To install the LGTM stack on a VPS, run Grafana’s maintained grafana/otel-lgtm image with Docker Compose for a development or smoke-test environment, then move to separately managed Loki, Tempo, a Prometheus-compatible metrics backend such as Mimir, and an Alloy or OpenTelemetry Collector when you need production isolation. Protect every public endpoint, use durable storage, and validate each signal before sending important telemetry.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What the LGTM stack contains
LGTM is a four-part observability pattern:
- Loki stores and indexes logs.
- Grafana provides dashboards, Explore, alerting, and links between signals.
- Tempo stores distributed traces.
- M is a metrics backend. Mimir is a natural choice, although any Prometheus-compatible backend can fill this role.
Applications and host agents emit logs, metrics, and traces to Grafana Alloy or an OpenTelemetry Collector. Logs are exported to Loki, traces to Tempo using OpenTelemetry, and metrics to Prometheus or Mimir. Grafana queries those systems and presents dashboards, Explore searches, service graphs, and cross-signal navigation.
As an Amazon Associate I earn from qualifying purchases.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteGrafana also publishes an all-in-one image, grafana/otel-lgtm. Its documented bundle includes Grafana, an OpenTelemetry Collector, Prometheus, Tempo, Loki, and Pyroscope. That makes it useful for learning, demonstrations, and testing, but the image is not a blanket production recommendation.
Choose an architecture before opening ports
| Concern | All-in-one container | Split services |
|---|---|---|
| Setup time | Fast: one image and one Compose service can provide a working laboratory. | Longer: each backend, collector, configuration file, and storage path must be defined. |
| Isolation | Weak. A process, configuration error, or resource spike affects the whole bundle. | Stronger. Logs, traces, metrics, and ingestion can be restarted or limited independently. |
| Upgrades | Tied to the image’s release and bundle choices. | Components can be pinned, upgraded, and rolled back independently. |
| Resource visibility | Simple to start, but per-component CPU and memory behavior is less obvious. | Each service has visible limits, logs, and health signals. |
| Persistence | Usually begins with local Docker volumes, which are easy to lose if not backed up. | Storage can be designed per backend, including external object storage. |
| Scaling | Scale the bundle as a unit. | Scale the collector or a backend according to its own ingest and query load. |
| Failure blast radius | High: a container or host problem can remove every signal. | Lower when replicas, queues, and independent storage are designed correctly. |
Use the all-in-one route for a disposable evaluation VPS, a training environment, or a smoke test. Use a split design for production telemetry, especially when several applications depend on the service or retention and recovery matter.
#1 Best Overall
VPS requirements and preparation
Size from observed telemetry
No authoritative one-size VPS specification, cost, or performance figure is published in the cited Grafana materials. CPU, memory, disk I/O, disk capacity, and network bandwidth depend on log volume, trace spans, metric cardinality, query concurrency, and retention. Start with a measured ingest rate and leave headroom for compaction, indexes, dashboards, and upgrades rather than selecting a machine from a generic “minimum” table.
Before provisioning, estimate:
- events, spans, and metric samples per second at normal and peak load;
- retention days for each signal;
- the amount of local scratch space needed during compaction and upgrades;
- backup bandwidth and the time allowed for restoration;
- how many people or automation jobs will query Grafana simultaneously.
Install the host software
Use a supported Linux distribution and a dedicated, non-root administrative account. Grafana’s Tempo quick start lists Git, Docker, and the Docker Compose plugin as prerequisites. Install those from your distribution or Docker’s current instructions, then verify:
Recommended Free Tools
git --version
docker --version
docker compose versionThe Compose command is the plugin form, docker compose, rather than the older standalone docker-compose binary. Keep the host patched and synchronize its clock; timestamps are essential when correlating logs, metrics, and traces.
Create a controlled project directory
Keep the Compose file, backend configuration, collector pipelines, Grafana provisioning, and operational notes in a dedicated directory. Put non-secret configuration under version control. Supply passwords, tokens, and private keys through a protected environment file or secret mechanism that is excluded from the repository.
sudo mkdir -p /opt/lgtm
sudo chown "$USER":"$USER" /opt/lgtm
cd /opt/lgtm
mkdir -p config data backupsDo not put credentials directly in a public Compose file. Restrict permissions on secret files and confirm that backups do not expose them.
Quick evaluation deployment with Docker Compose
The shortest repeatable path is Grafana’s maintained all-in-one image. The project describes it as intended for development, demo, and testing. Treat local volumes as replaceable until you have deliberately designed backup and restore.
