Observator is a tool of my own, started in October 2026 for the apps I host myself. A line like FROM node:22-alpine does not say which Node version is in the image, and an image built three months ago still runs whatever was in the cache back then. Observator records what each build really contains.
A stage at the bottom of the Dockerfile runs a small reporter written in Go during docker build. It sends the runtime versions and the lockfile to Observator. The reporter and the key stay out of the image, and the build always goes on, except with the optional gate on critical advisories.
Node.js is checked against the release schedule from nodejs.org and every npm package against OSV.dev. Each problem gets one notification, sent to Slack, Telegram, Discord, e-mail or a push service of your own.
The app is Next.js on PocketBase: two containers, with no Redis or queue. Over MCP, Claude Code can read Observator and add the snippet to the Dockerfiles in a repository. The source is on GitHub under the Functional Source License, which becomes Apache-2.0 after two years.
Features
- Exact Node.js version per app, with its release line and the image tag to pin
- npm packages from npm, Yarn and pnpm lockfiles, checked against OSV.dev
- Notifications through Slack, Telegram, Discord, e-mail, ntfy, Gotify, Pushover and webhooks
- Fix advice per advisory in the project's package manager
- Reporter as a static Go binary, also in distroless images
- MCP server for Claude Code
Technologies
Next.js
React
TypeScript
Tailwind CSS
PocketBase
Go
Docker