Installation

Requirements

• Docker Engine on Linux, macOS, or Windows with WSL2 — any release still supported by Docker will do, because the version floor below is set by Compose rather than by the engine
• Docker Compose v2.24 or newer, if you install that way — the compose file below declares its .env as optional, which older versions do not understand
• Around 300 MB of disk for the image itself, and 512 MB of RAM — a running manager sits near 170 MB with a small fleet
• Room for the data directory on top of that. It holds the database, the certificates and the backups, and it grows with log retention and metric history, so a fleet of any size wants a few gigabytes rather than a few hundred megabytes
• Network access to your MikroTik devices (SSH port 22 and/or HTTPS port 443)

Installing with Docker

Step 1 — Pull the image

docker pull ghcr.io/hreskiv/mikr:latest

Step 2 — Create a data directory

This directory stores the SQLite database, TLS certificates, and backups. It persists across container restarts and updates.

mkdir -p /opt/mikr/data

Step 3 — Run the container

docker run -d \
  --name mikr-manager \
  --restart unless-stopped \
  -p 3000:3000 \
  -p 3443:3443 \
  -p 5514:5514/udp \
  -p 5514:5514/tcp \
  -v /opt/mikr/data:/app/data \
  -e STORAGE_ADAPTER=sqlite \
  ghcr.io/hreskiv/mikr:latest

Port 5514 is the optional syslog receiver (Log collector). Both UDP and TCP listeners run by default — RouterOS 7.x can send over either. Skip the -p 5514:5514/... lines if you don't need logs, or set SYSLOG_ENABLED=false / SYSLOG_TCP_ENABLED=false.

Step 4 — Open in browser

Navigate to http://your-server-ip:3000 and log in.

Installing with Docker Compose

If you prefer Docker Compose, create these two files and run one command.

Step 1 — Create project directory

mkdir -p /opt/mikr && cd /opt/mikr

Step 2 — Create the .env file

This file stores your secrets. Generate random values and save them — you'll need the same keys on every update.

cat > /opt/mikr/.env <<EOF
JWT_SECRET=$(openssl rand -hex 32)
ENCRYPTION_KEY=$(openssl rand -hex 32)
EOF

Step 3 — Create docker-compose.yml

cat > /opt/mikr/docker-compose.yml <<'EOF'
services:
  mikr:
    image: ghcr.io/hreskiv/mikr:latest
    container_name: mikr-manager
    restart: unless-stopped
    ports:
      - "3000:3000"
      - "3443:3443"
      - "5514:5514/udp"   # optional — syslog receiver UDP
      - "5514:5514/tcp"   # optional — syslog receiver TCP
    volumes:
      - ./data:/app/data
    environment:
      - STORAGE_ADAPTER=sqlite
    env_file:
      - path: .env
        required: false
EOF

Step 4 — Start

cd /opt/mikr
docker compose up -d

MikroTik Container (RouterOS 7.22+)

Run mikr directly on a MikroTik router using the Container feature — no separate server needed.

Requirements

• RouterOS 7.22+ with Container package installed
• ARM64 (RB5009, hAP ax², cAP ax) or x86 (CHR) architecture
• At least 512 MB of free RAM, and around 300 MB of free storage for the image before any data
• USB or external storage recommended for persistence

Container App YAML

Paste this into the YAML tab of the MikroTik Container App configuration:

name: mikr
descr: MikroTik Manager — web-based device management, monitoring, and configuration for MikroTik fleets.
page: https://mikr.app
category: networking
default-credentials: admin/admin
services:
  mikr:
    image: ghcr.io/hreskiv/mikr:latest
    ports:
      - "3000:3000:web"
      - "3443:3443:web-ssl"
      - "5514:5514/udp:syslog-udp"
      - "5514:5514/tcp:syslog-tcp"
    environment:
      - HOST=0.0.0.0
      - PORT=3000
      - ENCRYPTION_KEY=<your-encryption-key>
      - JWT_SECRET=<your-jwt-secret>
    volumes:
      - data:/app/data
    restart: unless-stopped

