Centralized Docker Logging with Grafana Alloy and Loki on a Linux VPS

Centralized logs make debugging containers much easier than tailing Docker logs per container. Using Grafana Alloy and Loki for Docker Logs on a Linux VPS gives you a modern way to collect, store, and query logs from containers and files in one place.

In this guide, you will set up Grafana Alloy and Loki for Docker Logs with Docker Compose, a Loki filesystem config that works with the latest version 3.7, and an Alloy config that supports both file logs and Docker logs.

To follow this guide on Grafana Alloy and Loki for Docker logs, you need:

• Linux VPS running Ubuntu 22.04 or newer with Docker and Docker Compose plugin installed.
• Basic familiarity with Docker, YAML, and Linux shell.
• A non-root sudo user or root SSH access.

If you need a VPS for this setup, you can use an affordable Linux server from PerLod.

Connect to your VPS as root or a sudo user:

Update the system:

Install Docker and Docker Compose if it is not installed:

Now you can follow the steps below to set up Grafana Alloy and Loki for Docker logs.

First, you must create a simple project layout in your home directory:

We will keep the Loki config under loki/ and the Alloy config under alloy/ while running Grafana Alloy and Loki for Docker logs with a single Compose file.

Loki 3.7 needs a small but specific YAML configuration when you run it as a single binary on local disk. Here is a simple filesystem-based Loki config that works well on a small Linux VPS, avoids structured metadata requirements, and keeps about a week of logs without needing any external object storage.

Create the Loki YAML file:

This config runs Loki as a single process on local filesystem storage with seven days of retention, and explicitly disables structured metadata to satisfy Loki 3.7’s validation when using boltdb-shipper.

At this point, you must configure Grafana Alloy to send logs into Loki from two places, including a local log file and Docker containers. The file source gives you a guaranteed working path for testing, while the Docker source shows the modern way to collect container logs with Grafana Alloy and Loki for Docker logs.

Create an Alloy config file with both a file source and a Docker source:

• loki.source.file tails /tmp/alloy-logs/test.log and sends logs with label job="file-test" to Loki.
• loki.source.docker connects to the Docker socket and is ready to send container logs with job="docker". You can build on this for Docker labels and filtering.

Now you must define a Docker Compose file that starts Loki, Grafana, and Grafana Alloy together on your VPS. This shared stack keeps everything on a single Docker network, exposes only the ports you need, and makes it easy to bring the whole Grafana Alloy and Loki for Docker Logs setup up or down with a single command.

Create the Docker Compose YAML file in your project directory:

This Compose file starts Loki on 3100, Grafana on 3000, and Alloy with access to both the Docker socket and a host directory for test file logs, which is a common way to run Grafana Alloy and Loki for Docker logs on a single node.

Once you are done, you can start the stack and verify it with the commands below:

You should see Loki, Alloy, and Grafana all Up. If Loki fails, use docker logs loki --tail=50 and fix config typos based on the Loki YAML file.

In this step, you can create a simple file on the VPS and let Alloy stream its contents into Loki. This gives you a verified path to confirm that Grafana Alloy and Loki for Docker logs are connected correctly before you depend on Docker logs in production.

From your server, create the test file with:

Then, start a background writer with:

Alloy now tails /tmp/alloy-logs/test.log via loki.source.file and pushes those lines to Loki using the file-test job label.

To access the Grafana dashboard, open your browser and navigate to:

Log in as:

• User: admin
• Password: admin. Change it immediately.

Then, add Loki as a data source:

Go to Connections → Data sources, click Add data source, and choose Loki.

From there, set the URL to:

Click Save & test and make sure it reports a successful connection.

At this point, you must confirm that your test file logs are stored and searchable. Go to Explore in Grafana:

Pick the Loki data source and the query field (Code mode), enter:

Set the time range to Last 15 minutes and click Run query.

You should see lines like "hello" from the file log with labels job="file-test" and service_name="file-test", confirming that Grafana Alloy and Loki for Docker logs are working at least for the file pipeline.

Here you can start a small container that prints a message every few seconds, so it generates a steady stream of logs. These logs let you test the Docker path in your Grafana Alloy and Loki for Docker logs setup and verify that container output is reaching Loki and Grafana correctly.

Start the container with:

This container writes to stdout, which Docker stores in its JSON log files; Alloy’s loki.source.docker component reads those logs via /var/run/docker.sock and sends them to Loki with job="docker" when configured correctly.

In Grafana Explore, try:

If needed, use Label browser to inspect live labels Alloy sends along with Docker logs.

Note: As of 2026, loki.source.docker behavior continues to evolve, and some environments may need extra tweaks or an Alloy version pin for Docker logs, but the configuration shown here matches current Alloy patterns for Grafana Alloy and Loki for Docker logs.

It is best to tune how long Loki keeps logs, think about basic security for your endpoints, and see what changes when you move this Grafana Alloy and Loki for Docker logs setup from a small lab VPS into a real production environment.

• Adjust retention_period in loki-config.yml to match your disk size; shorter retention is safer on small VPS plans.
• Protect the Grafana UI and Loki endpoint behind a firewall or reverse proxy in production.
• Mounting /var/run/docker.sock gives Alloy broad power over Docker; only do this on hosts you control and trust.

For larger deployments or centralized logging from many servers, you can move Loki and Grafana to a stronger machine like a high-performance dedicated server and run Alloy agents on each VPS, still following the same Grafana Alloy and Loki for Docker logs pattern.

You now have a full working setup of Grafana Alloy and Loki for Docker Logs on a Linux VPS using Docker Compose, with Loki for storage, Alloy for log collection, and Grafana for search and dashboards. By tuning labels, filters, and retention, Grafana Alloy and Loki for Docker Logs give you a modern, light, and flexible logging stack that runs even on small VPS plans.

We hope you enjoy this guide. For more details on Alloy log components and examples, you can see the official ingesting logs to Loki using Alloyi docs.