Observability with Prometheus and Grafana

Security Aspects

When you enable metrics in the Docker daemon, they are exposed over a network endpoint (for example, 0.0.0.0:9323). This can introduce security risks if left open to the public network. To mitigate these risks:

• Restrict access to the metrics endpoint so only trusted hosts (for example, the monitoring server) can reach it.
• Restrict access to the Docker API socket (/var/run/docker.sock or TCP 2376) to the minimum necessary users or hosts.