From 790c713418748cb54a561be9c8a3bae4eab40c1f Mon Sep 17 00:00:00 2001
From: Simon <s.thiessen@local-it.org>
Date: Fri, 18 Sep 2026 00:07:07 +0200
Subject: [PATCH] allow scraping of docker events

---
 .env.sample               |  4 ++++
 README.md                 |  8 ++++++++
 compose.docker-events.yml | 20 ++++++++++++++++++++
 release/next              |  1 +
 4 files changed, 33 insertions(+)
 create mode 100644 compose.docker-events.yml
 create mode 100644 release/next

diff --git a/.env.sample b/.env.sample
index c70c433..b97f05b 100644
--- a/.env.sample
+++ b/.env.sample
@@ -53,6 +53,10 @@ SECRET_BASIC_AUTH_VERSION=v1
 # Not needed if you just want to read local log files — use SYSLOG_FILES instead.
 # SYSLOG=1
 # COMPOSE_FILE="$COMPOSE_FILE:compose.syslog.yml"
+#
+# Scrape Docker-Events via official docker-cli image using docker socket
+# COMPOSE_FILE="$COMPOSE_FILE:compose.docker-events.yml"
+
 
 # Monitoring Server
 #
diff --git a/README.md b/README.md
index 9b09925..d14468f 100644
--- a/README.md
+++ b/README.md
@@ -54,6 +54,14 @@ This is what a gathering host pushes into. It also runs its own Alloy, so it mon
 
 ## Additional features
 
+### Scrape docker events
+
+Just uncomment the following line in your .env to collect docker events using
+the official docker-cli image and the docker socket:
+```
+COMPOSE_FILE="$COMPOSE_FILE:compose.docker-events.yml"
+```
+
 ### Discovering metrics from other apps
 
 Alloy auto-discovers and scrapes other Docker Swarm services running on the same host, on the `proxy` network, that opt in via labels. No manual scrape config needed. On the app's `compose.yml`:
diff --git a/compose.docker-events.yml b/compose.docker-events.yml
new file mode 100644
index 0000000..9afd0ab
--- /dev/null
+++ b/compose.docker-events.yml
@@ -0,0 +1,20 @@
+version: "3.8"
+services:
+  docker-events:
+    image: docker:29.8.1-cli
+    command: >
+      docker events
+      --format '{{json .}}'
+      --filter type=container
+      --filter event=start
+      --filter event=die
+      --filter event=kill
+      --filter event=oom
+      --filter event=restart
+      --filter event=stop
+      --filter event=health_status
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    deploy:
+      restart_policy:
+        condition: on-failure
\ No newline at end of file
diff --git a/release/next b/release/next
new file mode 100644
index 0000000..75db9e3
--- /dev/null
+++ b/release/next
@@ -0,0 +1 @@
+allow scraping of docker events via new compose.docker-events.yml
\ No newline at end of file
-- 
2.54.0