From 3d8cd7ba19bf6c3ece57831d7905778ca5d5f720 Mon Sep 17 00:00:00 2001
From: Sam <sam@noctools.nz>
Date: Sat, 10 Oct 2026 20:03:22 +0000
Subject: [PATCH] --docker flag: enable agent2 docker plugin (socket access via
 docker group)

---
 README.md                       | 10 +++++++++
 install-zabbix-agent2-ubuntu.sh | 37 ++++++++++++++++++++++++++++++++-
 2 files changed, 46 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 7e984e2..ec5a53d 100644
--- a/README.md
+++ b/README.md
@@ -15,6 +15,7 @@ works behind NAT/firewalls and needs no inbound ports.
 # clone once, then git pull for updates:
 git clone https://gitea.noctools.nz/noctools/zabbix-agent.git
 sudo ./install-zabbix-agent2-ubuntu.sh --server <server-ip-or-name>
+sudo ./install-zabbix-agent2-ubuntu.sh --server <server-ip-or-name> --docker   # + docker monitoring
 ```
 
 Or with no local copy at all:
@@ -30,9 +31,18 @@ curl -fsSL https://gitea.noctools.nz/noctools/zabbix-agent/raw/branch/main/insta
 |---|---|---|
 | `--server HOST[:PORT]` | Zabbix server/proxy for active checks (**required**) | — |
 | `--hostname NAME` | Zabbix host name — must equal the technical name on the server | short system hostname |
+| `--docker` | enable the agent2 docker plugin: grants the `zabbix` user access to `/var/run/docker.sock` via the `docker` group (Docker must already be installed) | off |
 | `--major X.Y` | Zabbix repo series | `7.4` |
 
 After installing, create the host on the Zabbix server with the **exact same
 technical name** and an active-agent template (e.g. "Linux by Zabbix agent
 active"). The script reports whether the agent reached the server and warns
 if the host doesn't exist yet — the warning clears by itself once it does.
+
+## Docker monitoring
+
+`--docker` has the agent talk to `/var/run/docker.sock` (adds the `zabbix`
+user to the `docker` group). On the Zabbix server, link the host to a Docker
+template that uses **active** checks — e.g. "Docker by Zabbix agent 2 active"
+(where present) — since agents installed by this script are reached via
+active checks only.
diff --git a/install-zabbix-agent2-ubuntu.sh b/install-zabbix-agent2-ubuntu.sh
index 68a56a7..ff25640 100755
--- a/install-zabbix-agent2-ubuntu.sh
+++ b/install-zabbix-agent2-ubuntu.sh
@@ -16,6 +16,7 @@
 #   sudo ./install-zabbix-agent2-ubuntu.sh --server 203.0.113.10
 #   sudo ./install-zabbix-agent2-ubuntu.sh --server 203.0.113.10:10051 --hostname web01
 #   sudo ./install-zabbix-agent2-ubuntu.sh web01 --server 203.0.113.10   # positional hostname
+#   sudo ./install-zabbix-agent2-ubuntu.sh --server 203.0.113.10 --docker # + docker monitoring
 #
 # One-liner (no local copy needed):
 #   curl -fsSL <repo-url>/install-zabbix-agent2-ubuntu.sh | sudo bash -s -- --server 203.0.113.10
@@ -35,12 +36,16 @@ say() { echo "[zabbix-agent2] $*"; }
 die() { echo "[zabbix-agent2] ERROR: $*" >&2; exit 1; }
 usage() {
     cat <<EOF
-usage: sudo $0 --server HOST[:PORT] [--hostname NAME] [--major X.Y]
+usage: sudo $0 --server HOST[:PORT] [--hostname NAME] [--docker] [--major X.Y]
 
   --server HOST[:PORT]   required — Zabbix server/proxy for active checks
                          (IP or DNS name; port defaults to 10051)
   --hostname NAME        Zabbix host name (default: short system hostname;
                          MUST equal the technical host name on the server)
+  --docker               also enable the agent2 docker plugin: grants the
+                         'zabbix' user read access to /var/run/docker.sock
+                         via the 'docker' group. Docker must already be
+                         installed. Link a docker template server-side.
   --major X.Y            Zabbix major version from the official repo
                          (default: ${ZABBIX_MAJOR}; use your server's version)
   NAME (positional)      shorthand for --hostname NAME
@@ -50,10 +55,12 @@ EOF
 # ---- args --------------------------------------------------------------------
 SERVER_RAW=""
 HOSTNAME_ARG=""
+DOCKER=0
 while [ $# -gt 0 ]; do
     case "$1" in
         --server)        SERVER_RAW="${2:?}"; shift 2 ;;
         -n|--hostname)   HOSTNAME_ARG="${2:?}"; shift 2 ;;
+        --docker)        DOCKER=1; shift ;;
         --major)         ZABBIX_MAJOR="${2:?}"; shift 2 ;;
         -h|--help)       tail -n +2 "$0" | grep '^#' | sed 's/^# \{0,1\}//'; exit 0 ;;
         *)               HOSTNAME_ARG="$1"; shift ;;
@@ -116,6 +123,33 @@ set_conf "$CONF" ServerActive "$SA_ADDR"
 set_conf "$CONF" Server       "127.0.0.1,${SA_HOST}"
 set_conf "$CONF" Hostname     "$ZBX_HOSTNAME"
 
+# ---- 2b. optional: docker monitoring (agent2 docker plugin) -------------------
+DOCKER_STATUS="not requested"
+if [ "$DOCKER" = "1" ]; then
+    # The plugin talks to the docker UNIX socket; the agent runs as 'zabbix'.
+    # Socket access = membership in the 'docker' group (docker's own group).
+    getent group docker >/dev/null || die "--docker: no 'docker' group — Docker is not installed; install Docker first, then re-run"
+    usermod -aG docker zabbix
+    DOCKER_STATUS="enabled"
+    say "docker monitoring: 'zabbix' user added to 'docker' group"
+    if [ -S /var/run/docker.sock ]; then
+        if runuser -u zabbix -- test -r /var/run/docker.sock; then
+            say "docker monitoring: socket readable by 'zabbix'"
+        else
+            say "WARNING: zabbix still cannot read /var/run/docker.sock — check its group/permissions (should be root:docker 0660)"
+        fi
+    else
+        say "WARNING: /var/run/docker.sock does not exist — is the docker daemon running? Items will fail until it is"
+    fi
+    # Local end-to-end test of the plugin as the agent user (after the service
+    # restart below, the agent picks up the new group and can do the same).
+    PING="$(runuser -u zabbix -- zabbix_agent2 -t docker.ping 2>/dev/null || true)"
+    case "$PING" in
+        *1*) say "docker monitoring: docker.ping OK as 'zabbix'" ;;
+        *)   say "note: docker.ping did not answer locally yet (daemon down? access?) — see warning above" ;;
+    esac
+fi
+
 # ---- 3. service + sanity -------------------------------------------------------
 systemctl enable zabbix-agent2 >/dev/null
 systemctl restart zabbix-agent2
@@ -136,6 +170,7 @@ done
 echo
 say "done. config:"
 grep -E '^(Server|ServerActive|Hostname)=' "$CONF" | sed 's/^/    /'
+say "docker monitoring: ${DOCKER_STATUS}"
 if [ -n "$WARN" ]; then
     say "WARNING: agent cannot fetch its config yet:"
     if [ -r "$LOG" ]; then tail -n 4 "$LOG" | sed 's/^/    /'