alloy-docker-compose/docker-compose.yml

# Required env vars (export before `docker compose up -d`):
#   ALLOY_HOSTNAME, REMOTECFG_URL, REMOTECFG_ID, REMOTECFG_USER,
#   PROM_URL, PROM_USER, LOKI_URL, LOKI_USER, GRAFANA_TOKEN

services:
  alloy:
    image: grafana/alloy:v1.10.0
    container_name: alloy
    restart: unless-stopped
    hostname: ${ALLOY_HOSTNAME:?required}
    privileged: true
    network_mode: host                        # node_exporter netdev/netstat sees real host interfaces (eth0…) not veth
    environment:
      ALLOY_DEPLOY_MODE: docker
      REMOTECFG_URL: ${REMOTECFG_URL:?required}
      REMOTECFG_ID: ${REMOTECFG_ID:?required}
      REMOTECFG_USER: ${REMOTECFG_USER:?required}
      PROM_URL: ${PROM_URL:?required}
      PROM_USER: ${PROM_USER:?required}
      LOKI_URL: ${LOKI_URL:?required}
      LOKI_USER: ${LOKI_USER:?required}
      GRAFANA_TOKEN: ${GRAFANA_TOKEN:?required}
    volumes:
      - alloy-data:/var/lib/alloy/data
      - /proc:/rootproc:ro
      - /var/run/docker.sock:/var/run/docker.sock
      - /sys:/sys:ro
      - /:/rootfs:ro
      - /dev/disk/:/dev/disk:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /var/log:/var/log:ro                  # journal + syslog/messages/*.log for the Linux-Node integration
      - /etc/machine-id:/etc/machine-id:ro    # stable host id for systemd journal reader
    configs:
      - { source: alloy_config, target: /etc/alloy/config.alloy }
    command: 'run --storage.path=/var/lib/alloy/data /etc/alloy/config.alloy'

volumes:
  alloy-data:

configs:
  alloy_config:
    content: |
      remotecfg {
        url = sys.env("REMOTECFG_URL")
        id = sys.env("REMOTECFG_ID")
        poll_frequency = "60s"

        basic_auth {
          username = sys.env("REMOTECFG_USER")
          password = sys.env("GRAFANA_TOKEN")
        }
      }

      prometheus.remote_write "metrics_service" {
        endpoint {
          url = sys.env("PROM_URL")

          basic_auth {
            username = sys.env("PROM_USER")
            password = sys.env("GRAFANA_TOKEN")
          }
        }
      }

      loki.write "grafana_cloud_loki" {
        endpoint {
          url = sys.env("LOKI_URL")

          basic_auth {
            username = sys.env("LOKI_USER")
            password = sys.env("GRAFANA_TOKEN")
          }
        }
      }

      discovery.relabel "integrations_node_exporter" {
        targets = prometheus.exporter.unix.integrations_node_exporter.targets

        rule {
          target_label = "instance"
          replacement  = constants.hostname
        }

        rule {
          target_label = "job"
          replacement = "integrations/node_exporter"
        }
      }

      prometheus.exporter.unix "integrations_node_exporter" {
        disable_collectors = ["ipvs", "btrfs", "infiniband", "xfs", "zfs"]

        // Read host filesystems via bind mounts instead of the container namespace.
        rootfs_path = "/rootfs"
        procfs_path = "/rootproc"

        filesystem {
          fs_types_exclude     = "^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|tmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs)$"
          mount_points_exclude = "^/(dev|proc|run/credentials/.+|sys|var/lib/docker/.+)($|/)"
          mount_timeout        = "5s"
        }

        netclass {
          ignored_devices = "^(veth.*|cali.*|[a-f0-9]{15})$"
        }

        netdev {
          device_exclude = "^(veth.*|cali.*|[a-f0-9]{15})$"
        }
      }

      prometheus.scrape "integrations_node_exporter" {
        targets    = discovery.relabel.integrations_node_exporter.output
        forward_to = [prometheus.relabel.integrations_node_exporter.receiver]
      }

