Deploy Monitoring for Docker

🚀 Deploy Monitoring for Docker

Deploy the GermainUX Engine where it can securely access the Docker Engine API, then use the Docker wizard to create the monitoring components.

Do not expose an unauthenticated Docker API on TCP port 2375. Access to an unsecured Docker endpoint can provide control equivalent to root access on the Docker host.

🏗️ Architecture

📋 Prerequisites

Before deployment, confirm:

• A GermainUX Engine is installed and running.

• The Engine can reach the Docker host.

• The Docker version and API version are supported.

• An approved Docker API access method is available.

• Required TLS certificates or local permissions are available.

• Firewall rules permit only the required connection.

• Docker host and application owners have approved the monitoring.

• GermainUX can reach its Enterprise services.

• The expected monitoring frequency and data volume have been reviewed.

Choose a secure connection method

TLS-protected remote Docker API

Use an authenticated and encrypted Docker API endpoint for remote monitoring.

A typical secure endpoint uses:

tcp://DOCKER_HOST:2376

The Docker daemon should require:

• TLS.

• Client-certificate verification.

• A trusted certificate authority.

• A server certificate matching the Docker hostname.

• A client certificate dedicated to the GermainUX Engine.

• Firewall restrictions limiting access to approved Engine hosts.

Do not configure:

tcp://0.0.0.0:2375

Port 2375 normally provides unencrypted and unauthenticated Docker API access.

Docker TLS configuration varies by operating system, Docker installation, and organizational certificate-management policy. Configure the daemon using the organization’s approved Docker procedure.

Local Docker socket

When the GermainUX Engine runs directly on the Docker host, the installed GermainUX version may support access through the local Docker socket:

unix:///var/run/docker.sock

Access to this socket provides extensive control over Docker and should be treated as privileged access.

Grant socket access only to the dedicated account running the GermainUX Engine. Do not make the socket globally readable or writable.

If group-based access is approved:

sudo usermod -aG docker <germain-engine-user>

Restart the GermainUX Engine service or the account session after changing group membership.

Membership in the docker group is effectively root-equivalent on the Docker host. Use it only when explicitly approved.

Validate Docker API access

Validate a TLS endpoint

From the GermainUX Engine host, use the approved Docker certificates to validate connectivity:

docker \
  --tlsverify \
  --tlscacert=<ca-certificate> \
  --tlscert=<client-certificate> \
  --tlskey=<client-key> \
  -H=tcp://<docker-host>:2376 \
  version

Then validate container access:

docker \
  --tlsverify \
  --tlscacert=<ca-certificate> \
  --tlscert=<client-certificate> \
  --tlskey=<client-key> \
  -H=tcp://<docker-host>:2376 \
  ps

Validate local socket access

Run the following as the account used by the GermainUX Engine:

docker -H=unix:///var/run/docker.sock version

docker -H=unix:///var/run/docker.sock ps

Do not continue until the Engine account can access Docker through the approved connection method.

Configure certificates and credentials

For TLS-based monitoring:

1. Obtain the approved certificate authority file.

2. Obtain a client certificate and private key for the GermainUX Engine.

3. Store the files in a directory accessible only to the Engine service account.

4. Restrict private-key permissions.

5. Configure the Docker data source or Engine with the approved certificate locations.

6. Verify certificate expiration and rotation procedures.

7. Test the connection before running the wizard.

Do not embed private keys, passwords, or tokens in monitoring names, scripts, or documentation.

Run the Docker wizard

1. Sign in to Germain Workspace.

2. Open the left navigation menu.

3. Select Wizards.

4. Select Docker.
   

   

5. Select the monitoring node.

6. Select the GermainUX Engine that can reach Docker.

7. Enter a descriptive Docker environment name.

8. Enter the approved Docker API endpoint.

9. Configure the required TLS or connection properties.

10. Select the application and environment context.

11. Configure the execution schedule.

12. Review the generated monitoring components.

13. Select Finish.

Available fields and connection options can vary by GermainUX version.

For a TLS endpoint, use a value similar to:

https://docker-host.example.com:2376

Do not substitute an unsecured http:// endpoint on port 2375.

Configure the monitoring scope

Define which Docker resources GermainUX should monitor:

• Docker hosts.

• Containers.

• Container states.

• Container resource statistics.

• Images.

• Networks.

• Volumes.

• Docker events.

