groups:
  - name: docker_container_health
    interval: 60s
    rules:
      - alert: DockerContainerUnhealthy
        expr: docker_container_health_status{status="unhealthy"} == 1
        for: 5m
        labels:
          severity: high
        annotations:
          summary: "Container {{ $labels.container }} on {{ $labels.host }} is unhealthy"
          description: "Docker healthcheck reports unhealthy for more than 5 minutes."

      - alert: DockerContainerOOMKilled
        expr: docker_container_oom_killed == 1
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "Container {{ $labels.container }} on {{ $labels.host }} was OOM killed"
          description: "Container was killed by the OOM killer. Consider increasing memory limit."

      - alert: DockerContainerRestartLoop
        expr: increase(docker_container_restart_count_total[1h]) > 3
        for: 5m
        labels:
          severity: high
        annotations:
          summary: "Container {{ $labels.container }} on {{ $labels.host }} restarting frequently ({{ $value | humanize }} in 1h)"
          description: "Container has restarted more than 3 times in the last hour. Check container logs for persistent crashes."

      - alert: DockerContainerLogBloat
        expr: docker_container_log_size_bytes > 100 * 1024 * 1024
        for: 1h
        labels:
          severity: medium
        annotations:
          summary: "Container {{ $labels.container }} on {{ $labels.host }} log > 100MB"
          description: "Container log file is {{ $value | humanize }}. Configure log rotation or truncate."

