To be honest I never even used plugins except the SSHFS plugin which is still mentioned in the engine plugin documentation, but that plugin is already archived since 2022. So I wasn’t sure how plugins were running, but plugins are running in containers. There is a debugging guide in the documentation that explains how you can list plugin containers. Then if you know how to use runc, you can also find everything about the plugin, including how it sees the network and what certificates it is using.
The below command (as root) would for example list the ca-certificates folder inside the plugin’s container
nsenter --all -t $(
runc --root /run/docker/runtime-runc/plugins.moby list \
| grep $(\
docker plugin list --no-trunc \
| grep loki \
| awk '{print $1}' \
) | awk '{print $2}' \
) \
-- ls -la /usr/share/ca-certificates
# or
# -- ls -la /usr/local/share/ca-certificates
# or
# -- ls -la /etc/ca-certificates
But you can also get a shell in it:
nsenter --all -t $(
runc --root /run/docker/runtime-runc/plugins.moby list \
| grep $(\
docker plugin list --no-trunc \
| grep loki \
| awk '{print $1}' \
) | awk '{print $2}' \
) \
-- sh
To shorten it, you can add it to a function
function loki() {
nsenter --all -t $(
runc --root /run/docker/runtime-runc/plugins.moby list \
| grep $(\
docker plugin list --no-trunc \
| grep loki \
| awk '{print $1}' \
) | awk '{print $2}' \
) -- "$@";
}
Then just use
loki ls -la /usr/local/share/ca-certificates
curl is not in the “loki” plugin container, only wget, but you can install curl in it after you got a shell first or using the function directly:
loki apk add curl
Then you can test what the plugin sees. I don’t know exactly how the CA certificates should be added, but the ca bundle file can be read this way:
loki cat /etc/ssl/certs/ca-certificates.crt
Other files in the same folder are symbolic links to the files in the previously mentioned folder.
Grafana also shared the source code of this plugin
In the config.go file we can find the parameters if not in any documentation (I couldn’t)
So it looks like it supports settingthe CA file. At this point I’m still not sure how the plugin would see it, but you can try to set the “loki-tls-ca-file” config parameter as a log option to an absolute path as described here for other options: