Make your server "production-ready". Part 1
Make your server "production-ready". Part 5
Make your server "production-ready". Part 4
Make your server "production-ready". Part 3
A server without monitoring is flying blind: full disks, RAM bottlenecks, or a crashed container only become noticeable once a service goes down — or worse, when a customer reports it. In this tutorial you'll build a complete monitoring stack on your VPS: Prometheus collects metrics, Grafana visualizes them in dashboards, and Alertmanager sends you a notification before something breaks.
Start five containers via Docker Compose (Prometheus, Node Exporter, cAdvisor, Grafana, Alertmanager), import two ready-made Grafana dashboards, enable four alert rules and you'll be warned by email or Telegram before CPU, RAM, or disk space run out.
| Component | Purpose | Port |
|---|---|---|
| Prometheus | Collects and stores metrics (time-series database) | 9090 |
| Node Exporter | Provides host metrics: CPU, RAM, disk, network | 9100 |
| cAdvisor | Provides per-container metrics for Docker | 8080 |
| Grafana | Dashboards and visualization | 3000 |
| Alertmanager | Sends notifications (email, Telegram, …) | 9093 |
The principle is simple: Node Exporter and cAdvisor expose metrics as HTTP endpoints, Prometheus polls ("scrapes") them every 15 seconds and stores them. Grafana reads from Prometheus and draws graphs. If a value crosses a defined threshold, Prometheus fires an alert rule, and Alertmanager delivers it.
The final structure looks like this:
Create the file docker-compose.yml in ~/monitoring:
Two details matter here:
127.0.0.1. This means Prometheus, Grafana, and Alertmanager are not reachable from the internet, only locally or via a reverse proxy. If you want to use the web interfaces without a domain, reach them via an SSH tunnel: ssh -L 3000:localhost:3000 user@server. You should have a properly configured firewall with ufw in place regardless.--storage.tsdb.retention.time=30d limits the retention period to 30 days. On a VPS with limited disk space, you can reduce this.The Grafana admin password appears in plain text in the compose file. Set your own strong password here before the first start, and change it again after your first login to Grafana. Never expose Grafana with default credentials behind a public domain.
Create prometheus/prometheus.yml:
Since all containers run in the same monitoring Docker network, they can reach each other by container name — no IP addresses needed.
Create prometheus/alert-rules.yml with four rules that make sense on any server:
The for clause prevents false alarms: a brief CPU spike during a backup won't trigger an alert yet. Only once the condition persists for the defined duration does the alert fire.
Create alertmanager/alertmanager.yml. The example below sends alerts by email. If you're running your own mail server, keep in mind you'll need a correct PTR record for outbound mail:
Telegram alternative: If you don't have SMTP access, you can send alerts directly to a Telegram bot:
You get a bot token from Telegram's @BotFather, and the chat ID from @userinfobot.
All five containers should show as running. First check whether Prometheus can reach all targets — via SSH tunnel or reverse proxy at http://localhost:9090/targets. All three jobs (prometheus, node, cadvisor) must have status UP.
Open Grafana at http://localhost:3000 (or your domain) and log in with the credentials from the compose file.
Add a data source:
http://prometheus:9090 as the URL (container name, not localhost!)Import dashboards: Instead of building dashboards yourself, import two proven community dashboards via Dashboards → New → Import by entering the respective ID:
After importing, select your Prometheus data source for each — done! You now have a complete view of your server and every individual container.
If you followed our Caddy tutorial, a single entry in the Caddyfile is enough to serve Grafana over HTTPS with an automatic certificate:
Then run docker compose restart caddy (or systemctl reload caddy). Prometheus and Alertmanager generally don't need a public interface — for occasional access, an SSH tunnel is enough, which reduces the attack surface.
Never trust an alerting system you've never triggered. The easiest test is the TargetUnreachable rule:
After about two minutes (the rule's for duration), the alert should switch to FIRING in Prometheus under Alerts, and shortly after the email or Telegram message should arrive. Afterward:
Alertmanager automatically sends a "Resolved" notification.
On a typical 2-vCPU VPS, the entire stack runs at around 300–500 MB RAM and minimal CPU load. cAdvisor accounts for the largest share; if you only need host metrics and no container details, you can leave it out and save noticeably more. Prometheus's storage requirements grow with the number of metrics, but with 30 days of retention and this setup it typically stays under 2 GB on disk.
With five containers and three configuration files, you now have monitoring that prevents many outages before they happen: you can see trends (the disk will be full in three weeks), catch memory leaks in containers, and get notified as soon as a service goes down. Round out this setup with regular backups — monitoring warns you, backups save you.
In the next part of our "Production-Ready Server" series, we'll extend the stack with centralized logging using Loki, so that in Grafana you'll see not just that a container has problems, but also why — straight from its logs.
Around 300–500 MB RAM and minimal CPU load. If you skip cAdvisor and only collect host metrics, you can get by with noticeably less. On disk, Prometheus typically stays under 2 GB with 30 days of retention.
