- Switch back to 1000:1000

- Mount docker socket read-only
- Use docker service discovery

homelab/server/config/monitoring/docker-compose.yml

@@ -56,11 +56,11 @@ services:
     promtail:
         image: grafana/promtail:2.5.0
         container_name: monitoring_promtail
-        user: "0:0" # change back to 1000:1000 after testing
+        user: "1000:1000" 
         networks:
             - monitoring
         volumes:
-            - /var/lib/docker/:/var/lib/docker:ro
+            - /var/run/docker.sock:/var/run/docker.sock:ro
             - ${DOCKER_DATA}/promtail:/etc/promtail
             - ./promtail-config.yml:/etc/promtail/promtail-config.yml # not sure if this works. If not, just edit the config within the data volume
         restart: unless-stopped

homelab/server/config/monitoring/promtail-config.yml

@@ -9,13 +9,17 @@ clients:
   - url: http://loki:3100/loki/api/v1/push
 
 scrape_configs:
-  - job_name: docker 
-    pipeline_stages:
-      - docker: {}
-    static_configs:
-      - labels:
-          job: docker
-          __path__: /var/lib/docker/containers/*/*-json.log
+  - job_name: docker
+    docker_sd_configs:
+      - host: unix:///var/run/docker.sock
+        refresh_interval: 5s
+        filters:
+          - name: name
+            values: [flog] 
+    relabel_configs:
+      - source_labels: ['__meta_docker_container_name']
+        regex: '/(.*)'
+        target_label: 'container'
 
 # local machine logs
 #