deytenit/apex.ermnvldmr.com
1
0 Fork 0
Code Issues Pull Requests Actions Releases Wiki Activity

fix(alloy): enable docker_only in cadvisor exporter

Browse Source
This commit is contained in:
deytenit committed 2026-09-27 17:35:47 +03:00
1 parent 78ab580e6f
commit 5672e5d65c
2 files changed
+85 -85
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

assets/alloy/config.alloy
+1
View File
@@ -25,6 +25,7 @@ prometheus.exporter.unix "node" {
prometheus.exporter.cadvisor "containers" { prometheus.exporter.cadvisor "containers" {
docker_host = "unix:///var/run/docker.sock" docker_host = "unix:///var/run/docker.sock"
store_container_labels = true store_container_labels = true
docker_only = true
} }
// Stamp a static `node` label onto each exporter's targets. // Stamp a static `node` label onto each exporter's targets.
compositions/apex/docker-compose.yml
+84 -85
View File
@@ -4,29 +4,76 @@
# resolve against THIS dir — always use absolute ${APEX_*} vars). The engine exports # resolve against THIS dir — always use absolute ${APEX_*} vars). The engine exports
# APEX_TIER*/APEX_TIER*_SHARED/APEX_TIER_ROOT*/APEX_SUBNET/APEX_NODE_FQDN at invoke. # APEX_TIER*/APEX_TIER*_SHARED/APEX_TIER_ROOT*/APEX_SUBNET/APEX_NODE_FQDN at invoke.
x-environment: &shared-environment x-environment: &shared-environment
TZ: "${TZ:-Etc/UTC}" # override per node via TZ in the env; default UTC TZ: "${TZ:-Etc/UTC}" # override per node via TZ in the env; default UTC
services: services:
# --- edge (host network; profile-gated — a node opts in via COMPOSE_PROFILES) ---
xray: # --- optional: adguard (shares traefik netns) ---
image: ghcr.io/xtls/xray-core:26.3.27 adguard:
container_name: apex-xray image: adguard/adguardhome:v0.107.72
profiles: [xray] container_name: apex-adguard
volumes: volumes:
- ${APEX_TIER1}/xray/data/config.jsonc:/etc/xray/config.jsonc:ro - ${APEX_TIER1}/adguard/data:/opt/adguardhome/work
- ${APEX_TIER1_SHARED}/apex/letsencrypt:/etc/letsencrypt/live:ro - ${APEX_TIER1}/adguard/conf:/opt/adguardhome/conf
- ${APEX_TIER3_SHARED}/apex/xray/log:/var/log/xray/
- ${APEX_TIER3_SHARED}/apex/xray/shm:/dev/shm/xray/
environment: environment:
<<: *shared-environment <<: *shared-environment
network_mode: "host" network_mode: "service:traefik"
command: ["-c", "/etc/xray/config.jsonc"]
restart: unless-stopped restart: unless-stopped
user: "0:0"
labels: labels:
# backup (resticontainer, core/all-nodes): xray config only (logs + shm are ephemeral) # backup (resticontainer, core/all-nodes): adguard config only (work data regenerable)
- "restic.enable=true" - "restic.enable=true"
- "restic.backup.paths=/etc/xray/config.jsonc" - "restic.backup.paths=/opt/adguardhome/conf"
cap_add:
- NET_BIND_SERVICE
- SYS_NICE
- CAP_CHOWN
profiles: [ adguard ]
security_opt:
