How to run a MikroTik NetFlow collector with Docker Compose and keep it deployed

Step 1Configure the router

Two lines turn on flow export. The read-only API user and its certificate are optional but worth the extra minute: without them the collector still keeps history and raises alerts, but live views show a 90-second average and devices are named by MAC address. Replace <COLLECTOR_IP> with the host's address and <ROUTER_LAN_IP> with the router's LAN address.

1. Send flow records to the host

   active-flow-timeout=1m is the lowest value RouterOS accepts and the one the collector expects; the default of 30 minutes would hide a long download for half an hour. FastTrack can stay on.

   /ip traffic-flow set enabled=yes active-flow-timeout=1m
   /ip traffic-flow target add dst-address=<COLLECTOR_IP> port=2055 version=ipfix \
       src-address=<ROUTER_LAN_IP> v9-template-refresh=20 v9-template-timeout=1m

2. Add a read-only API user

   The flowmon group can read and use the API, nothing else, and the account only works from the host's address. The collector never needs an administrative account.

   /user group add name=flowmon policy=read,api
   /user add name=flowmon group=flowmon password=<STRONG_PASSWORD> address=<COLLECTOR_IP>/32

3. Give the API a certificate

   The encrypted API service (api-ssl, port 8729) has no certificate out of the box. A self-signed one is enough; the collector pins it on first use. Wait for the sign command to finish before the last line.

   /certificate add name=api-cert common-name=router.lan key-size=2048 days-valid=3650 \
       key-usage=key-cert-sign,crl-sign,digital-signature,key-encipherment,tls-server
   /certificate sign api-cert
   /ip service set api-ssl certificate=api-cert

   /ip traffic-flow target print shows one target pointing at the host, and /ip service print where name=api-ssl shows api-cert.

Step 2Prepare the host

1. Check Docker

   The collector needs Docker and Compose v2; the Simple Docker Ops agent additionally needs Docker running as the systemd service docker.service. Docker from snap, rootless Docker and Podman do not qualify; install Docker Engine from Docker's own repository (the supported devices page has the commands).

   docker version --format '{{.Server.Version}}'   # 24 or newer
   docker compose version --short                  # 2 or newer (Docker's repository ships 5.x; the major is what counts)
   systemctl is-active docker                      # active

2. Check the ports are free

   The collector runs with host networking and binds UDP 2055 and TCP 8080 directly. If something already holds 8080, pick another port now and use it in step 3 and step 4.

   sudo ss -lntup | grep -E ':(8080|2055)\b'       # no output means both are free

3. Pin the host's address

   A static address, or a static lease on the router (/ip dhcp-server lease make-static). The router's export target and the flowmon user's address restriction both point at it.

Step 4Make it a Simple Docker Ops application

The difference from step 3 is where the configuration lives. There is no .env file on the host: every ${NAME} in the compose text becomes a variable of the application, the password becomes a secret, and the agent writes what the container needs on the device at deploy time. The image is public, so no registry credentials are involved.

1. Pair the host

   On the host, run the installer. It checks Docker, installs the agent as a systemd service and prints Pair this device: with a code such as X72K-4PQ9. The code is single-use and valid for 15 minutes.

   curl -fsSL https://simpledockerops.com/install | sudo sh

   In the portal click + Add device, enter the code under Enrollment code, keep the host name or give it one, leave Fleet at No fleet for a single server, and click Enroll device. The agent connects outbound only; nothing new listens on the host.

   The device appears on the Devices page as online, with its architecture and Docker version.

2. Stop the plain Compose stack

   Both would bind the same ports. Run this on the host before the first deployment. The release below starts with a fresh database; the collector fills it again within minutes.

   docker compose -f deploy/docker-compose.yml down

3. Create the application

   Applications+ New application. Name netflow, paste the text below into docker-compose.yml, and Create. It is the repository's deploy/simpledockerops-compose.yml: the same container, with every setting as a variable instead of a file.

