Eight containers against a variable APM bill: what the self-hosted stack actually costs you

A dev.to walkthrough published a full Docker Compose file for a self-hosted observability stack: Prometheus with Node Exporter and cAdvisor for metrics, Promtail shipping container logs into Loki, Grafana on top, Uptime Kuma for external HTTP checks, all behind a Caddy reverse proxy [s1c4][s1c5][s1c6][s1c14]. It matters because of what it replaces: the author frames it against APM platforms where adding custom tags, ingestion volume or retained log indices can turn a $200/mo budget into a $2,000/mo invoice [s1c1][s1c2], a factor of ten [s1c3].

That is the trade being offered. Instead of a bill that moves with cardinality, you get a VPS bill, and the author claims the stack runs reliably on 4GB to 8GB of RAM for dozens of microservices [s1c7]. The rest of the cost shows up in the config, so read it.

The shape is eight long-running services [s1c15] and six named volumes [s1c17], with only Caddy publishing to the host on ports 80 and 443 [s1c14]; the other seven sit on an internal bridge network with no host ports [s1c16]. Every image is version-pinned, from Prometheus v2.51.0 and Loki 3.0.0 to Uptime Kuma 1.23.13-alpine [s1c8]. That is the right default, and it means the upgrade calendar is now yours.

Prometheus scrapes every 15 seconds against exactly three jobs: itself, node-exporter and cAdvisor [s1c10]. Retention is 30 days on a local volume [s1c9]. Application-level metrics are not in the box; you add scrape targets yourself. Loki runs with auth_enabled false, filesystem chunk storage, replication factor 1 and an in-memory ring [s1c11], which is a single-host deployment with no redundancy behind it. The printed Loki config also carries no compactor or retention section [s1c19], so log volume grows until you write one. The vendor charged you for retained indices; here the same decision arrives as a disk that fills up.

Alerting is the gap worth naming. The prometheus.yml in the article contains only global settings and scrape_configs, with no alerting or rule_files entries [s1c18]. The only notification path shipped is Uptime Kuma's external checks, which can fire to Telegram, Discord or webhooks [s1c6]. So a saturated disk or a stalled scrape on the monitoring host itself will not page anyone unless an external HTTP check happens to fail as a side effect.

Two more items for the risk register. The Grafana admin password sits in plaintext in the Compose environment block as ChangeThisSecurePassword!, with sign-ups disabled [s1c12]. And cAdvisor runs privileged, with /dev/kmsg and read-only mounts of / and /var/lib/docker [s1c13], while Promtail reads /var/log and /var/lib/docker/containers read-only [s1c20]. This box sees everything on the host, so treat it as production infrastructure rather than a side project.

None of that invalidates the argument. Promtail into Loki genuinely avoids ElasticSearch-class overhead, per the author [s1c5], and predictable cost has real operational value. But the honest comparison is not $2,000 against zero. It is a variable vendor bill against a fixed VPS bill plus retention policy, backups, TLS, upgrades and an alerting layer that this Compose file does not include [s1c18][s1c19].