Rank #2
Write the Compose file
In /opt/lgtm, create compose.yaml:
services:
lgtm:
image: grafana/otel-lgtm:latest
restart: unless-stopped
ports:
- "3000:3000"
- "4317:4317"
- "4318:4318"
volumes:
- lgtm-data:/data
volumes:
lgtm-data:This example exposes Grafana’s web port and the standard OTLP gRPC and HTTP listener ports. Confirm the current image documentation before relying on a listener or data path, because bundled components and defaults can change. For production, replace latest with a tested version and record the rollback image.
Start and inspect the container
- From the project directory, run
docker compose up -d. - Run
docker compose psand confirm the service is running. - Read startup output with
docker compose logs --tail=200 lgtm. - Open Grafana through the protected URL you configure at the reverse proxy. Complete the initial administrator setup.
The official Tempo quick start uses the same docker compose up -d followed by docker compose ps workflow. If the container repeatedly restarts, inspect its logs first; a port collision, invalid configuration, insufficient disk space, or an unwritable mounted directory is usually more informative than the Compose summary.
Send a known test signal
Use a deliberately generated test log and trace instead of waiting for a production application. Configure an OpenTelemetry SDK, Alloy, or an OpenTelemetry Collector to send OTLP to the collector listener. Send logs to the Loki pipeline, traces to Tempo, and metrics to the bundled Prometheus or to your selected metrics backend. The exact exporter settings depend on the client language and collector configuration, so keep those files beside the Compose project and document the endpoint and protocol used.
In Grafana, open Explore, select the Loki data source, and search for a distinctive test message. Select Tempo and use Search to find the generated trace; open it and confirm that the trace diagram renders. Select the metrics data source and run a query that should return a recent sample. If service-graph or trace-to-log navigation is configured, follow one link in each direction and verify that the time range and identifiers match.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Building a split deployment
A production-oriented layout separates ingestion from storage and visualization:
- Applications and host agents send telemetry to Grafana Alloy or an OpenTelemetry Collector.
- The collector parses, enriches, batches, and routes logs to Loki.
- OTLP traces go to Tempo.
- Prometheus scraping or remote write sends metrics to Mimir or another Prometheus-compatible backend.
- Grafana connects to each backend as a data source.
Grafana’s Loki tutorial demonstrates starting a Compose environment and configuring an OpenTelemetry Collector to send logs to Loki. Use the official Compose examples as the starting point for component-specific configuration rather than copying an old community file. Keep collector pipelines, Loki configuration, Tempo configuration, metrics configuration, and Grafana provisioning in separate versioned files so that a change in one signal path can be reviewed independently.
Decide where each component listens
On a single VPS, bind internal backend listeners to the private Docker network whenever possible. Only the reverse proxy and deliberately selected ingestion endpoints should be reachable from the Internet. A typical arrangement is:
| Endpoint | Purpose | Internet exposure |
|---|---|---|
| 80 and 443 | Reverse proxy and certificate termination. | Expose 443; keep 80 only for the redirect or certificate workflow you require. |
| 3000 | Grafana web interface. | Do not publish directly when a proxy or private network can front it. |
| 4317 | OTLP over gRPC. | Allow only from trusted applications, agents, or a private network; protect it with TLS and authentication at the edge. |
| 4318 | OTLP over HTTP. | Apply the same restriction; do not leave it broadly open. |
| Loki, Tempo, Mimir, and collector API ports | Internal ingestion, query, and administration. | Keep private unless a specific, authenticated architecture requires otherwise. |
Thus, when someone asks “what ports do I open for Grafana and OpenTelemetry,” the safe answer is to expose only the reverse proxy publicly, then permit 4317 or 4318 from known senders. The exact internal ports vary with the selected configuration. A firewall rule that merely makes a port reachable is not an authentication design.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsTLS, authentication, and firewall hardening
Put Grafana and ingestion endpoints behind TLS and an authenticated reverse proxy or a private network. Grafana’s documentation states: “Grafana Tempo doesn’t come with any included authentication layer.” Do not place Tempo, Loki, Mimir, or an unauthenticated collector listener directly on the public Internet.
- Allow SSH only from administration addresses or through a private access path.
- Expose 443 for Grafana and any intentionally secured ingestion gateway.
- Use strong administrator credentials and separate service credentials.
- Require TLS for OTLP across untrusted networks.
- Use network policies or Docker networks so Grafana reaches backends without publishing their ports.
- Review reverse-proxy limits for request size, timeouts, and connection counts.
- Watch for tenant-header errors and rejected OTLP payloads after enabling authentication or multi-tenancy.
Grafana authentication does not automatically secure every backend. A user who can reach a backend’s native API may bypass the Grafana permission model, so backend listeners should remain private.