- no-new-privileges:true
# --- optional: observability agent (profile-gated) ---
# Grafana Alloy: one agent per node. Collects host metrics (node_exporter-
# equivalent) + container metrics (cadvisor) and PUSHES them via remote_write;
# collects systemd-journal + docker logs and PUSHES them to Loki. All targets
# are OUTBOUND to a central Prometheus + Loki (hosted on whichever node runs them), so
# Alloy needs egress (direct, not enclave). Replaces the old store-only `loki`
# service (which had no feeder). Config is a committed, env-parameterized asset.
alloy:
image: grafana/alloy:v1.17.1
container_name: apex-alloy
volumes:
- ${APEX_COMMONS}/assets/alloy/config.alloy:/etc/alloy/config.alloy:ro
- ${APEX_TIER2}/alloy/data:/var/lib/alloy
- /var/run/docker.sock:/var/run/docker.sock:ro
- /run/containerd/containerd.sock:/run/containerd/containerd.sock:ro # cadvisor per-container stats on nodes using the containerd snapshotter (overlayfs)
- /proc:/host/proc:ro
- /sys:/host/sys:ro
- /:/rootfs:ro
- /var/log/journal:/var/log/journal:ro
- /run/log/journal:/run/log/journal:ro
- /etc/machine-id:/etc/machine-id:ro
environment:
<<: *shared-environment
APEX_NODE_HOST: "${APEX_NODE_HOST?error}" # node + instance metric/log labels
# push targets + machine auth (per-node scalars in apex.env / secret .env)
APEX_LOKI_PUSH_URL: "${APEX_LOKI_PUSH_URL?error}"
APEX_PROM_PUSH_URL: "${APEX_PROM_PUSH_URL?error}"
APEX_OBS_BASIC_AUTH_USER: "${APEX_OBS_BASIC_AUTH_USER?error}"
APEX_OBS_BASIC_AUTH_PASS: "${APEX_OBS_BASIC_AUTH_PASS?error}"
networks:
direct: {}
extra_hosts:
- "host.docker.internal:host-gateway"
command:
- run
- --server.http.listen-addr=0.0.0.0:12345
- --storage.path=/var/lib/alloy
- /etc/alloy/config.alloy
restart: unless-stopped
user: "0:0" # root: required for host metrics, journal, and docker.sock
cgroup: host # host cgroup namespace: the cadvisor exporter needs it to read per-container cgroups (else machine-root only)
hostname: "${APEX_NODE_HOST}" # UTS hostname => node_exporter's node_uname_info `nodename` (else the container id)
profiles: [ alloy ]
security_opt: security_opt:
- no-new-privileges:true - no-new-privileges:true
@@ -44,19 +91,18 @@ services:
resticontainer: resticontainer:
image: ghcr.io/deytenit/resticontainer:0.19.1 image: ghcr.io/deytenit/resticontainer:0.19.1
container_name: apex-resticontainer container_name: apex-resticontainer
profiles: [manual]
volumes: volumes:
- ${APEX_TIER3}/restic/cache:/var/restic-cache - ${APEX_TIER3}/restic/cache:/var/restic-cache
- /var/run/docker.sock:/var/run/docker.sock # query + exec/stop/start - /var/run/docker.sock:/var/run/docker.sock # query + exec/stop/start
# apex tier data + checkouts live under /srv, and the @tierN bind mounts are # apex tier data + checkouts live under /srv, and the @tierN bind mounts are
# ABSOLUTE symlinks into /srv (compositions/<p>/@tierN -> /srv/com-…-tierN/<p>). # ABSOLUTE symlinks into /srv (compositions/<p>/@tierN -> /srv/com-…-tierN/<p>).
# Mount /srv at the same path with RESTIC_HOSTFS=/ so restic follows those # Mount /srv at the same path with RESTIC_HOSTFS=/ so restic follows those
# symlinks and records the real host paths — a bare /:/hostfs cannot, because # symlinks and records the real host paths — a bare /:/hostfs cannot, because
# the absolute symlink target /srv/… is dangling inside the container. # the absolute symlink target /srv/… is dangling inside the container.
- /srv:/srv:ro # read the data (resolves @tierN symlinks) - /srv:/srv:ro # read the data (resolves @tierN symlinks)
environment: environment:
<<: *shared-environment <<: *shared-environment
RESTIC_HOSTFS: "/" # mount sources are already absolute (/srv/…) RESTIC_HOSTFS: "/" # mount sources are already absolute (/srv/…)
RESTIC_REPOSITORY: "${APEX_RESTIC_REPOSITORY?error}" RESTIC_REPOSITORY: "${APEX_RESTIC_REPOSITORY?error}"
RESTIC_PASSWORD: "${APEX_RESTIC_PASSWORD?error}" RESTIC_PASSWORD: "${APEX_RESTIC_PASSWORD?error}"
AWS_ACCESS_KEY_ID: "${APEX_RESTIC_AWS_ACCESS_KEY_ID?error}" AWS_ACCESS_KEY_ID: "${APEX_RESTIC_AWS_ACCESS_KEY_ID?error}"
@@ -72,12 +118,12 @@ services:
RESTIC_COMPRESSION: "${APEX_RESTIC_COMPRESSION:-max}" RESTIC_COMPRESSION: "${APEX_RESTIC_COMPRESSION:-max}"
RESTIC_CACHE_DIR: /var/restic-cache RESTIC_CACHE_DIR: /var/restic-cache
network_mode: "host" network_mode: "host"
profiles: [ manual ]
# --- docker socket proxy --- # --- docker socket proxy ---
socket-proxy: socket-proxy:
image: tecnativa/docker-socket-proxy:0 image: tecnativa/docker-socket-proxy:0
