Host Metrics in Docker container with mounted /sys /proc still reporting container network interface statistics

[josh-a1x]

A note for the community

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Problem

Firstly, thank you, I am loving Vector!

We have been using the 0.46.1-alpine image to collect host_metrics from within a container using PROCFS_ROOT and SYSFS_ROOT.

However I noticed that the network metrics looked a bit off, and indeed, it is reporting metrics on the network devices inside the container: lo and eth0 , not my AWS EC2 host, ens5, docker0 etc.

So it appears the env var isn't being respected for network stats

Configuration

host_metrics:
    type: "host_metrics"
    scrape_interval_secs: 5
    # See: https://vector.dev/docs/reference/configuration/sources/host_metrics/#warnings
    filesystem:
      devices:
        excludes: ["binfmt_misc"]
      filesystems:
        excludes: ["binfmt_misc"]
      mountpoints:
        excludes: ["*/proc/sys/fs/binfmt_misc"]

Version

vector 0.46.1 (aarch64-unknown-linux-musl 9a19e8a 2025-04-14 18:36:30.707862743)

Debug Output

Example Data

No response

Additional Context

No response

References

No response

[josh-a1x]

I am hosting all this on AL2023 by the way. example AMI is al2023-ami-2023.7.20250414.0-kernel-6.1-arm64

I just reproduced it using timberio/vector:0.48.0-alpine and timberio/vector:0.48.0-debian with the following:

# conf.yaml
sources:
  host_metrics:
    type: "host_metrics"
    scrape_interval_secs: 5
    # See: https://vector.dev/docs/reference/configuration/sources/host_metrics/#warnings
    filesystem:
      devices:
        excludes: ["binfmt_misc"]
      filesystems:
        excludes: ["binfmt_misc"]
      mountpoints:
        excludes: ["*/proc/sys/fs/binfmt_misc"]
sinks:
  printer:
    type: console
    inputs:
      - host_metrics
    target: stdout
    encoding:
      codec: json

and running (obvs subsitiute -alpine for -debian as needed)

docker run -d \
  -e PROCFS_ROOT="/host/proc" \
  -e SYSFS_ROOT="/host/sys" \
  -v "$PWD/conf.yaml:/etc/vector/vector.yaml:ro" \
  -v "/proc:/host/proc:ro" \
  -v "/sys:/host/sys:ro" \
  --name vector \
  timberio/vector:0.48.0-alpine

When I log into the container I can see that the host network devices are mounted in /host/sys/class/net

+ docker exec -it 192cdc5a00c4c8d76a6b1a93096ed1c49047bfba0a37dbea872daea06a0a5cad /bin/sh -c eval $(grep ^$(id -un): /etc/passwd | cut -d : -f 7-)

/ #
/ # ls /host/sys/class/net/
docker0      ens5         lo           veth505fac1
/ # ls /sys/class/net
eth0  lo

And when I check the vector output it says it will use the env vars, but reports metrics on the network devices:

