From fed5d6f8c78c051f0766eaa31ffdfce44296c64f Mon Sep 17 00:00:00 2001
From: tiennm99 <tiennm99@outlook.com>
Date: Sat, 25 Apr 2026 11:20:03 +0700
Subject: [PATCH] fix: point node_exporter at host bind mounts; drop pid:host
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

prometheus.exporter.unix now reads /rootproc and /rootfs (the existing
host bind mounts) instead of the container's own namespace, so the
filesystem + process metrics actually describe the host. This makes
pid:host unnecessary, so remove it — privileged is enough and pid:host
exposes every host process inside the container.
---
 alloy/docker-compose.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/alloy/docker-compose.yml b/alloy/docker-compose.yml
index 1ea4e7e..1c01834 100644
--- a/alloy/docker-compose.yml
+++ b/alloy/docker-compose.yml
@@ -9,7 +9,6 @@ services:
     restart: unless-stopped
     hostname: ${ALLOY_HOSTNAME:?required}
     privileged: true
-    pid: host                                 # node_exporter sees host /proc + processes; required for cpu/mem/load metrics
     environment:
       ALLOY_DEPLOY_MODE: docker
       REMOTECFG_URL: ${REMOTECFG_URL:?required}
@@ -94,6 +93,10 @@ configs:
       prometheus.exporter.unix "integrations_node_exporter" {
         disable_collectors = ["ipvs", "btrfs", "infiniband", "xfs", "zfs"]
 
+        // Read host filesystems via bind mounts instead of the container namespace.
+        rootfs_path = "/rootfs"
+        procfs_path = "/rootproc"
+
         filesystem {
           fs_types_exclude     = "^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|tmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs)$"
           mount_points_exclude = "^/(dev|proc|run/credentials/.+|sys|var/lib/docker/.+)($|/)"