• Application endpoints.

• Container and application logs.

Use container names, labels, image names, applications, and environment metadata to organize the monitored resources.

Exclude short-lived or non-business-critical containers when their data would create unnecessary volume.

Configure the schedule

Choose a collection interval appropriate for the environment.

Consider:

• Number of Docker hosts.

• Number of running and short-lived containers.

• Required detection speed.

• Docker API load.

• GermainUX Engine capacity.

• Data-retention requirements.

• Expected metrics and event volume.

Start with a moderate interval, validate the overhead, and increase collection frequency only when the operational requirement justifies it.

Configure Docker host monitoring

Docker statistics do not replace operating-system monitoring.

Deploy the applicable host monitor to collect:

• CPU usage and queue length.

• Memory and swap.

• Disk capacity and I/O.

• Network utilization.

• Docker daemon process status.

• Operating-system services.

• Host logs and errors.

For supported Linux hosts, review Linux Monitoring.

Configure container and application logs

Use File and Log Monitoring when Docker, container, or application logs must be analyzed.

Confirm:

• The Docker logging driver.

• Log location or retrieval mechanism.

• Container and application metadata.

• Log rotation behavior.

• Required parsers and error rules.

• Sensitive-data exclusions.

• Retention requirements.

The GermainUX Engine must have approved read access to the selected log source.

Configure application availability

A running container does not guarantee that its application is available.

Add the appropriate monitor for critical services, such as:

• HTTP or HTTPS endpoint monitoring.

• API monitoring.

• TCP availability.

• Database monitoring.

• Synthetic user transactions.

• Browser Real User Monitoring.

• Java or .NET code profiling.

• Business-process monitoring.

This allows GermainUX to distinguish a healthy container from an unhealthy application running inside it.

Validate the deployment

After completing the wizard:

1. Go to Germain Workspace → Settings → Germain → State.

2. Locate the Docker monitoring components.
   

   

3. Confirm that they are enabled and running.

4. Verify that the expected Docker host appears.

5. Confirm that running containers are discovered.

6. Review container state and available resource measurements.

7. Compare selected values with approved Docker commands.

8. Start and stop a controlled test container.

9. Confirm that GermainUX detects the state changes.

10. Generate a controlled health-check failure when safe.

11. Verify the expected KPI, SLA, or Watch.

12. Confirm that monitoring does not create unacceptable Docker API or host load.

Troubleshooting

Docker host is unreachable

Verify:

• Docker is running.

• The configured hostname and port are correct.

• The Engine can resolve the Docker hostname.

• Firewall rules permit the connection.

• The Docker API is listening on the expected endpoint.

• TLS certificates are valid and trusted.

• The client certificate is authorized.

• The server certificate matches the hostname.

Permission denied on the Docker socket

Verify:

• The GermainUX Engine service account owns or can access the socket through an approved group.

• The Engine service was restarted after the permission change.

• The socket permissions were not reset by a Docker restart.

• The configured Engine process is running under the expected account.

Do not resolve the problem by granting global read or write access to the Docker socket.

TLS connection fails

Verify:

• The client certificate and key form a valid pair.

• The certificate authority is correct.

• Certificates have not expired.

• The server certificate contains the Docker hostname.

• File permissions allow the Engine to read the required certificate files.

• The Docker daemon requires and accepts client-certificate authentication.

Containers are missing

Verify:

• The Engine is connected to the intended Docker host.

• The monitoring account can list containers.

• Monitoring filters do not exclude the containers.

• Short-lived containers existed during a collection interval.

• Docker labels and application mappings are correct.

Resource data is missing

Verify:

• The Docker API exposes statistics for the container.

• The container is running.

• The applicable monitoring capability is enabled.

• The Engine version supports the Docker API version.

• The monitoring schedule has executed successfully.

Security requirements

• Never expose an unauthenticated Docker API.

• Use TLS and client authentication for remote access.

• Restrict Docker API access by firewall.

• Use a dedicated Engine identity.

• Protect Docker certificates and private keys.

• Treat Docker socket and docker group access as root-equivalent.

• Do not collect secrets from environment variables, commands, labels, or logs.

• Restrict automated Docker actions.

• Audit monitoring access and configuration changes.

• Rotate credentials and certificates according to policy.

Deployment and configuration

ℹ️ Get Help

The Germain Team can help you set this up. Contact GermainUX Support.