docker_stack_write) is better. ports like "8080:80" or "127.0.0.1:8080:80/tcp". volumes like "myvol:/data" or "/opt/stacks/app/data:/data:ro" (a host folder must be in an allowed folder). Not possible here: privileged mode, devices, the docker socket.

Run a Compose action on one stack.

action: up (create/start, same as docker compose up -d), pull (get new images), update (pull then up), start, stop, restart, build (build the images the compose file builds itself), build_no_cache, up_build (build then up), recreate (up with --force-recreate). These need confirm=true. down (removes the containers and network, keeps volumes) and down_volumes (also removes the stack's volumes) are destructive and also

Check a stack and show the final compose file with all variables filled in.

Good for finding a missing or wrong value in the .env file. Secret values are hidden.

Show the compose file of a stack. Secret values are hidden. The .env file is never shown.

Show the last log lines of a whole stack, or one service of it. since like 10m, 2h, 2026-10-22.

List Compose stacks (one folder each under the stacks folder) and whether they are running.

Show the containers of one stack and their state.

Create a new stack, or replace the compose file of one, then check it. Needs confirm=true.

The file goes to //compose.yaml (an existing compose file keeps its name). The result is checked with docker compose config. If the check fails, the old file is put back (or the new file removed) and the error is shown. Nothing is started: use docker_stack_action up. Secret values should be ${VARIABLES} that live in the .env file (write that with server_file_write).

Show CPU, memory and network use of running containers right now.

Give an image a second name (docker tag). Needs confirm=true.

List volumes: name and driver.

Delete a file or an empty folder on the Docker host. Destructive.

Destructive. Shows a preview first. Run again with confirm=true after the user says yes. recursive=true also deletes a folder with everything in it. Never forced.

Change part of a text file: replace old_string with new_string. Needs confirm=true.

old_string must match the file exactly and must be unique, unless replace_all=true. Works on files Claude can read. Lines with hidden secrets cannot be matched.

List files and folders on the Docker host (type, mode, owner, size, date, path).

Any path works. SERVER_MCP_FILE_ROOTS can limit it to some folders. as_root=true uses sudo. An empty path means the stacks folder. A path without a leading / starts there too. depth is how many folder levels to show (1 to 4).

Make a folder (and missing parent folders) on the Docker host. Needs confirm=true.

Move or rename a file or folder on the Docker host. Needs confirm=true.

Without overwrite=true an existing destination is left alone.

Read a text file on the Docker host. Secret values are hidden.

Files that hold secrets (.env, *.env, keys, credentials) are never shown. Big files are cut (SERVER_MCP_MAX_FILE_KB, default 1024 KB).

Create a file, or replace a whole file, on the Docker host. Needs confirm=true.

make_dirs creates missing folders. backup keeps the old file as .bak. mode is an optional octal mode such as 644 or 755 (for scripts). An existing file keeps its mode and owner. encoding is text, or base64 for binary files. For a small change to an existing file use server_file_edit instead: it never touches hidden secret lines.

List the Docker hosts this tool knows and test the connection to each.

Show the system: OS, kernel, uptime, CPU, memory, disks and network. Read only.

Look at background jobs started with background=true.

action: list, status, output (last lines of the log), cancel, clean (remove finished jobs). Jobs started as root must be read with as_root=true. list, status and output run right away. cancel and clean show a preview first.

Read the system log (journalctl). Optional unit, line count, since ("1 hour ago") and grep. Read only.

Manage system packages (apt, dnf or apk, found automatically).

action: list_updates and search are read only. update (refresh lists), install, remove and upgrade show a preview first. packages is a space separated list. background=true starts it as a background job and returns a job id at once. Use it for upgrade and install, which can take minutes. Check it with server_job.

Reboot or power off the host. action: reboot or poweroff. Always shows a preview first.

The SSH link drops when it runs. That is normal.

Show the busiest processes. sort: cpu or mem. Read only.

Run one shell command on the Docker host itself (not inside a container).

It starts in the stacks folder. Safe read-only commands (ls, cat, head, tail, grep, find, df, free, uptime, git status/log/diff, ps, ss, ip, and pipes between them) run right away. Anything else needs confirm=true after the user says yes. Risky ones (rm, mv, dd, chmod, chown, kill, systemctl, apt, reboot, sudo ...) are marked destructive in the preview. as_root=true runs it with sudo. Root commands always show a preview first. background=true starts it as a background job and returns a job id at once (use it for anything that can take more than about 40 seconds). Check it with server_job. Files with passwords or keys (.env, keys, credentials) are blocked. For files, prefer server_file_read, server_file_write and server_file_edit.

Manage a systemd service. action: status, start, stop, restart, reload, enable, disable.

status is read only and runs right away. The others show a preview first.