   services:
     netflow:
       image: kcdyer/mikrotik-home-netflow-plus:1.1.0
       restart: unless-stopped
       network_mode: host
       environment:
         NFP_EXPORTERS: ${ROUTER_IP}
         NFP_ROUTER_ADDR: ${ROUTER_IP}
         NFP_ROUTER_USER: ${ROUTER_USER}
         NFP_ROUTER_PASSWORD: ${ROUTER_PASSWORD}
         NFP_ROUTER_TLS: "true"
         NFP_SITES: ${SITES}
         NFP_HTTP_LISTEN: ":${HTTP_PORT}"
       volumes:
         - netflow-data:/data
   
   volumes:
     netflow-data:

4. Fill in the variables

   The portal detects the ${…} names and lists them in the application's Variables card with a Default, a Required flag and a Secret flag. ROUTER_PASSWORD is marked secret automatically because of its name; its default is disabled and says "set under Secrets". Fill in the others and Save working copy.

5. Store the router password as a secret

   SecretsSet a secret: Scope Application, Which netflow, Name ROUTER_PASSWORD, Value the flowmon password, Save secret. It is encrypted at rest, shown as dots from now on, and delivered to the agent only when a release needs it.

6. Cut a release

   Back on the application page, Cut release. Version 1.1.0, Notes as you like. The portal resolves the image to its digest and records the platforms it provides; the preflight notes would warn if there were no linux/arm64 build.

   The release shows as ready with linux/amd64 and linux/arm64 and the frozen compose text with the image pinned by @sha256:.

7. Deploy it

   ReleasesDeploy on the release. Target One device, choose the host, Start rollout. (The device page has the same thing as Choose a release to deploy… and Deploy to this device.) The agent pulls the image, starts the container and reports healthy once the container is running and its built-in health check has passed for 30 seconds.

   The deployment shows the device as healthy. http://<host>:8080 opens the collector and its Status page reads as in step 3.

Put it on a wall display

The collector's /dashboard page is a full-screen wall display built for a small always-on screen: download and upload right now, a live chart, top devices and destinations, today's totals, and a banner when the router stops exporting or an alert fires. The sister guide on the DisplayOps site, Live MikroTik traffic monitor on a wall display, puts it on a Raspberry Pi screen: which URL to use, the password prompt, and keeping the Pi on it. It starts from the collector this guide leaves you with.

Troubleshooting

• The container keeps restarting. Capture its logs from the device page (Logs, then Capture) or with docker logs on the host. bind: address already in use means another program holds the port: set HTTP_PORT to a free one and redeploy.
• The deployment never turns healthy. Same cause, or the image has no build for the host's architecture. The deploy dialog blocks with "Architecture validation failed" when the release lacks the device's platform; the published image has both, a build of your own may not.
• Status says "No flow records received yet". The router's target does not point at this host, or UDP 2055 is blocked on the way. /ip traffic-flow target print on the router.
• Packets "rejected from other sources". The router exports from an address other than ROUTER_IP. Set src-address on the target to the router's LAN address.
• Router API "invalid user name or password". The secret is wrong, or the flowmon user's address restriction does not match the host. Set the secret again and deploy the release again; devices keep the old value until their next deployment.
• Router API "TLS handshake failed". api-ssl has no certificate. Step 1.3.
• A changed variable has no effect. Application defaults are frozen into each release: cut a new one. Fleet and device variables apply as soon as they are saved.
• History is gone after a redeploy. The application was deleted and recreated, which gave the volume a new name. See the callout above.
• The installer refuses to run. Docker from snap, rootless Docker or Podman. Install Docker Engine from Docker's repository; the installer prints the steps and the supported devices page lists them.

Security checklist

• The router account has the read and api policies only and works only from the host's address.
• api-ssl has a certificate and the collector pins it on first use. Without TLS the password crosses the LAN in the clear.
• ROUTER_PASSWORD is a secret, never a default: encrypted at rest, never shown again, delivered to the agent only with a release.
• If anyone other than you can reach the host, add NFP_AUTH_PASSWORD: ${WEB_PASSWORD} to the compose text and set it as another secret. Put a reverse proxy with TLS in front if the interface leaves the LAN.
• The agent opens no inbound ports, and the collector's two ports are on your LAN only. Nothing in this guide opens anything to the internet.
• The API key has admin rights. Keep it in a secret store and create a separate key per system that uses it.