Logging

Short-lived aggregation, not log warehousing.

Loki and Promtail are used for centralized log visibility on the VM. The design goal is incident support and recent history, not long-term archival or analytics at ELK scale.

Docker containers -> Promtail -> Loki -> Grafana

Retention stays intentionally short.
Container logs are rotated before they become disk pressure.
The VM is not used as a long-term logging backend.