RouterOS CLI (alternative)

If you prefer configuring via CLI instead of the Container App UI:

# Enable container mode (requires reboot)
/system/device-mode/update container=yes

# Create veth interface for the container
/interface/veth/add name=veth-mikr address=172.17.0.2/24 gateway=172.17.0.1

# Create a bridge for containers
/interface/bridge/add name=bridge-containers
/interface/bridge/port/add bridge=bridge-containers interface=veth-mikr
/ip/address/add address=172.17.0.1/24 interface=bridge-containers

# NAT for container internet access
/ip/firewall/nat/add chain=srcnat action=masquerade src-address=172.17.0.0/24

# Port forwarding — access mikr from LAN
/ip/firewall/nat/add chain=dstnat action=dst-nat protocol=tcp \
    dst-port=3000 to-addresses=172.17.0.2 to-ports=3000

# (optional) Syslog receiver — lets other MikroTiks send logs to mikr
/ip/firewall/nat/add chain=dstnat action=dst-nat protocol=udp \
    dst-port=5514 to-addresses=172.17.0.2 to-ports=5514

# (optional) TCP syslog — useful when UDP is blocked in the path
/ip/firewall/nat/add chain=dstnat action=dst-nat protocol=tcp \
    dst-port=5514 to-addresses=172.17.0.2 to-ports=5514

# Persistent data mount (use USB/NVMe, not NAND flash)
/container/mounts/add list=mikr-data src=disk1/mikr/data dst=/app/data

# Environment variables
/container/envs/add list=mikr-env key=HOST value=0.0.0.0
/container/envs/add list=mikr-env key=PORT value=3000
/container/envs/add list=mikr-env key=ENCRYPTION_KEY value=<your-key>
/container/envs/add list=mikr-env key=JWT_SECRET value=<your-secret>

# Pull and create container
/container/add remote-image=ghcr.io/hreskiv/mikr:latest \
    interface=veth-mikr envlist=mikr-env mountlists=mikr-data \
    hostname=mikr start-on-boot=yes logging=yes

# Start
/container/start 0

Environment variables

Pass variables with -e flags or mount an .env file. All are optional with sensible defaults.

Example with custom secrets:

docker run -d \
  --name mikr-manager \
  --restart unless-stopped \
  -p 3000:3000 \
  -p 3443:3443 \
  -v /opt/mikr/data:/app/data \
  -e STORAGE_ADAPTER=sqlite \
  -e JWT_SECRET=$(openssl rand -hex 32) \
  -e ENCRYPTION_KEY=$(openssl rand -hex 32) \
  ghcr.io/hreskiv/mikr:latest

Updating

Your data is stored in /opt/mikr/data (mounted volume), so it survives container replacement.

Docker Compose

cd /opt/mikr
docker compose pull
docker compose up -d

Plain Docker

# Pull the latest image
docker pull ghcr.io/hreskiv/mikr:latest

# Stop and remove the old container
docker stop mikr-manager
docker rm mikr-manager

# Start a new container with the same settings
docker run -d \
  --name mikr-manager \
  --restart unless-stopped \
  -p 3000:3000 \
  -p 3443:3443 \
  -v /opt/mikr/data:/app/data \
  --env-file /opt/mikr/.env \
  ghcr.io/hreskiv/mikr:latest

Clean up old images

docker image prune -f

Activating a licence

The Community edition supports up to 10 devices for free. To manage more devices, activate your licence key in the app:

1. Log in as admin
2. Navigate to License in the sidebar
3. Paste your licence key and click Activate

The licence is stored in the database and persists across updates.

Enabling HTTPS

Auto-generated self-signed certificate

docker run -d \
  --name mikr-manager \
  --restart unless-stopped \
  -p 3000:3000 \
  -p 3443:3443 \
  -v /opt/mikr/data:/app/data \
  -e STORAGE_ADAPTER=sqlite \
  -e TLS_ENABLED=true \
  ghcr.io/hreskiv/mikr:latest

Access via https://your-server-ip:3443. Your browser will warn about the self-signed cert — this is expected.

