Wiunix
Talk to an Engineer
Illustrative Academy studio: seated operator and physical DEMO Compose monitoring diagram.

WIUNIX ACADEMY

Prometheus and Grafana with Docker Compose: private monitoring and recovery

Build a private monitoring stack with pinned images, service discovery, provisioned dashboards, persistent data and a safe backup/restore rehearsal.

Intermediate60 min readUpdated
Make this guide yours

YOUR SYSTEM. YOUR STEPS.

Where are you working?

Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.

Ubuntu 24.04 LTSReviewed against official documentation ·

USE YOUR OWN VALUES

Configure this tutorial

Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.

Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.

Set values for my environment11 editable values

THE OUTCOME

What will you have at the end?

A private, digest-pinned Compose monitoring stack with verifiable collection and recoverable data.

01SSH → loopback192.0.2.40 · 13000 / 19090
02academy-monitor · 172.30.71.0/24Grafana → prometheus:9090 · Prometheus → grafana:3000
03Persistent local storage/srv/academy-monitor · /srv/academy-monitor-backups
Supported operating systems and versions

Five OS paths are documentation-reviewed. No complete OS/Docker installation, real SSH login, public deployment or alert delivery is claimed. Isolated executable checks are recorded separately. Custom settings are untested; DEMO imagery is not staff, facilities or test evidence.

Before you begin

  • Fresh dedicated Linux amd64/arm64 host with sudo, console and authorized SSH.
  • 2vCPU/4GiB RAM/20GiB local disk starting lab budget; actual ingest sizing required.
  • Unused paths, ports and nonoverlapping bridge subnet; registry/package HTTPS egress.
  • Protected password editor and approved encrypted off-host backup destination.

A Compose stack you can recover

Build a private Prometheus 3.15.0 and Grafana OSS 13.2.4 stack with pinned images, persistent storage, file-based scrape discovery, a provisioned dashboard and a controlled outage/recovery exercise. This intermediate guide takes about 60 minutes and assumes Linux, YAML and SSH experience. The result monitors these two services; it does not automatically measure the host or every Docker container. The separate host-monitoring guide covers that different task.

Follow the two network namespaces

The browser reaches host loopback ports 13000 and 19090 through existing SSH access to 192.0.2.40. Inside the dedicated bridge, Grafana queries http://prometheus:9090; Prometheus scrapes itself and grafana:3000. Container loopback is that container, not the host and not its neighbor. Service DNS survives replacement; fixed container IPs are unnecessary. Internal service ports 9090/3000 stay fixed; the public settings change only host/tunnel ports. No inbound web rule or public domain is needed.

Keep management off the internet

Only 127.0.0.1 is published. Require a maintained Docker Engine at least 28: older releases had a same-L2 localhost-publish exposure. Docker-published ports can bypass ordinary UFW policy; never change to an all-interface bind as a troubleshooting shortcut. Host root and Docker API users can read the files and reach the bridge. Do not add untrusted workloads to this network. A read-only Docker socket mount still exposes a privileged API; this guide mounts no socket, host root, cgroups or privileged exporter. cAdvisor and containerized node_exporter require their own host-access threat assessment.

Choose dedicated public values first

Choose an unused identifier academy-monitor, disjoint new absolute stack/backup directories, an unused bridge subnet 172.30.71.0/24, and distinct free host/tunnel ports. Paths must not be nested or existing; inspect symlinked parents and ownership separately. The subnet must not overlap LAN, VPN, routes or other Docker networks. SSH host/user/port describe your existing authorized access and do not create it. Retention is 15 days with a 5 GiB block limit; reserve extra disk for WAL, head data, Grafana, logs and backups. Applied settings and custom progress stay in sessionStorage in this tab/language/article/environment; default progress uses localStorage. Nothing enters share links or the server. Never enter secrets here. Custom values are not tested deployments.

01

LET’S BUILD

Inspect a fresh dedicated host

Use a new dedicated amd64 or arm64 host with sudo and independent console access. Start with 2 vCPU, 4 GiB RAM and at least 20 GiB free local disk for this small lab, then size from actual active series and ingest rate. Review routes and listeners. If a container runtime or workload exists, stop and plan its migration; do not remove packages or restart a shared daemon blindly.

Bash

Dedicated Linux host; Bash shell

cat /etc/os-release
dpkg --print-architecture
df -h /var/lib /srv
free -h
ip -4 route show table all
sudo ss -lntup
dpkg-query -W docker.io docker-ce containerd containerd.io runc podman-docker docker-compose docker-compose-v2 2>/dev/null || true
How do I know it worked?

Supported OS/architecture, adequate resources, free selected ports and no existing runtime workload.

02

LET’S BUILD

Configure the official Docker repository

Current vendor documentation explicitly lists Ubuntu 26.10, 26.04/24.04 LTS and Debian 13/12. This step uses the selected OS repository and its own codename; it never substitutes another release. It is only for the empty host confirmed above. Review conflicting distribution Docker/containerd/runc packages through the official prerequisite page before proceeding. Installing Docker changes host networking and starts a privileged daemon; perform this only on your lab host. Download the vendor key over HTTPS; the signed repository then verifies package metadata.

Bash

Dedicated Linux host; Bash shell

sudo apt-get update
sudo apt-get install --no-install-recommends ca-certificates curl python3 nano iproute2
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
sudo tee /etc/apt/sources.list.d/docker.sources >/dev/null <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF
sudo apt-get update
apt-cache policy docker-ce docker-compose-plugin
How do I know it worked?

Correct signed vendor repository for the selected codename; no signature or missing-release error.

Explore all tutorials ↗