Small requests, shared results
Automatic small pages build a complete list. Compact caches are reused and kept current through watches.
THE DESKTOP WORKSPACE FOR YOUR INFRASTRUCTURE
Kubernetes & Docker.One clear workspace.
A desktop app for developers and DevOps. Investigate Kubernetes resources, follow Docker logs and manage Helm releases in one workspace.No kubectl or Helm CLI requiredConnect directly to the Kubernetes API. Helm is built in.
Kubernetes + DockerOne place for daily operations
Your existing accessKubeconfig and Docker contexts
Helm built inNo separate Helm CLI
Built to respect your cluster and computer.
Ocular loads the resource type and namespaces you choose. It avoids collecting every resource and full description in the background.
Bounded work
Request concurrency, request rates and idle cache retention are limited. Large All Namespaces reads ask you to choose namespaces instead of silently showing a partial list.
You control the load
Refresh explicitly, follow elapsed time and received data, or cancel a list request. The cluster graph loads only when you ask.
10,000 Pods. 558 MiB of memory.
A complete list of 10,000 Pods, with local search and sorting. Small requests, a shared cache and explicit loading keep the work under your control.
- Connect → complete resource list
- 9.8 s
- Resources in the complete list
- 10,000
- Read budget · requests/s
- 10
- Sampled peak memory · app + browser
- 558 MiB
Measured with SPK Ocular 1.7.0 on Linux in browser mode. Sampled peak total PSS of the app and Chromium across 6 sessions, including object details.
Measurement conditions
Per connection: 10 read requests/s with a burst of 20, and at most 4 finite responses in flight.
Measured with SPK Ocular 1.7.0 on a local Kubernetes HTTP test fixture. Initial loading is the median of 3 fresh application sessions; 100 pages of 100 Pods form the complete list.
Linux browser mode with a dedicated headless Chromium. PSS includes the app and Chromium process trees; the HTTP fixture and measurement tool are excluded. The sampled peak across 6 valid sessions was 558 MiB.
Memory was sampled approximately every 0.5 seconds.
From “what failed?” to “what next?”
The details you need to investigate and act, without piecing together a dozen separate windows.
01 / INVESTIGATE
Find the workload that needs you.
Spot unhealthy resources, open related objects and inspect their configuration. See when permissions or connection errors prevent a complete picture.
- Resource health, events and relationships
- Namespace selection, search and favorites
- Deployment revision history and read-only YAML comparison
02 / TROUBLESHOOT
Keep the evidence in view.
Matching lines appear while a bounded history scan continues; new live lines arrive alongside it. Search works within the filtered result. Open a terminal or forward a service port to investigate further.
Download retained source log history independently of viewer filters or line limits. Downloads opens automatically with progress and cancellation; click a completed row to open the file. Right-click the log download button to choose a location. Retention, export limits and incomplete reads remain explicit. Copy uses the filtered viewer buffer.
- All log levels, text filters and search
- Separate log windows and plain-text exports
- Terminals, container selection and local port forwarding
03 / SHIP & RECOVER
Helm, from install to rollback.
Browse charts, choose a version and edit values. Review an upgrade before you run it, inspect release history or roll back to an earlier revision.
- Chart repositories and OCI registries
- Install, upgrade, rollback and uninstall
- Embedded Helm. No separate CLI required.
CONTAINER FILES
Browse folders. Edit files in place.
Browse Docker containers and Kubernetes Pods, follow symlink targets and edit configuration files in a cached folder tree. Copy whole files or folders to your computer in the desktop app.
- Cached folders, entry counts and symlink navigation
- Syntax highlighting and UTF-8 editing up to 2 MiB
- Save with unsaved-edit protection and external-change checks
- Desktop downloads go straight to your Downloads folder
Requires a running Linux container: sh for browsing, readlink for symlinks and tar for downloads. Native file and folder copies are streamed without the editor’s 2 MiB limit; existing destination names are not overwritten. Browser-mode downloads require the desktop app.
Investigate with the evidence connected.
Configuration risks and image reports
Review Kubernetes workload settings, declared RBAC rules and NetworkPolicy selection. Read existing Trivy Operator vulnerability reports with image, package and available fix details. Ocular does not run scans or install the operator; findings do not prove exploitability or compliance.
Cluster graph
Explore UID-based relationships and declared Service, Ingress and Gateway routes. This is configuration, not measured traffic.
Events timeline
Inspect bounded Kubernetes Events snapshots grouped by workload ownership. Refresh explicitly; retention and incomplete coverage stay visible. This is not an audit history.
