Deploying Grafana on an Azure Linux VM Using Docker and Configuring Network Access

Monitoring your infrastructure and applications is essential for maintaining high availability. Grafana is widely used for visualizing metrics, logs, and traces. When deploying Grafana on a Linux virtual machine hosted in Microsoft Azure, combining Docker for containerized management with Azure Network Security Groups (NSGs) provides a clean and reproducible setup while allowing controlled network access.

Prerequisites

Before starting, ensure you have:

An active Azure Virtual Machine running a Linux distribution, such as Ubuntu, Debian, or RHEL.
Docker and Docker Compose installed on your Linux server.
Administrative access to the Azure Portal.

Step 1: Deploy Grafana Using Docker Compose

While Grafana can be started with a single docker run command, using Docker Compose makes long-term management and updates easier.

1. Create a Project Directory

Create a dedicated directory for Grafana and navigate into it:

mkdir grafana && cd grafana

This directory will contain the Docker Compose configuration for the Grafana deployment.

2. Create the Compose File

Create a file named docker-compose.yml using your preferred text editor, such as nano or vim:

version: '3.8'

services:
  grafana:
    image: grafana/grafana-oss:latest
    container_name: grafana
    ports:
      - "3000:3000"
    volumes:
      - grafana-storage:/var/lib/grafana
    restart: unless-stopped

volumes:
  grafana-storage:

This configuration defines the Grafana container, maps port 3000, and creates a persistent volume for Grafana data.

3. Launch the Container

Run the following command to deploy Grafana in the background:

docker compose up -d

To verify that the container is running, execute:

docker compose ps

If the container is running correctly, Grafana should be available on port 3000 of the Linux VM.

Step 2: Configure the Azure Network Security Group (NSG)

To access the Grafana dashboard externally, the Azure Network Security Group associated with the VM must allow inbound TCP traffic on port 3000.

1. Navigate to Virtual Machine Networking

In the left-hand menu under Settings, click Networking.

2. Add an Inbound Port Rule

Click + Create port rule or Add inbound port rule, depending on the Azure Portal interface.

3. Configure Port Parameters

In the configuration panel, enter the required parameters:

Source: Any or, preferably, your specific IP address or IP range.
Destination port ranges: 3000
Protocol: TCP
Action: Allow
Priority: Use an appropriate unused priority, such as 310.
Name: Allow-Grafana-3000

Click Add to save the rule.

For improved security, restrict the source to a known IP address or network instead of allowing traffic from any source.

Step 3: Access and Secure Grafana

Once Grafana is running and the Azure NSG permits traffic on port 3000, you can access the Grafana web interface.

Open your browser and navigate to:

http://<your-azure-vm-public-ip>:3000

For example:

http://203.0.113.10:3000

On a new Grafana installation, use the default credentials:

Username: admin
Password: admin

Follow the on-screen prompts to change the default password immediately.

For production environments, avoid exposing Grafana directly to the public internet without additional security controls. Consider using HTTPS, restricting network access, and placing Grafana behind an appropriate reverse proxy or gateway.

Conclusion

Deploying Grafana on an Azure Linux virtual machine using Docker Compose provides a straightforward way to run and manage the monitoring platform.

The setup involves:

Creating a dedicated Grafana project directory.
Defining the Grafana container using Docker Compose.
Starting and verifying the container.
Configuring an Azure NSG rule for port 3000.
Accessing Grafana through the VM's public IP address.
Changing the default administrator password.

With these steps completed, Grafana is ready to be configured with the appropriate data sources and used for monitoring infrastructure and applications.