Install SigNoz on Docker for SELinux-Enforcing Hosts

Choose SigNoz Cloud for ease, or self-host for control—with the freedom to switch as your needs grow.

This guide explains how to install SigNoz on Docker on SELinux-enforcing hosts. It runs all the components SigNoz requires on a single machine, with SELinux labels applied to the configuration files Foundry mounts into the containers.

Prerequisites

A Linux host with SELinux running in enforcing mode.
Docker Engine 20.10+ (or Docker Desktop) with the Docker Compose v2 plugin.
At least 4GB of memory allocated to Docker.
Open ports: 8080 (SigNoz UI), 4317 and 4318 (OTLP ingestion).

Install SigNoz

Step 1: Install foundryctl

curl -fsSL https://signoz.io/foundry.sh | bash

For manual install (air-gapped, etc.) or PATH setup, see the foundry getting-started guide.

Step 2: Create casting.yaml

On SELinux-enforcing hosts, the configuration files Foundry mounts into the containers carry a host SELinux label that the container processes are not allowed to read, so the containers fail to start with permission-denied errors even though the file permissions look correct. The patches below relabel those mounts by appending :z for a shared SELinux label (use :Z for a private, unshared one).

Only the bind-mounted configuration files need a label: the ./…:…:ro entries. Your telemetry data lives in Docker named volumes, which Docker already manages under the correct SELinux context. Because those config mounts are read-only, the label combines as ro,z:

apiVersion: v1alpha1
kind: Installation
metadata:
  name: signoz
spec:
  deployment:
    flavor: compose
    mode: docker
  patches:
    - target: "deployment/compose.yaml"
      operations:
        - op: replace
          path: /services/ingester/volumes/0
          value: ./ingester/ingester.yaml:/etc/otel-collector-config.yaml:ro,z
        - op: replace
          path: /services/ingester/volumes/1
          value: ./ingester/opamp.yaml:/etc/opamp-config.yaml:ro,z
        - op: replace
          path: /services/signoz-telemetrykeeper-clickhousekeeper-0/volumes/1
          value: ./telemetrykeeper/clickhousekeeper/keeper-0.yaml:/etc/clickhouse-keeper/keeper.yaml:ro,z
        - op: replace
          path: /services/signoz-telemetrystore-clickhouse-0-0/volumes/2
          value: ./telemetrystore/clickhouse/config-0-0.yaml:/etc/clickhouse-server/config.yaml:ro,z
        - op: replace
          path: /services/signoz-telemetrystore-clickhouse-0-0/volumes/3
          value: ./telemetrystore/clickhouse/functions.yaml:/etc/clickhouse-server/functions.yaml:ro,z

Step 3: Deploy

foundryctl cast -f casting.yaml

cast validates Docker, generates the Compose files into pours/deployment/, and starts the containers.

cast chains Foundry's three stages:

gauge checks your environment
forge renders the Compose files into pours/ (with your SELinux labels applied) and writes casting.yaml.lock
cast starts the stack

If you prefer to manage the containers yourself, render the files with forge, inspect them, and bring the stack up with Docker Compose:

foundryctl gauge -f casting.yaml   # validate prerequisites
foundryctl forge -f casting.yaml   # generate compose files (labels included)
cd pours/deployment && docker compose up -d

Step 4: Verify the installation

Check that the containers are running:

docker ps

The output should look similar to the following:

CONTAINER ID   IMAGE                                 COMMAND                  CREATED              STATUS                        PORTS                                                             NAMES
315e746cf0ff   clickhouse/clickhouse-server:25.5.6   "/entrypoint.sh"         About a minute ago   Up About a minute (healthy)   8123/tcp, 9000/tcp, 9009/tcp                                      signoz-telemetrystore-clickhouse-0-0
066dc6f6346f   postgres:16                           "docker-entrypoint.s…"   About a minute ago   Up About a minute (healthy)   5432/tcp                                                          signoz-metastore-postgres-0
e3b456480fe4   clickhouse/clickhouse-keeper:25.5.6   "/usr/bin/clickhouse…"   About a minute ago   Up About a minute (healthy)   2181/tcp, 9181/tcp, 10181/tcp, 44444/tcp                          signoz-telemetrykeeper-clickhousekeeper-0
51f763006ae0   signoz/signoz-otel-collector:latest   "/bin/sh -c '/signoz…"   About a minute ago   Up About a minute             0.0.0.0:4317-4318->4317-4318/tcp, [::]:4317-4318->4317-4318/tcp   signoz-ingester-1
c7550a1412d4   signoz/signoz:latest                  "./signoz server"        About a minute ago   Up About a minute (healthy)   0.0.0.0:8080->8080/tcp, [::]:8080->8080/tcp                       signoz-signoz-0

Once all containers are running, point your browser to http://<IP-ADDRESS>:8080/ to access the SigNoz UI (use http://localhost:8080/ when SigNoz runs on your local machine).

Troubleshooting

A container fails with a permission-denied error

SELinux is blocking the container from reading a mounted config file. Confirm every bind-mounted config file in pours/deployment/compose.yaml ends in :ro,z (or :ro,Z). If you customized your casting, the volume indices in the patches may have shifted; re-run foundryctl forge -f casting.yaml and recheck each ./… mount's position.