Prometheus is a powerful open-source monitoring and alerting toolkit.
It features a multi-dimensional data model, a flexible query language (PromQL), and integrates tightly with Grafana.
Key strengths:
Pull-based metrics collection
Excellent for Kubernetes and cloud-native environments
Strong alerting via Alertmanager
Self-host Prometheus with Docker
Verified install
We started this exact setup from scratch in a clean Linux machine on Nov 1, 2026 and checked it through Prometheus's own API: every check passed. Recipes are re-checked regularly and removed if they stop working.
Prometheus has no built-in authentication. Port 9090 is bound to 127.0.0.1: access it from outside <your-server> through an SSH tunnel (ssh -L 9090:127.0.0.1:9090 user@<your-server>) or place an authenticating reverse proxy with TLS in front of it.
On a fresh install, access the web UI at http://127.0.0.1:9090 (or http://localhost:9090 via your SSH tunnel) to query PromQL metrics; Status → Targets lists the default active scrape target (Prometheus scraping itself).
The default configuration scrapes Prometheus itself; because /etc/prometheus/prometheus.yml is not mounted, any edits inside the container are lost on restart. To add custom scrape targets or alerting rules, mount a host configuration file into /etc/prometheus/prometheus.yml in compose.yml and restart Prometheus or reload via SIGHUP (docker compose kill -s HUP prometheus).
security: public host — port 9090 is bound to 127.0.0.1
security: open protocols — no unauthenticated Redis protocol on public ports
security: nuclei scan — no public TCP ports
services healthy
logs clean
Ubuntu 24.04 · Apple container, Docker 29.1.3, Compose 2.40.3+ds1-0ubuntu1~24.04.1. Images pulled in 43 s: prom/prometheus:v3.15.1.
Based on the upstream setup. Official Docker setup with named volume for TSDB data. Image pinned to v3.15.1, bound to 127.0.0.1 because Prometheus has no native authentication, web lifecycle disabled, and healthcheck added.