Yes. Install just the Node Exporter on each additional server and add it as an extra target in prometheus.yml. You should secure the connection via a private network, VPN, or firewall rule so the exporter isn't publicly reachable.
First check at http://localhost:9093 whether the alert is arriving at Alertmanager. If it is, the issue lies with mail delivery: SMTP credentials, port 587/465, and (if using your own mail server) the PTR record are the most common causes.
VPS on AMD EPYC with NVMe SSD, full control, hosted in Germany.
Configure VPS
No. For everyday use, an SSH tunnel is enough (ssh -L 3000:localhost:3000 user@server). A public domain via Caddy is more convenient, but should then be secured with a strong password and ideally 2FA.
monitoring/
├── docker-compose.yml
├── prometheus/
│ ├── prometheus.yml
│ └── alert-rules.yml
└── alertmanager/
└── alertmanager.ymlgrafana.your-domain.com {
reverse_proxy localhost:3000
}mkdir -p ~/monitoring/{prometheus,grafana,alertmanager}
cd ~/monitoringservices:
prometheus:
image: prom/prometheus:latest
container_name: prometheus
restart: unless-stopped
volumes:
- ./prometheus:/etc/prometheus
- prometheus-data:/prometheus
command:
- '--config.file=/etc/prometheus/prometheus.yml'
- '--storage.tsdb.retention.time=30d'
ports:
- "127.0.0.1:9090:9090"
networks:
- monitoring
node-exporter:
image: prom/node-exporter:latest
container_name: node-exporter
restart: unless-stopped
pid: host
volumes:
- /proc:/host/proc:ro
- /sys:/host/sys:ro
- /:/rootfs:ro
command:
- '--path.procfs=/host/proc'
- '--path.sysfs=/host/sys'
- '--path.rootfs=/rootfs'
networks:
- monitoring
cadvisor:
image: gcr.io/cadvisor/cadvisor:latest
container_name: cadvisor
restart: unless-stopped
privileged: true
volumes:
- /:/rootfs:ro
- /var/run:/var/run:ro
- /sys:/sys:ro
- /var/lib/docker/:/var/lib/docker:ro
- /dev/disk/:/dev/disk:ro
networks:
- monitoring
grafana:
image: grafana/grafana-oss:latest
container_name: grafana
restart: unless-stopped
volumes:
- grafana-data:/var/lib/grafana
environment:
- GF_SECURITY_ADMIN_USER=admin
- GF_SECURITY_ADMIN_PASSWORD=PleaseChange123!
- GF_SERVER_ROOT_URL=https://grafana.your-domain.com
ports:
- "127.0.0.1:3000:3000"
networks:
- monitoring
alertmanager:
image: prom/alertmanager:latest
container_name: alertmanager
restart: unless-stopped
volumes:
- ./alertmanager:/etc/alertmanager
command:
- '--config.file=/etc/alertmanager/alertmanager.yml'
ports:
- "127.0.0.1:9093:9093"
networks:
- monitoring
volumes:
prometheus-data:
grafana-data:
networks:
monitoring:global:
scrape_interval: 15s
evaluation_interval: 15s
rule_files:
- "alert-rules.yml"
alerting:
alertmanagers:
- static_configs:
- targets: ["alertmanager:9093"]
scrape_configs:
- job_name: "prometheus"
static_configs:
- targets: ["localhost:9090"]
- job_name: "node"
static_configs:
- targets: ["node-exporter:9100"]
- job_name: "cadvisor"
static_configs:
- targets: ["cadvisor:8080"]groups:
- name: server-alerts
rules:
- alert: HighCPUUsage
expr: 100 - (avg by(instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 90
for: 10m
labels:
severity: warning
annotations:
summary: "CPU above 90% for 10 minutes ({{ $labels.instance }})"
- alert: LowRAM
expr: (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes) * 100 < 10
for: 5m
labels:
severity: warning
annotations:
summary: "Less than 10% RAM available ({{ $labels.instance }})"
- alert: DiskAlmostFull
expr: (node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes{mountpoint="/"}) * 100 < 15
for: 5m
labels:
severity: critical
annotations:
summary: "Less than 15% disk space free on / ({{ $labels.instance }})"
- alert: TargetUnreachable
expr: up == 0
for: 2m
labels:
severity: critical
annotations:
summary: "Exporter or service unreachable: {{ $labels.job }}"global:
smtp_smarthost: "mail.your-domain.com:587"
smtp_from: "[email protected]"
smtp_auth_username: "[email protected]"
smtp_auth_password: "your-smtp-password"
route:
receiver: "mail"
group_by: ["alertname"]
group_wait: 30s
group_interval: 5m
repeat_interval: 4h
receivers:
- name: "mail"
email_configs:
- to: "[email protected]"receivers:
- name: "telegram"
telegram_configs:
- bot_token: "123456:ABC-YOUR-BOT-TOKEN"
chat_id: -100123456789
parse_mode: "HTML"cd ~/monitoring
docker compose up -d
docker compose psdocker stop node-exporterdocker start node-exporter