Most secure monitoring and observability container images, ranked by isolation score¶
How isolated are the most-pulled monitoring and observability container images when you docker run them with plain defaults, no hardening flags? This page ranks 27 metrics, logging, and tracing stacks (Prometheus, Grafana, Loki, Jaeger, exporters) on IronClaw's seven-dimension container containment scale (0-100), best-isolated first. Scores run 48/100 to 63/100 (average 56/100). Higher is safer. Every score comes from ironctl scan, a credential-free audit you can run on your own containers in ten seconds.
No monitoring and observability image ships fully isolated by default: the leaders still leave capabilities, egress, or a writable root filesystem open. Every one of those gaps has a
docker runflag that targets it, listed on every scorecard.
Ranked best to worst¶
| Rank | Image | Score | Grade | Top gaps (default config) |
|---|---|---|---|---|
| 🥇 1 | prom/alertmanager:v0.28.0 |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 🥈 2 | fluent/fluentd:v1.17 |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 🥉 3 | grafana/grafana:11.4.0 |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 4 | graylog/graylog:6.1 |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 5 | jaegertracing/jaeger:2.1.0 |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 6 | kibana:8.16.1 |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 7 | logstash:8.16.1 |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 8 | grafana/loki:3.3.2 |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 9 | prom/node-exporter:v1.8.2 |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 10 | prom/prometheus:v3.1.0 |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 11 | prom/pushgateway:v1.10.0 |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 12 | grafana/tempo:2.6.1 |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 13 | quay.io/thanos/thanos:v0.37.2 |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 14 | openzipkin/zipkin:3.4.4 |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 15 | grafana/alloy:latest |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 16 | prom/blackbox-exporter:v0.25.0 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 17 | gcr.io/cadvisor/cadvisor:v0.52.1 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 18 | chronograf:1.10 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 19 | quay.io/cortexproject/cortex:v1.18.1 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 20 | kapacitor:1.7 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 21 | netdata/netdata:stable |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 22 | grafana/promtail:3.3.2 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 23 | statsd/statsd:v0.10.2 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 24 | telegraf:1.33-alpine |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 25 | louislam/uptime-kuma:1 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 26 | timberio/vector:0.43.0-alpine |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 27 | victoriametrics/victoria-metrics:v1.107.0 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
Scan your own monitoring and observability container¶
These grades come from ironctl scan, one credential-free command that audits any running container, docker-compose service, or Kubernetes manifest, not just the monitoring and observability images ranked above:
# install (Homebrew)
brew install ironsecco/ironclaw/ironclaw
# grade your own container the same way this page was generated
ironctl scan my-container
- All container isolation scores →, every scorecard, worst-isolated first.
- Browse every category →, the full set of ranked collection pages.
- Container Isolation Leaderboard →, the whole dataset ranked, with a Hall of Fame and worst offenders.
- Scan any container →, the full command reference.
- The State of Container Isolation, 2026 →, the survey these grades are built from.
Part of the Container Isolation Scores directory. Generated from a reproducible survey by examples/isolation-survey/gen_scorecards.py and refreshed weekly, so this ranking never goes stale. Grades reflect each image's default configuration, not a limit of the image itself: the docker run flags on each page target the gaps that grade found.