WIUNIX ACADEMY
Prometheus and Grafana with Docker Compose: private monitoring and recovery
Build a private monitoring stack with pinned images, service discovery, provisioned dashboards, persistent data and a safe backup/restore rehearsal.
Make this guide yoursYOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment11 editable values
THE OUTCOME
What will you have at the end?
A private, digest-pinned Compose monitoring stack with verifiable collection and recoverable data.
Supported operating systems and versions
Five OS paths are documentation-reviewed. No complete OS/Docker installation, real SSH login, public deployment or alert delivery is claimed. Isolated executable checks are recorded separately. Custom settings are untested; DEMO imagery is not staff, facilities or test evidence.
Before you begin
- Fresh dedicated Linux amd64/arm64 host with sudo, console and authorized SSH.
- 2vCPU/4GiB RAM/20GiB local disk starting lab budget; actual ingest sizing required.
- Unused paths, ports and nonoverlapping bridge subnet; registry/package HTTPS egress.
- Protected password editor and approved encrypted off-host backup destination.
A Compose stack you can recover
Build a private Prometheus 3.15.0 and Grafana OSS 13.2.4 stack with pinned images, persistent storage, file-based scrape discovery, a provisioned dashboard and a controlled outage/recovery exercise. This intermediate guide takes about 60 minutes and assumes Linux, YAML and SSH experience. The result monitors these two services; it does not automatically measure the host or every Docker container. The separate host-monitoring guide covers that different task.
Follow the two network namespaces
The browser reaches host loopback ports 13000 and 19090 through existing SSH access to 192.0.2.40. Inside the dedicated bridge, Grafana queries http://prometheus:9090; Prometheus scrapes itself and grafana:3000. Container loopback is that container, not the host and not its neighbor. Service DNS survives replacement; fixed container IPs are unnecessary. Internal service ports 9090/3000 stay fixed; the public settings change only host/tunnel ports. No inbound web rule or public domain is needed.
Keep management off the internet
Only 127.0.0.1 is published. Require a maintained Docker Engine at least 28: older releases had a same-L2 localhost-publish exposure. Docker-published ports can bypass ordinary UFW policy; never change to an all-interface bind as a troubleshooting shortcut. Host root and Docker API users can read the files and reach the bridge. Do not add untrusted workloads to this network. A read-only Docker socket mount still exposes a privileged API; this guide mounts no socket, host root, cgroups or privileged exporter. cAdvisor and containerized node_exporter require their own host-access threat assessment.
Choose dedicated public values first
Choose an unused identifier academy-monitor, disjoint new absolute stack/backup directories, an unused bridge subnet 172.30.71.0/24, and distinct free host/tunnel ports. Paths must not be nested or existing; inspect symlinked parents and ownership separately. The subnet must not overlap LAN, VPN, routes or other Docker networks. SSH host/user/port describe your existing authorized access and do not create it. Retention is 15 days with a 5 GiB block limit; reserve extra disk for WAL, head data, Grafana, logs and backups. Applied settings and custom progress stay in sessionStorage in this tab/language/article/environment; default progress uses localStorage. Nothing enters share links or the server. Never enter secrets here. Custom values are not tested deployments.
LET’S BUILD
Inspect a fresh dedicated host
Use a new dedicated amd64 or arm64 host with sudo and independent console access. Start with 2 vCPU, 4 GiB RAM and at least 20 GiB free local disk for this small lab, then size from actual active series and ingest rate. Review routes and listeners. If a container runtime or workload exists, stop and plan its migration; do not remove packages or restart a shared daemon blindly.
Dedicated Linux host; Bash shell
cat /etc/os-release
dpkg --print-architecture
df -h /var/lib /srv
free -h
ip -4 route show table all
sudo ss -lntup
dpkg-query -W docker.io docker-ce containerd containerd.io runc podman-docker docker-compose docker-compose-v2 2>/dev/null || true
Supported OS/architecture, adequate resources, free selected ports and no existing runtime workload.
LET’S BUILD
Configure the official Docker repository
Current vendor documentation explicitly lists Ubuntu 26.10, 26.04/24.04 LTS and Debian 13/12. This step uses the selected OS repository and its own codename; it never substitutes another release. It is only for the empty host confirmed above. Review conflicting distribution Docker/containerd/runc packages through the official prerequisite page before proceeding. Installing Docker changes host networking and starts a privileged daemon; perform this only on your lab host. Download the vendor key over HTTPS; the signed repository then verifies package metadata.
Dedicated Linux host; Bash shell
sudo apt-get update
sudo apt-get install --no-install-recommends ca-certificates curl python3 nano iproute2
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
sudo tee /etc/apt/sources.list.d/docker.sources >/dev/null <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF
sudo apt-get update
apt-cache policy docker-ce docker-compose-plugin
Correct signed vendor repository for the selected codename; no signature or missing-release error.