Explain RBAC
Trace ServiceAccount bindings and role rules. Check requests as the current connection with the server; declarations and self-access decisions stay separate.
Compare saved resources
Pair resources on connected targets and compare normalized read-only YAML. Secret payloads and unsaved drafts are excluded; service fields are optional.
Keep your investigation workspace
Pin read-only properties and keep log references, ended terminal slots and panel sizes across restarts. Connect and resume explicitly; no contents or commands are saved or replayed.
The everyday tools, already here.
Quick navigation · Ctrl+K
Jump to views, environments and namespaces, or find resources by type and name, such as dep model, within your selected namespaces. Use Command+K on macOS.
Kubernetes resources
Pods, deployments, services and custom resources, with details and relationships.
Docker
Inspect standalone containers alongside Compose projects and services. Follow logs, open a terminal and review container actions.
Reviewed changes
Inspect a change before applying it. Existing infrastructure permissions still apply.
A workspace that remembers
Keep namespace selections, filters, favorites and column widths between visits.
YOUR AGENTS. YOUR RULES.
Give your agent useful access. Keep control of changes.
Let local coding agents inspect the environment through Ocular. Choose the namespaces, resource kinds and operations they can use, and review actions that require your approval.
Scope access
Choose an environment, namespaces and operations.
Inspect together
Give the agent resource and log context for its investigation.
Review the action
Approve protected changes, or pause access when the work is done.
Local agents running as your OS user share these permissions. Ocular does not isolate them from other programs on your computer. Standalone Docker containers are currently available in the UI only; project grants do not include them.
A closer look at your next workspace.
Real screens from SPK Ocular 1.9.0. Demo data, not product mockups.
LOCAL / OPEN SOURCE
No Ocular components to install in your cluster.
Ocular connects from your computer using your existing kubeconfig and Docker contexts. No central management server or in-cluster Ocular component is required.
Source codeYour existing access
Use your configured credentials and permissions. External authentication helpers specified in kubeconfig must still be installed.
Open source
Read the code, report a bug or contribute under Apache 2.0.
NO PAID TIER
Every feature. Everyone.
Free for individuals, teams and companies of any size. No limits based on revenue or funding. No seats to license and no features to unlock.
Bring your environments together.
Choose your operating system and architecture, then download the desktop installer. All features included.
Linux, Windows & macOS · x86-64 & ARM64
You can also download packages and checksums directly from GitHub Releases, without an account. Development builds are available separately from successful CI runs; they may require a GitHub account and expire.
- Choose DEB/RPM for Linux, MSI for Windows or DMG for macOS. Portable archives are also available.
- Check the SHA-256 checksum, then install and open Ocular.
- Use your existing kubeconfig or Docker context to inspect your environment.
Installation & compatibility
Linux requires GTK 3 and WebKit2GTK 4.1, including browser mode.
- DEB / RPM
- From 1.6.1, DEB and RPM require glibc 2.35 or newer. Ubuntu 24.04 remains the native build baseline.
- Verified distributions
- Package installation and desktop/browser startup were verified on Ubuntu 22.04 and Debian 12/13 (DEB), and Fedora 44 (RPM) on x86-64. Ubuntu 22.04 was also verified natively on ARM64.
Checks use isolated distribution userspaces sharing a host kernel and X11. They do not certify stock kernels, Wayland or GPU drivers.
Windows: Windows 10/11 with WebView2. macOS: version 12 or newer, Intel or Apple Silicon.
Windows installers are unsigned; macOS builds are ad-hoc signed, not notarized. Check the download source and the package’s SHA-256 checksum before installation.
Before you make yourself at home.
Is it really free for commercial use?
Yes. There are no revenue or funding limits, subscriptions or trial expiry. Every feature is included; donating is optional.
Do I need to install anything in my cluster?
No Ocular server or cluster component is required. The app uses your existing Kubernetes access. Some capabilities depend on services in your cluster, such as metrics-server for resource metrics.
Does Ocular include a container engine?
No. Ocular works with existing Docker engines, standalone containers and Compose projects. It does not provide a container engine or a virtual machine.
Do I need to install Helm separately?
No. Ocular uses the embedded Helm SDK to browse charts and manage releases. A separate Helm CLI is unnecessary. Kubernetes permissions and access to the chart repository are still required.
Can I use it with my coding agent?
Yes, through the local agent API. You grant access to selected environments, scopes and operations. Protected writes require review. Agents running as your OS user share these permissions. You can pause their access at any time.