Custom certificate

docker run -d \
  --name mikr-manager \
  --restart unless-stopped \
  -p 3000:3000 \
  -p 3443:3443 \
  -v /opt/mikr/data:/app/data \
  -v /path/to/certs:/certs:ro \
  -e STORAGE_ADAPTER=sqlite \
  -e TLS_ENABLED=true \
  -e TLS_CERT_PATH=/certs/fullchain.pem \
  -e TLS_KEY_PATH=/certs/privkey.pem \
  ghcr.io/hreskiv/mikr:latest

Prometheus, Grafana & Zabbix

mikr exposes a /metrics endpoint in Prometheus text format. Connect it to Prometheus + Grafana for historical graphs of CPU, memory, temperature, per-interface traffic, and device availability.

Enable the endpoint

The /metrics endpoint is disabled by default (returns 404). You can turn it on in the app under Settings → Prometheus export, where you can also set an optional scrape token. To enable it with environment variables instead, set METRICS_ENABLED=true:

# In .env file
METRICS_ENABLED=true

# Optional but recommended — Bearer token auth
METRICS_TOKEN=your-secret-token

Generate a strong random token:

openssl rand -hex 32

If METRICS_TOKEN is set, Prometheus must send a Bearer token or use ?token=your-secret-token.

Verify metrics are available

curl http://your-server-ip:3000/metrics

Prometheus configuration

Add this to your prometheus.yml:

scrape_configs:
  - job_name: 'mikr'
    scrape_interval: 60s
    metrics_path: /metrics
    static_configs:
      - targets: ['your-server-ip:3000']

With token authentication:

scrape_configs:
  - job_name: 'mikr'
    scrape_interval: 60s
    metrics_path: /metrics
    authorization:
      type: Bearer
      credentials: 'your-secret-token'
    static_configs:
      - targets: ['your-server-ip:3000']

If mikr uses HTTPS (port 3443):

scrape_configs:
  - job_name: 'mikr'
    scheme: https
    tls_config:
      insecure_skip_verify: true
    scrape_interval: 60s
    metrics_path: /metrics
    static_configs:
      - targets: ['your-server-ip:3443']

Available metrics

All per-device metrics include labels: name, host, site. The interface traffic metrics add an interface label. The rate metrics already carry a computed bits-per-second value, so you graph them directly without rate().

InfluxDB (via Telegraf)

There is no native InfluxDB push. Point a Telegraf prometheus input at the endpoint and Telegraf writes the series into InfluxDB:

[[inputs.prometheus]]
  urls = ["http://your-server-ip:3000/metrics"]
  # http_headers = { "Authorization" = "Bearer your-secret-token" }

[[outputs.influxdb_v2]]
  urls = ["http://influxdb:8086"]
  token = "INFLUX_TOKEN"
  organization = "your-org"
  bucket = "mikrotik"

Grafana dashboard

Import the ready-made dashboard template:

1. Download grafana-dashboard.json
2. In Grafana, go to Dashboards → Import → Upload JSON file
3. Select your Prometheus data source and click Import

The dashboard includes: fleet overview stats, device status table, CPU/memory time series, temperature/voltage/power graphs, per-interface traffic (RX/TX), uptime tracking, RouterOS version distribution, and device model breakdown. Filter by site and device using the dropdown variables at the top.

Zabbix

Zabbix does not need the /metrics endpoint at all. The template reads the REST API, so it also sees what /metrics does not publish: CVE counts, missing security releases, licence headroom, syslog throughput, blocked attackers and failed tasks. Your routers need no SNMP community and no Zabbix agent, and do not have to be reachable from the Zabbix server — everything comes from the manager.