container_name: apex-socket-proxy container_name: apex-socket-proxy
user: "0:0"
volumes: volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro - /var/run/docker.sock:/var/run/docker.sock:ro
environment: environment:
@@ -87,14 +133,12 @@ services:
networks: networks:
socket: {} socket: {}
restart: unless-stopped restart: unless-stopped
user: "0:0"
# --- edge reverse proxy (the core anchor on direct) --- # --- edge reverse proxy (the core anchor on direct) ---
traefik: traefik:
image: traefik:3.6 image: traefik:3.6
container_name: apex-traefik container_name: apex-traefik
user: "${APEX_UID?error}:${APEX_GID?error}"
group_add:
- "${APEX_SHARED_GID?error}"
depends_on: depends_on:
- socket-proxy - socket-proxy
volumes: volumes:
@@ -155,75 +199,30 @@ services:
# (letsencrypt certs are regenerable via ACME/Cloudflare DNS-01) # (letsencrypt certs are regenerable via ACME/Cloudflare DNS-01)
- "restic.enable=true" - "restic.enable=true"
- "restic.backup.paths=/etc/traefik/dynamic" - "restic.backup.paths=/etc/traefik/dynamic"
user: "${APEX_UID?error}:${APEX_GID?error}"
group_add:
- "${APEX_SHARED_GID?error}"
security_opt: security_opt:
- no-new-privileges:true - no-new-privileges:true
xray:
# --- optional: adguard (shares traefik netns) --- image: ghcr.io/xtls/xray-core:26.3.27
adguard: container_name: apex-xray
image: adguard/adguardhome:v0.107.72
container_name: apex-adguard
profiles: [adguard]
volumes: volumes:
- ${APEX_TIER1}/adguard/data:/opt/adguardhome/work - ${APEX_TIER1}/xray/data/config.jsonc:/etc/xray/config.jsonc:ro
- ${APEX_TIER1}/adguard/conf:/opt/adguardhome/conf - ${APEX_TIER1_SHARED}/apex/letsencrypt:/etc/letsencrypt/live:ro
- ${APEX_TIER3_SHARED}/apex/xray/log:/var/log/xray/
- ${APEX_TIER3_SHARED}/apex/xray/shm:/dev/shm/xray/
environment: environment:
<<: *shared-environment <<: *shared-environment
network_mode: "host"
command: [ "-c", "/etc/xray/config.jsonc" ]
restart: unless-stopped
labels: labels:
# backup (resticontainer, core/all-nodes): adguard config only (work data regenerable) # backup (resticontainer, core/all-nodes): xray config only (logs + shm are ephemeral)
- "restic.enable=true" - "restic.enable=true"
- "restic.backup.paths=/opt/adguardhome/conf" - "restic.backup.paths=/etc/xray/config.jsonc"
network_mode: "service:traefik" user: "0:0"
restart: unless-stopped profiles: [ xray ]
cap_add:
- NET_BIND_SERVICE
- SYS_NICE
- CAP_CHOWN
security_opt:
- no-new-privileges:true
# --- optional: observability agent (profile-gated) ---
# Grafana Alloy: one agent per node. Collects host metrics (node_exporter-
# equivalent) + container metrics (cadvisor) and PUSHES them via remote_write;
# collects systemd-journal + docker logs and PUSHES them to Loki. All targets
# are OUTBOUND to a central Prometheus + Loki (hosted on whichever node runs them), so
# Alloy needs egress (direct, not enclave). Replaces the old store-only `loki`
# service (which had no feeder). Config is a committed, env-parameterized asset.
alloy:
image: grafana/alloy:v1.17.1
container_name: apex-alloy
hostname: "${APEX_NODE_HOST}" # UTS hostname => node_exporter's node_uname_info `nodename` (else the container id)
cgroup: host # host cgroup namespace: the cadvisor exporter needs it to read per-container cgroups (else machine-root only)
profiles: [alloy]
user: "0:0" # root: required for host metrics, journal, and docker.sock
volumes:
- ${APEX_COMMONS}/assets/alloy/config.alloy:/etc/alloy/config.alloy:ro
- ${APEX_TIER2}/alloy/data:/var/lib/alloy
- /var/run/docker.sock:/var/run/docker.sock:ro
- /run/containerd/containerd.sock:/run/containerd/containerd.sock:ro # cadvisor per-container stats on nodes using the containerd snapshotter (overlayfs)
- /proc:/host/proc:ro
- /sys:/host/sys:ro
- /:/rootfs:ro
- /var/log/journal:/var/log/journal:ro
- /run/log/journal:/run/log/journal:ro
- /etc/machine-id:/etc/machine-id:ro
environment:
<<: *shared-environment
APEX_NODE_HOST: "${APEX_NODE_HOST?error}" # node + instance metric/log labels
# push targets + machine auth (per-node scalars in apex.env / secret .env)
APEX_LOKI_PUSH_URL: "${APEX_LOKI_PUSH_URL?error}"
APEX_PROM_PUSH_URL: "${APEX_PROM_PUSH_URL?error}"
APEX_OBS_BASIC_AUTH_USER: "${APEX_OBS_BASIC_AUTH_USER?error}"
APEX_OBS_BASIC_AUTH_PASS: "${APEX_OBS_BASIC_AUTH_PASS?error}"
command:
- run
- --server.http.listen-addr=0.0.0.0:12345
- --storage.path=/var/lib/alloy
- /etc/alloy/config.alloy
networks:
direct: {}
extra_hosts:
- "host.docker.internal:host-gateway"
restart: unless-stopped
security_opt: security_opt:
- no-new-privileges:true - no-new-privileges:true