[ssm-user@ip-10-100-2-115 vector]$ docker logs 192cdc5a00c4 | grep "collector\":\"network"
2025-07-22T15:50:40.959461Z  INFO vector::app: Log level is enabled. level="info"
2025-07-22T15:50:40.960397Z  INFO vector::app: Loading configs. paths=["/etc/vector/vector.yaml"]
2025-07-22T15:50:40.961802Z  INFO source{component_kind="source" component_id=host_metrics component_type=host_metrics}: vector::sources::host_metrics: PROCFS_ROOT is set in envvars. Using custom for procfs. custom="/host/proc"
2025-07-22T15:50:40.961834Z  INFO source{component_kind="source" component_id=host_metrics component_type=host_metrics}: vector::sources::host_metrics: SYSFS_ROOT is set in envvars. Using custom for sysfs. custom="/host/sys"
2025-07-22T15:50:40.962551Z  INFO vector::topology::running: Running healthchecks.
2025-07-22T15:50:40.962632Z  INFO vector::topology::builder: Healthcheck passed.
2025-07-22T15:50:40.962637Z  INFO vector: Vector has started. debug="false" version="0.48.0" arch="aarch64" revision="a67e4e2 2025-06-30 18:25:45.272082383"
2025-07-22T15:50:40.962674Z  INFO vector::app: API is disabled, enable by setting `api.enabled` to `true` and use commands like `vector top`.
{"name":"network_receive_bytes_total","namespace":"host","tags":{"collector":"network","device":"lo","host":"192cdc5a00c4"},"timestamp":"2025-07-22T15:50:40.964164172Z","kind":"absolute","counter":{"value":0.0}}
{"name":"network_receive_errs_total","namespace":"host","tags":{"collector":"network","device":"lo","host":"192cdc5a00c4"},"timestamp":"2025-07-22T15:50:40.964164172Z","kind":"absolute","counter":{"value":0.0}}
{"name":"network_receive_packets_total","namespace":"host","tags":{"collector":"network","device":"lo","host":"192cdc5a00c4"},"timestamp":"2025-07-22T15:50:40.964164172Z","kind":"absolute","counter":{"value":0.0}}
{"name":"network_transmit_bytes_total","namespace":"host","tags":{"collector":"network","device":"lo","host":"192cdc5a00c4"},"timestamp":"2025-07-22T15:50:40.964164172Z","kind":"absolute","counter":{"value":0.0}}
{"name":"network_transmit_packets_drop_total","namespace":"host","tags":{"collector":"network","device":"lo","host":"192cdc5a00c4"},"timestamp":"2025-07-22T15:50:40.964164172Z","kind":"absolute","counter":{"value":0.0}}
{"name":"network_transmit_packets_total","namespace":"host","tags":{"collector":"network","device":"lo","host":"192cdc5a00c4"},"timestamp":"2025-07-22T15:50:40.964164172Z","kind":"absolute","counter":{"value":0.0}}
{"name":"network_transmit_errs_total","namespace":"host","tags":{"collector":"network","device":"lo","host":"192cdc5a00c4"},"timestamp":"2025-07-22T15:50:40.964164172Z","kind":"absolute","counter":{"value":0.0}}
{"name":"network_receive_bytes_total","namespace":"host","tags":{"collector":"network","device":"eth0","host":"192cdc5a00c4"},"timestamp":"2025-07-22T15:50:40.964164172Z","kind":"absolute","counter":{"value":200.0}}
{"name":"network_receive_errs_total","namespace":"host","tags":{"collector":"network","device":"eth0","host":"192cdc5a00c4"},"timestamp":"2025-07-22T15:50:40.964164172Z","kind":"absolute","counter":{"value":0.0}}
{"name":"network_receive_packets_total","namespace":"host","tags":{"collector":"network","device":"eth0","host":"192cdc5a00c4"},"timestamp":"2025-07-22T15:50:40.964164172Z","kind":"absolute","counter":{"value":2.0}}
{"name":"network_transmit_bytes_total","namespace":"host","tags":{"collector":"network","device":"eth0","host":"192cdc5a00c4"},"timestamp":"2025-07-22T15:50:40.964164172Z","kind":"absolute","counter":{"value":0.0}}
...

Trace logs:

