tiennm99/composes
1
0 Fork 0
mirror of https://github.com/tiennm99/composes.git synced 2026-10-14 20:17:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: grant DAC_OVERRIDE so alloy can write its data dir

Browse Source 
container runs as root (0:0) but cap_drop=[ALL] stripped DAC_OVERRIDE,
so mkdir on /var/lib/alloy/data (alloy-owned in the image) failed with
permission denied. add it back (only DAC_OVERRIDE, nothing else) and
mount /etc/machine-id ro for a stable journal host id. annotate every
volume with the component that uses it.
This commit is contained in:
tiennm99 committed 2026-04-24 13:56:37 +07:00
1 parent fe7e48bf19
commit 59bf58a412
1 file changed
+9 -7
Download Patch File Download Diff File Expand all files Collapse all files
alloy/docker-compose.yml
+9 -7
View File
@@ -17,14 +17,16 @@ services:
GRAFANA_TOKEN: ${GRAFANA_TOKEN:?required} GRAFANA_TOKEN: ${GRAFANA_TOKEN:?required}
security_opt: [ "no-new-privileges:true" ] security_opt: [ "no-new-privileges:true" ]
cap_drop: [ ALL ] cap_drop: [ ALL ]
cap_add: [ DAC_OVERRIDE ] # root loses all caps; DAC_OVERRIDE is needed to write alloy-owned /var/lib/alloy/data and read root-owned journal/docker dirs
volumes: volumes:
- alloy-data:/var/lib/alloy/data - alloy-data:/var/lib/alloy/data # remotecfg + storage state
- /var/run/docker.sock:/var/run/docker.sock:ro - /var/run/docker.sock:/var/run/docker.sock:ro # discovery.docker + loki.source.docker (streams log API)
- /var/lib/docker:/var/lib/docker:ro - /var/lib/docker:/var/lib/docker:ro # cadvisor container metadata
- /proc:/host/proc:ro - /proc:/host/proc:ro # node-exporter cpu/mem/load/net
- /sys:/host/sys:ro - /sys:/host/sys:ro # node-exporter + cadvisor cgroups
- /:/rootfs:ro,rslave - /:/rootfs:ro,rslave # filesystem collector (rslave picks up new mounts)
- /var/log/journal:/var/log/journal:ro - /var/log/journal:/var/log/journal:ro # loki.source.journal
- /etc/machine-id:/etc/machine-id:ro # stable host id for journal reader
configs: configs:
- { source: alloy_config, target: /etc/alloy/config.alloy } - { source: alloy_config, target: /etc/alloy/config.alloy }
command: [ run, --server.http.listen-addr=0.0.0.0:12345, --storage.path=/var/lib/alloy/data, /etc/alloy/config.alloy ] command: [ run, --server.http.listen-addr=0.0.0.0:12345, --storage.path=/var/lib/alloy/data, /etc/alloy/config.alloy ]