fix(edge-log-shipper): run Alloy from the upstream image #1578

2026-11-06T10:43:08Z

claude-bot commented

2026-11-06 10:43:08 +00:00

Arch's grafana-alloy 1.21.1 has no loki.source.journal. It logs loki.source.journal is not enabled, and must be ran on linux with journal support and ships nothing. The last edge-1 entry in Loki is from 2026-10-22 12:22, two minutes after the 1.13.2 → 1.21.1 upgrade. edge-2 has never shipped.

edge-alloy.service runs grafana/alloy:v1.21.3@sha256:8ab8… (edge_alloy_image, Renovate-tracked like the other edge_*_image).
The container runs as alloy with the systemd-journal group. Root filesystem is read-only, all capabilities are dropped, no-new-privileges is set and the network is the host's.
/run/log/journal and /etc/machine-id are mounted read-only. The WAL and positions stay on /run/alloy (tmpfs).
--log-driver none with an attached run: Alloy's own output reaches the journal once, through the unit.
Alloy config, labels and Loki credentials are unchanged.
The grafana-alloy package is removed.

Tested on the workstation: the image with exactly these flags (non-root, journal group, read-only, --cap-drop ALL) reads journal entries. systemd-analyze verify passes on the rendered unit.

Refs YouTrack S28-16.

🤖 Generated with Claude Code

Arch's `grafana-alloy` 1.21.1 has no `loki.source.journal`. It logs `loki.source.journal is not enabled, and must be ran on linux with journal support` and ships nothing. The last edge-1 entry in Loki is from 2026-10-22 12:22, two minutes after the 1.13.2 → 1.21.1 upgrade. edge-2 has never shipped. - `edge-alloy.service` runs `grafana/alloy:v1.21.3@sha256:8ab8…` (`edge_alloy_image`, Renovate-tracked like the other `edge_*_image`). - The container runs as `alloy` with the `systemd-journal` group. Root filesystem is read-only, all capabilities are dropped, `no-new-privileges` is set and the network is the host's. - `/run/log/journal` and `/etc/machine-id` are mounted read-only. The WAL and positions stay on `/run/alloy` (tmpfs). - `--log-driver none` with an attached run: Alloy's own output reaches the journal once, through the unit. - Alloy config, labels and Loki credentials are unchanged. - The `grafana-alloy` package is removed. Tested on the workstation: the image with exactly these flags (non-root, journal group, read-only, `--cap-drop ALL`) reads journal entries. `systemd-analyze verify` passes on the rendered unit. Refs YouTrack S28-16. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-11-06 10:43:09 +00:00

fix(edge-log-shipper): run Alloy from the upstream image

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

7f78f48ec6

Arch's grafana-alloy 1.21.1 is built without loki.source.journal
("loki.source.journal is not enabled"), so since the 2026-10-22 upgrade
edge-1 has shipped no logs and edge-2 never did. edge-alloy.service now
runs grafana/alloy (Renovate-tracked) as the alloy user with the journal
group, read-only root, no capabilities, host network, /run/log/journal
mounted read-only and the WAL on /run/alloy. The package is removed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k.renner merged commit db0c5a8d96 into main

2026-11-06 11:06:06 +00:00

claude-bot referenced this pull request

2026-11-06 11:13:52 +00:00

fix(os-update): keep the pacman package cache empty #1579

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1578