Recommended Free Tools
To install the LGTM stack on a VPS, run Grafana’s maintained grafana/otel-lgtm image for a disposable evaluation, or deploy Loki, Grafana, Tempo and a Prometheus-compatible metrics backend such as Mimir as separate services. Put Grafana and telemetry ingestion behind TLS and authentication, keep the storage backends private, and treat the all-in-one image as a development and testing tool rather than a production observability platform.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This guide gives you a repeatable Docker Compose path, explains the data flow, shows which network boundaries to create, and provides checks for logs, traces, metrics, persistence and upgrades.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat the LGTM stack contains
LGTM is a four-part observability pattern:
| Letter | Component | Role |
|---|---|---|
| L | Loki | Stores and queries logs. It indexes labels rather than the full content of every log line, which makes label design important. |
| G | Grafana | Provides dashboards, Explore, alerting and navigation between related signals. |
| T | Tempo | Stores and searches distributed traces received through OpenTelemetry. |
| M | Mimir or another Prometheus-compatible backend | Stores and queries time-series metrics. Mimir is the usual Grafana-oriented choice when metrics must be retained and scaled separately from Grafana. |
Applications and host agents emit logs, metrics and traces to Grafana Alloy or an OpenTelemetry Collector. The collector routes logs to Loki, traces to Tempo and metrics to Prometheus or Mimir. Grafana then queries those backends and presents dashboards, Explore views, service graphs and cross-signal links.
Grafana’s maintained grafana/otel-lgtm image is broader than the four-letter acronym: it bundles Grafana, an OpenTelemetry Collector, Prometheus, Loki, Tempo and Pyroscope. That convenience is useful for a lab, demo or smoke test, but it does not remove the need for production security, storage, retention and upgrade engineering.
#1 Best Overall
Choose an all-in-one or split deployment
| Decision factor | All-in-one image | Split services |
|---|---|---|
| Setup time | Fastest: one Compose service and a small number of published ports. | Longer: each backend, collector and configuration file must be defined and tested. |
| Isolation | Low. A process, disk or configuration problem can affect every signal. | Higher. Logs, traces, metrics and ingestion can be limited independently. |
| Upgrade independence | Components move together with the image. | Grafana, Loki, Tempo, Mimir and collectors can be staged on separate schedules. |
| Resource visibility | Simple to start, but per-component CPU and memory behavior is less obvious. | Each service can have explicit limits, dashboards and restart policies. |
| Persistence design | Convenient for experiments; the image’s documented storage layout must be followed. | Volumes or object storage can be designed for each backend and retention policy. |
| Scaling | Scale the whole bundle, even when only one signal is busy. | Scale collectors and storage tiers according to their own ingest and query loads. |
| Failure blast radius | A single container or host issue can remove the entire observability view. | Failures are easier to contain, although Grafana may temporarily lose one signal. |
Use the all-in-one path below for learning, a short-lived acceptance test or a demo. Use a split design when the VPS will collect important production telemetry or when you need independent retention, backups and upgrades.
Prerequisites and VPS planning
Install the host software
Use a supported Linux VPS and install:
- Git, if you will keep Compose files and configuration in a repository.
- Docker Engine.
- The Docker Compose plugin, so the command is
docker composerather than the obsolete standalonedocker-composebinary.
Grafana’s Tempo quick start lists Git, Docker and the Compose plugin as prerequisites. Follow the installation method for your Linux distribution, then verify the tools before creating the stack:
Free tools Windows power users keep installed
One-click scans. No signup required.
git --version
docker --version
docker compose versionSize from telemetry, not from a generic VPS chart
There is no authoritative one-size CPU, memory, disk or bandwidth specification for LGTM. Required capacity depends on log volume, trace sampling, metric cardinality, query concurrency, retention and compression. Start with measured ingest rates and watch the host while traffic is flowing.
- CPU is consumed by collectors, parsing, compression, indexing and queries.
- Memory pressure appears during ingestion, compaction and large dashboard queries.
- Disk usage follows retained chunks, indexes, WALs and temporary files.
- Network capacity must cover telemetry ingress, dashboard queries, backups and any object-storage traffic.
For a trial, choose a VPS that can run Docker and the selected image comfortably. Before collecting business-critical data, load-test with representative traffic and set disk, memory and CPU alerts.
Create a controlled project directory
Keep the deployment in one dedicated directory, for example:
mkdir -p "$HOME/lgtm"
cd "$HOME/lgtm"
git initStore Compose files, Loki, Tempo, Mimir, collector and Grafana provisioning files under version control. Keep passwords, API tokens and private keys outside the repository; inject them through a protected environment file or a secret mechanism supported by your deployment. Review file permissions so ordinary users cannot read credentials.
