feat(promtail): switch to docker_sd opt-in scraping

compose.yml

@@ -625,10 +625,14 @@ services:
       - observability
     volumes:
       - ./infra/loki/promtail-config.yml:/etc/promtail/config.yml:ro
-      - /home/kert/.local/share/docker/containers:/var/lib/docker/containers:ro
+      - ${DOCKER_SOCK:-/run/user/1000/docker.sock}:/var/run/docker.sock:ro
     command: -config.file=/etc/promtail/config.yml
     depends_on:
       - loki
+    group_add:
+      - "${DOCKER_GID:-985}"
+    security_opt:
+      - no-new-privileges:true
     restart: unless-stopped
 
   otel-collector:

infra/loki/promtail-config.yml

@@ -9,30 +9,32 @@ clients:
   - url: http://loki:3100/loki/api/v1/push
 
 scrape_configs:
-  # Scrape Docker container logs
-  - job_name: containers
-    static_configs:
-      - targets:
-          - localhost
-        labels:
-          job: containerlogs
-          __path__: /var/lib/docker/containers/*/*log
-
+  - job_name: docker
+    docker_sd_configs:
+      - host: unix:///var/run/docker.sock
+        refresh_interval: 15s
+    relabel_configs:
+      - source_labels: ['__meta_docker_container_label_promtail']
+        regex: 'true'
+        action: keep
+      - source_labels: ['__meta_docker_container_name']
+        regex: '/?(.*)'
+        target_label: container
+      - source_labels: ['__meta_docker_container_name']
+        regex: '/?(.*)'
+        target_label: job
+      - source_labels: ['__meta_docker_container_label_com_docker_compose_service']
+        target_label: service
+      - source_labels: ['__meta_docker_container_label_com_docker_compose_project']
+        target_label: project
     pipeline_stages:
-      - json:
-          expressions:
-            output: log
-            stream: stream
-            attrs:
-      - json:
-          expressions:
-            tag:
-          source: attrs
+      - docker: {}
       - regex:
-          expression: (?P<container_name>(?:[a-zA-Z0-9][a-zA-Z0-9_.-]+))
-          source: tag
+          expression: '(?i)(?P<level>error|warn|info|debug|fatal|critical|trace)'
       - labels:
-          stream:
-          container_name:
-      - output:
-          source: output
+          level:
+      - regex:
+          expression: '(?P<remote_ip>\d+\.\d+\.\d+\.\d+) .* "(?P<http_method>GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS) (?P<http_path>[^ ]*) [^"]*" (?P<http_status>\d{3}) (?P<http_bytes>\d+)'
+      - labels:
+          http_method:
+          http_status:

tests/test_observability.py

@@ -81,3 +81,23 @@ class TestLokiRetention:
         cfg = yaml.safe_load((ROOT / "infra/loki/loki-config.yml").read_text())
         assert cfg["compactor"]["retention_enabled"] is True
         assert cfg["limits_config"]["retention_period"] == "168h"
+
+
+class TestPromtailRewire:
+    def test_promtail_uses_docker_sock(self):
+        svc = _services()["promtail"]
+        vols = [v for v in svc["volumes"] if isinstance(v, str)]
+        # New: docker.sock; old filesystem mount must be gone.
+        assert any("docker.sock" in v for v in vols)
+        assert not any("/var/lib/docker/containers" in v for v in vols)
+
+    def test_promtail_has_docker_gid(self):
+        svc = _services()["promtail"]
+        assert "group_add" in svc
+
+    def test_promtail_config_is_docker_sd(self):
+        cfg = yaml.safe_load((ROOT / "infra/loki/promtail-config.yml").read_text())
+        jobs = cfg["scrape_configs"]
+        docker_jobs = [j for j in jobs if j.get("job_name") == "docker"]
+        assert docker_jobs, "expected job_name=docker"
+        assert "docker_sd_configs" in docker_jobs[0]