What is Rootprint?

Rootprint is an open-source platform for logs and traces that you run on your own infrastructure. It stores indexed log data directly in S3-compatible object storage (AWS S3, GCS, Cloudflare R2, MinIO, Azure Blob), so retention expenses match your storage bill. The deployment uses three containers: Rootprint (web UI on port 8282), Quickwit (search engine), and PostgreSQL (accounts and settings). It supports Google, GitHub, and OpenID Connect sign-in, scoped API keys, and a read-only MCP server for AI agent access (Claude Code, Cursor). The project has not reached version 1.0 and remains in active development.

Should you self-host Rootprint?

Rootprint scores 49/100 on selfhost.directory (how scoring works) and ranks #6 of 13 in Log Management. It has 439 GitHub stars.

It shipped 9 stable releases in the past year. The latest, v0.4.6, came out on 20 October 2026. New versions land roughly every 4 days.

Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is Apache-2.0-licensed and written mostly in Svelte.

Its closest alternative on selfhost.directory is netdata (87/100, 81 201 stars). It scores higher overall, so compare the two before you pick. See Rootprint vs netdata side by side.

Features

Admin Controls
AI agent access (MCP)
Full-Text Search
Log and trace correlation
OpenTelemetry ingestion
S3-compatible Storage
Service health
Team access with roles
Trace explorer

How to configure Rootprint

BETTER_AUTH_SECRETAuto-generatedSigns session tokens and encrypts stored OAuth access and refresh tokens. If set, it must be at least 32 characters or startup fails. If unset, Rootprint generates one on first boot and stores it in the database.
Signs session tokens and encrypts stored OAuth access and refresh tokens. If set, it must be at least 32 characters or startup fails. If unset, Rootprint generates one on first boot and stores it in the database.
DATABASE_URLPostgreSQL connection string, for example postgres://rootprint:rootprint@db:5432/rootprint.
PostgreSQL connection string, for example postgres://rootprint:rootprint@db:5432/rootprint.
FRONTEND_URLSame as ORIGINAdditional allowed CORS origin, for split deployments where the SPA is hosted on a different origin than the API. Sign-in callbacks, invite links, and cookies still use ORIGIN.
Additional allowed CORS origin, for split deployments where the SPA is hosted on a different origin than the API. Sign-in callbacks, invite links, and cookies still use ORIGIN.
INGEST_PROXY_TIMEOUT_MS120000How long an ingest request (/api/ingest/ndjson, /v1/logs, /v1/traces) may wait on Quickwit before Rootprint answers 503. Minimum 1000.
How long an ingest request (/api/ingest/ndjson, /v1/logs, /v1/traces) may wait on Quickwit before Rootprint answers 503. Minimum 1000.
LOG_LEVELinfoAPI log level: trace, debug, info, warn, error, or fatal.
API log level: trace, debug, info, warn, error, or fatal.
values: trace, debug, info, warn, error, fatal
OIDC_DISCOVERY_TIMEOUT_MS5000How long an OpenID Connect discovery fetch may take before the issuer is treated as unreachable.
How long an OpenID Connect discovery fetch may take before the issuer is treated as unreachable.
OIDC_RETRY_MS60000How long to wait before retrying OpenID Connect discovery after it fails at boot. The provider stays hidden from the sign-in page until discovery succeeds.
How long to wait before retrying OpenID Connect discovery after it fails at boot. The provider stays hidden from the sign-in page until discovery succeeds.
ORIGINCanonical public URL of this Rootprint instance, for example https://logs.example.com. Used for sign-in callbacks, invite links, the CORS allow-list, and cookies.
Canonical public URL of this Rootprint instance, for example https://logs.example.com. Used for sign-in callbacks, invite links, the CORS allow-list, and cookies.
PORT8282HTTP listen port. Remap the port with the compose ports: block instead of changing this.
HTTP listen port. Remap the port with the compose ports: block instead of changing this.
PUBLIC_AUTH_RATE_LIMIT30Requests per client IP per window on unauthenticated auth routes (first-admin setup, and invite and password-reset links).
Requests per client IP per window on unauthenticated auth routes (first-admin setup, and invite and password-reset links).
QUICKWIT_URLQuickwit REST endpoint, for example http://quickwit:7280. Must point at Quickwit 0.9.0; earlier releases are not supported.
Quickwit REST endpoint, for example http://quickwit:7280. Must point at Quickwit 0.9.0; earlier releases are not supported.
RATE_LIMIT_WINDOW_MS60000Window length in milliseconds, shared by both limiters. A 429 sends the window in seconds, rounded up, as Retry-After (60 by default).
Window length in milliseconds, shared by both limiters. A 429 sends the window in seconds, rounded up, as Retry-After (60 by default).
READ_RATE_LIMIT300Requests per signed-in user per window on search, histogram, field values, trace and service health reads, MCP tool calls, and share resolution.
Requests per signed-in user per window on search, histogram, field values, trace and service health reads, MCP tool calls, and share resolution.
SEARCH_AUDIT_RETENTION_DAYS30Days of search activity audit rows to keep. Older rows are pruned hourly. Minimum 30; a lower value fails startup.
Days of search activity audit rows to keep. Older rows are pruned hourly. Minimum 30; a lower value fails startup.
TRACE_INDEX_IDotel-traces-v0_9The span store: the one Quickwit index holding OTLP spans.
The span store: the one Quickwit index holding OTLP spans.
TRUST_PROXY_HOPS0Number of trusted reverse proxies in front of Rootprint that append to X-Forwarded-For. 0 uses the TCP peer address.
Number of trusted reverse proxies in front of Rootprint that append to X-Forwarded-For. 0 uses the TCP peer address.

FAQ

Does it do metrics or alerting?

No. Rootprint focuses on logs and traces and runs alongside Prometheus and Grafana, which keep handling your metrics and alerts.

Is it production-ready?

Rootprint is pre-1.0 and under active development. The engine underneath is Quickwit, which runs petabyte-scale log search in production.

What storage do I need?

Any S3-compatible object store (AWS S3, Google Cloud Storage, Cloudflare R2, MinIO, Ceph), Azure Blob, or local disk for a laptop trial. Quickwit writes index splits there; search nodes stay stateless.

What does it cost?

Nothing for the software (Apache-2.0). You pay your cloud provider for the compute it runs on and the storage it fills. Rootprint charges nothing per host, per seat, or per GB ingested.

How do I self-host it?

Docker Compose brings up three containers next to an S3-compatible bucket: Rootprint, Quickwit, and Postgres. The quickstart takes about five minutes.

Does Rootprint handle traces?

Yes. Send OTLP spans to POST /v1/traces with an existing ingest key. The trace explorer charts span volume, error rate, and latency, and filters spans by service, operation, duration, and status. Open a trace from any log carrying its trace ID, or paste the ID into the search box, and you get a waterfall with per-span attributes, events, database calls, and links back to the correlated logs.

What is Rootprint?

Open-source log and trace search that runs on your own object storage. Built on Quickwit, it indexes the full text of every log, so you can find any line without designing labels first. Indexes live in your S3, GCS, R2, MinIO, or Azure Blob bucket, so a year of retention costs a year of storage.