Rank #2
Run a quick LGTM evaluation with Docker Compose
The following Compose file intentionally uses the maintained image without a version tag. That is acceptable for a disposable evaluation, because it lets you start quickly. Do not copy this unpinned image reference into a production change without selecting and testing a specific release.
services:
lgtm:
image: grafana/otel-lgtm
container_name: lgtm
restart: unless-stopped
ports:
- "3000:3000"
- "4317:4317"
- "4318:4318"Save it as compose.yaml. The published ports provide the Grafana web interface and the two standard OpenTelemetry Protocol transports used by many SDKs: gRPC and HTTP. The image’s own documentation and bundled configuration remain the authority for any additional ports or paths.
Start and inspect the container
- From the project directory, start the service in the background:
docker compose up -d - Confirm that Compose created the expected container:
docker compose ps - Read startup output if the status is not healthy or the web interface does not respond:
docker compose logs --follow lgtm - Open Grafana at
http://SERVER_IP:3000only from a restricted administration network while this evaluation is running. Change the initial credentials through the image’s documented procedure before anyone else can reach it.
This simple file has no deliberately designed durable storage. Treat its data as replaceable. If the container or VPS is removed, dashboards and telemetry may disappear. A persistent deployment must use the storage mounts and configuration described by the selected Grafana, Loki, Tempo and metrics backend documentation, then back those volumes up.
Verify logs, traces and metrics
Check the data sources
In Grafana, open the data-source settings and test the Loki, Tempo and metrics connections supplied by the image. A successful connection test proves reachability and basic configuration; it does not prove that retention, authentication or query performance are correct.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesGenerate a known test log
Produce a deliberately identifiable log from a test application or host agent, then open Explore, select Loki and search for that label or message. Use a distinctive value such as a temporary service name so you can distinguish your test event from background container logs. If it does not appear, inspect collector logs and verify that the exporter points to the Loki endpoint used by your Compose network.
Generate and search a trace
Run a small instrumented request through an OpenTelemetry SDK configured for the collector’s OTLP endpoint. In Grafana, select Tempo, open Search and locate the trace. Open it and confirm that the span tree or trace diagram contains the expected service and duration. A trace that reaches the collector but not Tempo usually indicates an exporter, protocol or endpoint mismatch.
Query recent metrics
Send a test metric or scrape a test target, then run a simple recent-sample query in Grafana. Confirm that a dashboard panel renders values with current timestamps. Empty results can mean that the target is not being scraped, the collector is not exporting, or the query is aimed at a different metrics backend.
What ports do I open for Grafana and OpenTelemetry?
For the evaluation Compose file, Grafana is mapped to TCP 3000, while OTLP is mapped to TCP 4317 (gRPC) and TCP 4318 (HTTP). These are examples for this image and configuration, not a universal firewall requirement. Confirm the ports in the Compose file and collector configuration you actually deploy.
| Endpoint | Typical exposure policy | Reason |
|---|---|---|
| Grafana web interface | Expose through an authenticated reverse proxy on TLS; keep the container port private where possible. | Dashboards and administration should not be exposed as an unauthenticated HTTP service. |
| OTLP gRPC (4317 in the example) | Allow only from applications, agents or a private network that must send telemetry. | Public OTLP ingestion invites abuse and can exhaust CPU, memory and disk. |
| OTLP HTTP (4318 in the example) | Allow only from approved senders; expose through TLS if traffic crosses an untrusted network. | It is an ingestion endpoint, not a public browsing endpoint. |
| Loki, Tempo, Mimir and collector APIs | Keep on the Docker network or private network; do not broadly publish them. | Grafana and trusted collectors can reach them without making storage APIs Internet-facing. |
| SSH administration | Restrict to a management IP range or private access path. | Routine host administration should not be open to the entire Internet. |
In a hardened design, clients connect to a reverse proxy on HTTPS (normally TCP 443), and the proxy forwards to Grafana and, where required, authenticated OTLP ingestion. An HTTP listener may be used only for redirecting to HTTPS. Firewall rules should expose administration and required ingress—not every port present in the Compose file.
Build a split LGTM deployment
When the VPS becomes a real observability service, separate the concerns:
- Run Grafana Alloy or an OpenTelemetry Collector as the controlled ingestion tier.
- Configure log receivers and exporters so logs are sent to Loki.
- Configure OTLP trace exporters so traces are sent to Tempo.
- Configure metric receivers or scrapers so metrics are sent to Prometheus or Mimir.
- Run Grafana as the only broadly reachable query and visualization service.
- Put Loki, Tempo, Mimir and collector APIs on an internal Compose network, with explicit service-to-service credentials and tenant settings where required.