Persistence, retention, and recovery
Telemetry storage is part of the design, not an optional volume declaration. The Loki quick-start Compose environment includes MinIO for Loki indexes and chunks, illustrating that persistence must be planned explicitly.
Local volumes
A named Docker volume is convenient for a lab and can survive a container recreation, but it is still tied to the VPS. Disk loss, accidental removal, filesystem corruption, or a destroyed host removes the data unless you have a tested backup. Monitor free space and inode usage, and set alerts before the disk fills.
Rank #4
Object storage and external services
For production, evaluate durable object storage for components that support it, along with a separate backup location. Document credentials, bucket policies, encryption, lifecycle rules, and the restore procedure. Keep indexes, chunks, traces, and metric blocks within the retention policy you actually intend to operate; indefinite retention on a small VPS is not a capacity plan.
Retention and restore tests
- Define retention separately for logs, traces, and metrics.
- Set disk-pressure alerts below the point at which compaction or ingestion fails.
- Back up configuration, provisioning files, and secrets according to their sensitivity.
- Back up data or use the backend’s durable storage mechanism.
- Periodically restore to an isolated environment and query a known test event.
Never assume that a successful file copy is a valid observability backup. A restore is complete only when Grafana can connect and expected data can be queried.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Production image and upgrade policy
Pin image versions in production. Review Grafana, Loki, Tempo, Mimir, collector, and operating-system release notes before upgrading. Stage the change on a disposable or separate host, capture the current image digests and configuration, then define a rollback image and data-compatibility plan.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do not copy latest into a production Compose file without a rollback plan. Upgrade one component at a time when the architecture permits it, and watch ingestion, query latency, error rates, disk use, and memory after each change. Keep the Compose file and configuration history so you can identify which change introduced a failure.
Loki’s quick-start documentation says its Simple Scalable Deployment mode is deprecated and scheduled for removal in Loki 4.0. Do not choose that mode for a new production design; follow the currently recommended deployment modes in the version you install.
End-to-end validation checklist
docker compose psshows the expected containers running.- Grafana loads through the protected URL and requires authentication.
- The Loki, Tempo, and metrics data sources pass their built-in connection tests.
- A deliberately generated test log appears in Loki Explore.
- A generated trace appears in Tempo Search and opens as a trace diagram.
- A metrics query returns recent samples and a dashboard renders them.
- Restart a container and confirm that data survives according to the selected storage design.
- Review logs for authentication failures, tenant-header errors, rejected OTLP payloads, and disk pressure.
- Verify that a test trace can be correlated with its log entries and metrics when the required IDs and exemplars are configured.
Troubleshooting by symptom
Grafana opens, but a data source fails
Check the data-source URL from inside the Docker network, not from your laptop. Confirm the backend container name, listening address, credentials, tenant headers, and TLS settings. Then inspect the backend logs for rejected requests. A browser request to a private service address is not a valid connectivity test for Grafana.
Best Value
Logs never appear in Loki
Confirm that the collector receives the event, that its pipeline selects the intended receiver and exporter, and that the exporter points to the correct Loki endpoint. Look for authentication or tenant-header errors. Generate one unmistakable test message and search a narrow time range in Explore; an overly broad query can hide a timestamp or label mistake.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Traces arrive but cannot be searched
Check that the client and collector use the same OTLP protocol and that the collector routes traces to Tempo rather than the logs exporter. Verify the trace timestamp, service name, and sampling decision. Read Tempo’s logs for rejected payloads and confirm that Grafana’s Tempo data source points to the private Tempo address.
Metrics are empty or dashboards show “No data”
Confirm that the target is being scraped or that remote write is accepted, then run a simple recent-sample query before opening a complex dashboard. Check label names, time range, clock synchronization, and retention. A dashboard built for a different metric naming convention can be healthy while displaying nothing.
The VPS runs out of disk
Stop accepting nonessential telemetry if necessary, identify which backend and volume are growing, and preserve logs before deleting data. Reduce retention or ingest volume deliberately, add capacity, and verify compaction behavior. Do not delete a Docker volume as a first response; it can destroy the only copy of your telemetry.
Is the LGTM Docker image production ready?
The maintained all-in-one image is explicitly positioned for development, demo, and testing. It is production-ready only in the limited sense that you can run a carefully engineered observability service with pinned components, secure ingress, durable storage, backups, monitoring, and a tested upgrade and recovery process. The image’s convenience does not supply those operational controls. For a consequential service, use the image to learn the signal flow, then adopt a split deployment or another documented production architecture that matches your ingest and retention requirements.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
