Deploying Grafana

Grafana is a visualization and alerting service. A production deployment needs more than a running container: it needs durable state, reproducible provisioning, authenticated access, and a backup and upgrade procedure.

Run Grafana with Persistent State #

Grafana stores users, dashboards created in the UI, alerting data, and configuration metadata in its database. For a small installation, persist the default SQLite database; for highly available deployments, use a supported external database and run multiple Grafana instances behind a load balancer.

services:
  grafana:
    image: grafana/grafana:11.2.0
    ports:
      - "3000:3000"
    volumes:
      - grafana-data:/var/lib/grafana
      - ./provisioning:/etc/grafana/provisioning:ro
    environment:
      GF_SERVER_ROOT_URL: https://grafana.example.com/
      GF_SECURITY_ADMIN_USER: admin
      GF_SECURITY_ADMIN_PASSWORD__FILE: /run/secrets/grafana_admin_password
    secrets:
      - grafana_admin_password
volumes:
  grafana-data:
secrets:
  grafana_admin_password:
    file: ./grafana_admin_password.txt

Pin a tested image version instead of using a floating tag. The shown secret file is suitable only when its filesystem permissions and deployment mechanism are controlled; use the platform’s secret manager in production.

Provision Data Sources and Dashboards #

Provisioning makes configuration reviewable and repeatable. A Prometheus data source can be defined in provisioning/datasources/prometheus.yaml:

apiVersion: 1
datasources:
  - name: Prometheus
    type: prometheus
    access: proxy
    url: http://prometheus:9090
    isDefault: true

Use dashboard provisioning for dashboards stored in version control. Decide ownership carefully: a provisioned dashboard may be overwritten on restart if the source file changes. Keep a documented path for emergency UI changes and export them back to source control.

Secure, Back Up, and Upgrade #

Terminate TLS at Grafana or a trusted reverse proxy, set the public root_url, and configure the correct OAuth, SAML, LDAP, or anonymous-access policy. Disable anonymous access unless it is intentionally public. Use organization and folder permissions to keep teams from modifying each other’s dashboards and alert rules.

Back up the database and provisioning repository together, then test a restore. Before an upgrade, read the release notes, take a database backup, test the target version against data sources and alert delivery, and retain a rollback plan. Do not expose Grafana’s administrative endpoints directly to the Internet without authentication and rate-limiting controls.