Grafana’s Loki tutorial demonstrates the Docker Compose workflow and the collector-to-Loki leg. Official Compose examples are useful for learning and evaluation, but production changes must add authentication, durable storage, retention, backups and resource controls.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Persistence choices
Use durable mounted volumes or external object storage according to each backend’s supported design. The Loki quick-start environment includes MinIO for Loki indexes and chunks, illustrating that persistence is an architectural decision rather than an automatic property of a container. A local Docker volume is not a backup: define scheduled backups, test restoration and monitor remaining disk space.
Rank #4
Retention and cardinality
Set log, trace and metric retention before sending important telemetry. Keep Loki labels bounded; putting request IDs, full URLs or other unbounded values into labels can create excessive index cardinality. Apply trace sampling deliberately, and avoid collecting high-cardinality metrics without a query and storage reason.
Production hardening on a VPS
Authentication and TLS
Place Grafana and ingestion endpoints behind TLS and an authenticated reverse proxy or private network. Grafana’s documentation states: “Grafana Tempo doesn’t come with any included authentication layer.” Therefore, never treat a reachable Tempo endpoint as protected merely because it is running inside Docker. Apply equivalent controls to Loki, Mimir and collector endpoints.
Firewall and network boundaries
- Allow SSH only from a controlled administration path.
- Expose Grafana through the protected HTTPS entry point.
- Allow OTLP only from known applications, agents or private network ranges.
- Do not publish internal Loki, Tempo, Mimir or collector APIs broadly.
- Review Docker-published ports after every Compose change; a newly added mapping can bypass the intended proxy boundary.
Version pinning and upgrades
Pin image versions in production instead of using latest. Read the release notes for Grafana, Loki, Tempo, Mimir and the collector, test upgrades in a staging stack, and keep the previous image available for rollback. Upgrade one change at a time when possible, verify data-source health and query results, and record the migration steps.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Deprecated Loki deployment modes
Loki’s quick-start documentation says Simple Scalable Deployment is deprecated and scheduled for removal in Loki 4.0. Do not start a new production design around that mode; select a currently recommended deployment mode and verify its storage and scaling requirements.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Validation checklist before accepting the VPS
docker compose psshows every expected container running.- Grafana loads through the protected URL and requires authentication.
- Loki, Tempo and the metrics data sources pass their built-in connection tests.
- A deliberately generated test log appears in Loki Explore.
- A generated trace appears in Tempo Search and opens as a trace diagram.
- Metrics queries return recent samples and dashboards render.
- Restart a container and confirm that data survives according to the selected storage design.
- Review logs for authentication failures, tenant-header errors, rejected OTLP payloads and disk pressure.
- Restore a backup in a separate test location and verify that the documented procedure works.
Troubleshooting common failures
The container is running, but Grafana is unreachable
Check docker compose ps, then inspect docker compose logs lgtm. Confirm that the VPS firewall, cloud firewall and any reverse proxy allow the intended path. If the service listens only on localhost or a private interface, do not solve the problem by exposing every container port; correct the proxy or binding configuration.
OTLP requests are rejected
Verify that the application uses the same protocol as the receiver: OTLP gRPC and OTLP HTTP are different transports. Check the hostname and port from inside the application’s network, confirm that TLS expectations match, and inspect collector logs for malformed payloads or authentication and tenant-header errors.
Best Value
Logs arrive intermittently
Look for collector back-pressure, dropped batches, Loki write errors and disk pressure. Check whether the VPS has enough I/O capacity and whether retention is consuming the volume. A restart can hide the symptom temporarily; measure ingest and storage before increasing limits.
Traces appear in the collector but not in Tempo
Inspect the collector’s Tempo exporter, endpoint and protocol settings. Confirm that the Tempo service is reachable on the internal network and that the trace search window includes the test request. Also check for authentication or tenant headers if the split deployment requires them.
Data disappeared after a restart
The evaluation file intentionally lacks a production persistence design. Add the documented durable volume or object-storage configuration for the selected backend, restart the service, and test survival again. Then back up the data and practice a restore; a volume that survives one restart is not necessarily recoverable after host loss.
Is the LGTM Docker image production ready?
The maintained grafana/otel-lgtm image is explicitly positioned for development, demos and testing. It is a good way to learn the interfaces, validate instrumentation and prove that a small application emits all three signal types. It is not, by itself, a production architecture. Production readiness requires pinned versions, authenticated TLS endpoints, private backend APIs, durable storage, retention and backup policies, resource monitoring, tested restores and an upgrade rollback plan.
For a short evaluation, the all-in-one Compose service minimizes setup time. For a service that must remain available and retain telemetry, split the collector and storage backends, measure actual workload, and design the VPS and storage around those measurements.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