      // Linux-Node integration ships everything node_exporter emits and only drops
      // the per-collector scrape meta-metrics (matches the upstream cloud-config).
      prometheus.relabel "integrations_node_exporter" {
        forward_to = [prometheus.remote_write.metrics_service.receiver]

        rule {
          source_labels = ["__name__"]
          regex         = "node_scrape_collector_.+"
          action        = "drop"
        }
      }

      loki.relabel "integrations_node_exporter" {
        forward_to = [loki.write.grafana_cloud_loki.receiver]
        rule {
          target_label = "job"
          replacement  = "integrations/node_exporter"
        }
        rule {
          target_label = "instance"
          replacement  = constants.hostname
        }
      }

      journal_module "integrations_node_exporter" {
        forward_to = [loki.relabel.integrations_node_exporter.receiver]
      }

      // File-based logs from the Linux-Node integration: syslog/messages/*.log.
      // On systemd hosts, rsyslog often mirrors journald — see README "Caveats".
      local.file_match "integrations_node_exporter_files" {
        path_targets = [{
          __address__ = "localhost",
          __path__    = "/var/log/{syslog,messages,*.log}",
        }]
      }
      loki.source.file "integrations_node_exporter_files" {
        targets    = local.file_match.integrations_node_exporter_files.targets
        forward_to = [loki.relabel.integrations_node_exporter.receiver]
      }

      //JOURNAL
      declare "journal_module" {
        argument "forward_to" {
            optional = false
        }

        loki.source.journal "default"  {
            max_age       = "12h0m0s"
            path          = "/var/log/journal"
            forward_to    = [loki.process.default.receiver]
            relabel_rules = loki.relabel.default.rules
        }

        loki.relabel "default" {
            rule {
                source_labels = ["__journal__systemd_unit"]
                target_label  = "unit"
            }
            rule {
                source_labels = ["__journal__boot_id"]
                target_label  = "boot_id"
            }
            rule {
                source_labels = ["__journal__transport"]
                target_label  = "transport"
            }
            rule {
                source_labels = ["__journal_priority_keyword"]
                target_label  = "level"
            }
            forward_to    = []
        }
        loki.process "default" {
            forward_to    = argument.forward_to.value
        }
      }

      prometheus.exporter.cadvisor "integrations_cadvisor" {
          docker_only = true
      }
      discovery.relabel "integrations_cadvisor" {
          targets = prometheus.exporter.cadvisor.integrations_cadvisor.targets

          rule {
              target_label = "job"
              replacement  = "integrations/docker"
          }

          rule {
              target_label = "instance"
              replacement  = constants.hostname
          }
      }

      prometheus.relabel "integrations_cadvisor" {
          forward_to = [prometheus.remote_write.metrics_service.receiver]

          rule {
              source_labels = ["__name__"]
              regex         = "container_cpu_usage_seconds_total|container_fs_reads_total|container_fs_usage_bytes|container_fs_writes_total|container_last_seen|container_memory_usage_bytes|container_network_receive_bytes_total|container_network_receive_errors_total|container_network_receive_packets_dropped_total|container_network_transmit_bytes_total|container_network_transmit_errors_total|container_network_transmit_packets_dropped_total|container_spec_memory_reservation_limit_bytes|machine_memory_bytes|machine_scrape_error|up"
              action        = "keep"
          }
      }

      prometheus.scrape "integrations_cadvisor" {
          targets    = discovery.relabel.integrations_cadvisor.output
          forward_to = [prometheus.relabel.integrations_cadvisor.receiver]
      }

      discovery.docker "logs_integrations_docker" {
          host             = "unix:///var/run/docker.sock"
          refresh_interval = "5s"
      }
      discovery.relabel "logs_integrations_docker" {
          targets = []

          rule {
              target_label = "job"
              replacement  = "integrations/docker"
          }

          rule {
              target_label = "instance"
              replacement  = constants.hostname
          }

          rule {
              source_labels = ["__meta_docker_container_name"]
              regex         = "/(.*)"
              target_label  = "container"
          }

          rule {
              source_labels = ["__meta_docker_container_log_stream"]
              target_label  = "stream"
          }
      }
      loki.source.docker "logs_integrations_docker" {
          host             = "unix:///var/run/docker.sock"
          targets          = discovery.docker.logs_integrations_docker.targets
          forward_to       = [loki.write.grafana_cloud_loki.receiver]
          relabel_rules    = discovery.relabel.logs_integrations_docker.rules
          refresh_interval = "5s"
      }