2025-07-22T16:19:27.908813Z DEBUG vector::app: Internal log rate limit configured.
2025-07-22T16:19:27.908861Z  INFO vector::app: Log level is enabled. level="TRACE"
2025-07-22T16:19:27.908926Z DEBUG vector::app: messaged="Building runtime." worker_threads=8
2025-07-22T16:19:27.908999Z TRACE mio::poll: registering event source with poller: token=Token(1), interests=READABLE    
2025-07-22T16:19:27.909926Z  INFO vector::app: Loading configs. paths=["/etc/vector/vector.yaml"]
2025-07-22T16:19:27.910751Z DEBUG vector::config::loading: No secret placeholder found, skipping secret resolution.
2025-07-22T16:19:27.911139Z DEBUG vector::topology::builder: Building new source. component=host_metrics
2025-07-22T16:19:27.911414Z  INFO source{component_kind="source" component_id=host_metrics component_type=host_metrics}: vector::sources::host_metrics: PROCFS_ROOT is set in envvars. Using custom for procfs. custom="/host/proc"
2025-07-22T16:19:27.911441Z  INFO source{component_kind="source" component_id=host_metrics component_type=host_metrics}: vector::sources::host_metrics: SYSFS_ROOT is set in envvars. Using custom for sysfs. custom="/host/sys"
2025-07-22T16:19:27.911470Z DEBUG vector::topology::builder: Building new sink. component=printer
2025-07-22T16:19:27.912173Z  INFO vector::topology::running: Running healthchecks.
2025-07-22T16:19:27.912191Z DEBUG vector::topology::running: Connecting changed/added component(s).
2025-07-22T16:19:27.912208Z DEBUG vector::topology::running: Configuring outputs for source. component=host_metrics
2025-07-22T16:19:27.912228Z DEBUG vector::topology::running: Configuring output for component. component=host_metrics output_id=None
2025-07-22T16:19:27.912244Z DEBUG vector::topology::running: Connecting inputs for sink. component=printer
2025-07-22T16:19:27.912242Z  INFO vector::topology::builder: Healthcheck passed.
2025-07-22T16:19:27.912266Z DEBUG vector::topology::running: Adding component input to fanout. component=printer fanout_id=host_metrics
2025-07-22T16:19:27.912289Z DEBUG vector::topology::running: Spawning new source. key=host_metrics
2025-07-22T16:19:27.912322Z TRACE vector::topology::running: Spawning new sink. key=printer
2025-07-22T16:19:27.912339Z DEBUG source{component_kind="source" component_id=host_metrics component_type=host_metrics}: vector::topology::builder: Source pump supervisor starting.
2025-07-22T16:19:27.912365Z DEBUG source{component_kind="source" component_id=host_metrics component_type=host_metrics}: vector::topology::builder: Source pump starting.
2025-07-22T16:19:27.912359Z DEBUG source{component_kind="source" component_id=host_metrics component_type=host_metrics}: vector::topology::builder: Source starting.
2025-07-22T16:19:27.912379Z  INFO vector: Vector has started. debug="false" version="0.48.0" arch="aarch64" revision="a67e4e2 2025-06-30 18:25:45.272082383"
2025-07-22T16:19:27.912380Z DEBUG sink{component_kind="sink" component_id=printer component_type=console}: vector::topology::builder: Sink starting.
2025-07-22T16:19:27.912398Z  INFO vector::app: API is disabled, enable by setting `api.enabled` to `true` and use commands like `vector top`.
2025-07-22T16:19:27.912427Z DEBUG source{component_kind="source" component_id=host_metrics component_type=host_metrics}: vector::sources::host_metrics::cgroups: Detected modern cgroup base directory. base_dir="/host/sys/fs/cgroup"
2025-07-22T16:19:27.913767Z TRACE vector: Beep.
2025-07-22T16:19:27.913780Z TRACE source{component_kind="source" component_id=host_metrics component_type=host_metrics}: vector_common::internal_event::bytes_received: Bytes received. byte_size=0 protocol=none
2025-07-22T16:19:27.913828Z DEBUG sink{component_kind="sink" component_id=printer component_type=console}: vector::utilization: utilization=0.03937227793007081
2025-07-22T16:19:27.942894Z TRACE source{component_kind="source" component_id=host_metrics component_type=host_metrics}:grow_pool{queue_len=1 idle_count=0 thread_count=0}: blocking: spawning a new thread to handle blocking tasks
2025-07-22T16:19:27.943131Z TRACE blocking::main_loop: blocking: going to sleep timeout=500ms
2025-07-22T16:19:27.943161Z TRACE blocking::main_loop: blocking: notified
2025-07-22T16:19:27.943186Z TRACE blocking::main_loop: blocking: Internal log [going to sleep] is being suppressed to avoid flooding.
2025-07-22T16:19:27.943254Z TRACE blocking::main_loop: blocking: Internal log [notified] is being suppressed to avoid flooding.
2025-07-22T16:19:27.945760Z TRACE source{component_kind="source" component_id=host_metrics component_type=host_metrics}: mio::poll: registering event source with poller: token=Token(281472723654272), interests=READABLE | WRITABLE    
2025-07-22T16:19:27.947511Z TRACE source{component_kind="source" component_id=host_metrics component_type=host_metrics}: log: Internal log [registering event source with poller: token=Token(281472723654272), interests=READABLE | WRITABLE] is being suppressed to avoid flooding.
2025-07-22T16:19:27.949606Z TRACE source{component_kind="source" component_id=host_metrics component_type=host_metrics}: vector_common::internal_event::events_received: Events received. count=780 byte_size=501575
2025-07-22T16:19:27.949931Z TRACE source{component_kind="source" component_id=host_metrics component_type=host_metrics}: vector_buffers::topology::channel::limited_queue: Sent item.
2025-07-22T16:19:27.949950Z TRACE source{component_kind="source" component_id=host_metrics component_type=host_metrics}: vector_common::internal_event::events_sent: Events sent. count=780 byte_size=501575 output=_default
2025-07-22T16:19:27.950007Z TRACE source{component_kind="source" component_id=host_metrics component_type=host_metrics}: vector_core::fanout: Processing control message outside of send: ControlMessage::Add(ComponentKey { id: "printer" })
2025-07-22T16:19:27.950056Z TRACE source{component_kind="source" component_id=host_metrics component_type=host_metrics}: vector_buffers::topology::channel::limited_queue: Internal log [Sent item.] is being suppressed to avoid flooding.
2025-07-22T16:19:27.950079Z TRACE source{component_kind="source" component_id=host_metrics component_type=host_metrics}: vector_core::fanout: Sent item to fanout.
2025-07-22T16:19:27.950154Z TRACE sink{component_kind="sink" component_id=printer component_type=console}: vector_common::internal_event::events_received: Events received. count=780 byte_size=501575
2025-07-22T16:19:27.950224Z TRACE sink{component_kind="sink" component_id=printer component_type=console}: vector_common::internal_event::events_sent: Events sent. count=1 byte_size=569
2025-07-22T16:19:27.950235Z TRACE sink{component_kind="sink" component_id=printer component_type=console}: vector_common::internal_event::bytes_sent: Bytes sent. byte_size=229 protocol=console
2025-07-22T16:19:27.950253Z TRACE sink{component_kind="sink" component_id=printer component_type=console}: vector_common::internal_event::events_sent: Internal log [Events sent.] is being suppressed to avoid flooding.
2025-07-22T16:19:27.950266Z TRACE sink{component_kind="sink" component_id=printer component_type=console}: vector_common::internal_event::bytes_sent: Internal log [Bytes sent.] is being suppressed to avoid flooding.

[jujunchen]

me too