apache/skywalking-ui repository overview

⁠Apache SkyWalking UI

These Docker images are not official ASF releases but are provided for convenience. The recommended usage is always to build from source.

This repository hosts two UIs for Apache SkyWalking⁠:

• Horizon UI — the current SkyWalking UI. Tags: horizon-X.Y.Z and latest.
• Booster UI — the previous UI, tagged by the OAP release it shipped with (9.x, 10.x, with -java17 / -java21 variants).

latest is Horizon UI.

⁠Horizon UI

A dense, dark-first web UI on OAP's GraphQL query protocol and MQE. One image bundles the backend-for-frontend and the built UI — no separate frontend container. Multi-arch: linux/amd64 + linux/arm64.

⁠Features

• Per-layer dashboards, service/instance/endpoint drill-down, topology, traces, logs, profiling, alarms and events.
• Template-driven dashboards with an in-UI editor (edit locally, then push to OAP).
• MQE editor with syntax highlighting and debugging.
• Built-in auth (local users, LDAP, single sign-on) + RBAC, login audit, and OAP platform views (cluster status, inspect, data retention, configuration, runtime rules, live debugger).
• AI agent conversations and GenAI evaluation records; an optional AI assistant, and an MCP endpoint for your own agents.

⁠How to use

Every setting in the image's built-in /app/horizon.yaml can be set with a HORIZON_* environment variable, so no config file is needed to start.

# 1. Hash a password for the first user
docker run --rm apache/skywalking-ui:latest node -e \
  "const a=require('argon2');a.hash(process.argv[1],{type:a.argon2id}).then(h=>console.log(h))" 'your-password'

# 2. Run — paste the hash inside the single quotes
docker run -d --name horizon-ui -p 8081:8081 \
  -e HORIZON_OAP_QUERY_URL=http://<oap-host>:12800 \
  -e HORIZON_OAP_ADMIN_URL=http://<oap-host>:17128 \
  -e HORIZON_AUTH_LOCAL_USERS='[{"username":"admin","passwordHash":"<hash>","roles":["admin"]}]' \
  -v horizon-data:/data \
  apache/skywalking-ui:latest

Open http://localhost:8081⁠ and sign in as admin. Pin horizon-X.Y.Z (not latest) for production.

To configure with a file instead, copy the built-in one out, edit it, and mount it back:

docker run --rm apache/skywalking-ui:latest cat /app/horizon.yaml > horizon.yaml
docker run -d --name horizon-ui -p 8081:8081 \
  -v "$(pwd)/horizon.yaml:/app/horizon.yaml:ro" \
  -v horizon-data:/data \
  apache/skywalking-ui:latest

⁠OAP setup

Horizon talks to two OAP ports:

• OAP 11.x — everything works. This is what Horizon is built against.
• OAP 10.3 / 10.4 — set HORIZON_TEMPLATES_MODE=readonly. Dashboards render from the templates bundled in the image; the pages that need the OAP 11 admin port stay hidden.
• Older OAP — upgrade OAP first.

For an OAP behind basic auth, set HORIZON_OAP_AUTH='{"username":"…","password":"…"}'.

⁠Authentication

• local (default) — users defined in auth.local.users / HORIZON_AUTH_LOCAL_USERS, each with an Argon2 password hash and a role list.
• ldap — bind against your directory (auth.ldap); group DNs map to roles via auth.ldap.groupMappings. Select it with auth.backend / HORIZON_AUTH_BACKEND.
• Single sign-on (auth.sso) — sign in through any OpenID Connect provider (Google, Okta, Entra ID, Keycloak, …), or an OAuth 2.0 one such as GitHub. Email addresses and domains map to roles. Password sign-in keeps working alongside it.

Roles resolve to RBAC verbs that gate every page and API. Behind HTTPS, set HORIZON_SESSION_COOKIE_SECURE=true. For probes, use GET /api/health (public, no OAP dependency).

⁠Documentation

• Container image⁠ — every environment variable, Kubernetes example, volumes, probes
• Authentication⁠ — local, LDAP, single sign-on, API tokens
• OAP version requirement⁠
• All docs⁠ · source: https://github.com/apache/skywalking-horizon-ui⁠

Licensed under the Apache License 2.0.