1. Download zabbix-template.yaml
2. In the manager, sign in as a Super Admin, open API Keys in the sidebar and create a key with the viewer role and access to every site
3. In Zabbix, go to Data collection → Templates → Import and upload the YAML file
4. Link the template to a host and fill in two macros:
   • {$MIKR.URL} — https://mikr.example.com, no trailing slash
   • {$MIKR.API.KEY} — the key from step 2

Devices are discovered from the API, so every device the manager polls arrives with its own items and triggers: online state, CPU, memory, temperature, voltage, power, RouterOS version, RouterBOARD firmware, and how long ago it was last polled. Triggers cover offline devices, threshold breaches, an available RouterOS update, firmware left behind after an upgrade, and monitoring data going stale.

Thresholds are macros — {$MIKR.CPU.WARN}, {$MIKR.TEMP.WARN}, {$MIKR.RAM.WARN} — and take a per-device context, so {$MIKR.CPU.WARN:"core-router"} overrides the fleet default for one device. {$MIKR.DEVICE.MATCHES} and {$MIKR.DEVICE.NOT_MATCHES} limit discovery to devices whose name matches a pattern.

API access

MikroTik Manager exposes an HTTP/JSON API under /api — the same one the web interface uses. Scripts, monitoring, and CI can call it using an API key, with no interactive login or token refresh.

Creating a key

Sign in as a Super Admin, open the API Keys page, and click Create API Key. Choose:

• Role — viewer, operator, or admin (a key can never be Super Admin)
• Scope — optionally limit the key to specific sites, exactly like a scoped user
• Expiry — optional; leave empty for a key that never expires

The token (format mikr_…) is shown once at creation — copy it then, it cannot be retrieved later. Only a SHA-256 hash is stored on the server.

Using a key

Send the key in an X-API-Key header:

curl -H "X-API-Key: mikr_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  https://YOUR-HOST:3443/api/devices

…or as a Bearer token (the mikr_ prefix is auto-detected):

curl -H "Authorization: Bearer mikr_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  https://YOUR-HOST:3443/api/devices

Roles

Run operations — execute commands and templates, RouterOS/firmware upgrades, reboots, create and download backups, test/refresh devices. Change config & inventory — create/edit/delete devices and sites, settings, command templates, webhooks, IDS, license, DHCP and service toggles.

A key acts with its role across the same server-side role and per-site checks as a user. * Super Admin (manages users, API keys, and per-site access grants) is available in the interface only — an API key can never hold it.

Troubleshooting

View logs

docker logs mikr-manager --tail 100

Follow logs in real-time

docker logs mikr-manager -f

Enable debug logging

Stop the container and re-run with -e LOG_LEVEL=debug to see SSH/REST connection details.

Container won't start

• Check if port 3000 is already in use: ss -tlnp | grep 3000
• Verify the data directory exists and is writable
• Check Docker logs for startup errors

Devices show "Error" or "Offline"

• Verify SSH connectivity from the Docker host: ssh admin@device-ip
• Check that the MikroTik user has required permissions: ssh, read, write, sensitive, api, rest-api — and reboot as well if you upgrade or restart devices from the manager
• For REST devices, ensure www-ssl or www service is enabled on the MikroTik
• Check container logs for specific error messages

Reset admin password

Try the app first. A second Super Admin can set another account's password from the Users page, and every user changes their own under Settings → Password. The command below is for the case where nobody can sign in at all.

If the account is simply missing, re-run the seed script — it only creates a new admin when there is no user at all, and says so and stops otherwise:

docker exec mikr-manager node scripts/seed.js

To force a new password onto an existing account, run this against the container. Replace newpassword with the one you want, and admin with the username if it differs:

docker exec mikr-manager node -e "
const {getStore}=require('./src/data/store');
const {hashPassword}=require('./src/services/auth.service');
(async()=>{
  const store=getStore();
  const user=await store.users.findByUsername('admin');
  if(!user) return console.error('no such user');
  await store.users.update(user.id,{
    passwordHash: await hashPassword('newpassword'),
    passwordChangedAt: Date.now()
  });
  console.log('password reset for', user.username);
})();"

Every other session signed in as that account is signed out shortly afterwards, on this machine and any other. Sign in with the new password and change it from Settings once you are back in.