Graylog Podman Pod Deployment and Upgrade Guide

Containerized Log Management

This guide outlines a recommended deployment structure for running Graylog on Rocky Linux 9 using Podman pods, systemd service management, and persistent host-mounted storage. It also includes a safe, repeatable upgrade workflow for Graylog containers.

Deployment goal: keep Graylog, MongoDB, and OpenSearch grouped in a shared Podman pod while using systemd to manage lifecycle, restarts, and upgrades cleanly.

This article is part of the Infrastructure & Systems Guide and Automation and DevOps Guide clusters, where RavenHawkTech organizes practical systems administration, container operations, lifecycle management, monitoring, and repeatable infrastructure workflows.

Architecture Overview

The deployment uses a single Rocky Linux host with Podman pods to group the core Graylog services together. This keeps the services close to each other, simplifies local container networking, and makes it easier to manage the stack as one logical application.

Rocky Linux 9 host
Podman pod for container grouping
Graylog container
MongoDB container
OpenSearch container
systemd services controlling each container
Persistent storage mounted from host directories

Automation angle: This pattern works best when the directory layout, container image versions, systemd units, backups, and validation checks are documented as a repeatable runbook instead of handled as one-off shell history.

Recommended Directory Structure

Why this matters: containers should be replaceable. Storing Graylog, MongoDB, and OpenSearch data on the host keeps important data outside the container lifecycle, which makes upgrades and recovery safer.

/opt/graylog/graylog_data
/opt/graylog/mongodb_data
/opt/graylog/opensearch_data
/etc/systemd/system/

Create the Pod

Why this matters: a Podman pod lets Graylog, MongoDB, and OpenSearch share a network namespace. That allows Graylog to reach supporting services over localhost while exposing only the required ports to the host network.

podman pod create --name graylog -p 9000:9000 -p 1514:1514 -p 1514:1514/udp -p 12201:12201 -p 12201:12201/udp

Deploy MongoDB Container

Why this matters: MongoDB stores Graylog configuration and metadata.

podman run -d --name mongodb --pod graylog -v /opt/graylog/mongodb_data:/data/db:Z docker.io/library/mongo:7

Deploy OpenSearch Container

Why this matters: OpenSearch provides the searchable backend for Graylog log data.

podman run -d --name opensearch --pod graylog -e discovery.type=single-node -e OPENSEARCH_JAVA_OPTS='-Xms1g -Xmx1g' -v /opt/graylog/opensearch_data:/usr/share/opensearch/data:Z docker.io/opensearchproject/opensearch:2.19.4

Deploy Graylog Container

Why this matters: this container ties the deployment together and defines how Graylog connects to its supporting services.

podman run -d --name graylog-server --pod graylog -v /opt/graylog/graylog_data:/usr/share/graylog/data:Z -e GRAYLOG_NODE_ID_FILE=/usr/share/graylog/data/config/node-id -e GRAYLOG_HTTP_BIND_ADDRESS=0.0.0.0:9000 -e GRAYLOG_HTTP_PUBLISH_URI=http://192.168.128.140:9000/ -e GRAYLOG_HTTP_EXTERNAL_URI=http://192.168.128.140:9000/ -e GRAYLOG_ELASTICSEARCH_HOSTS=http://127.0.0.1:9200 -e GRAYLOG_MONGODB_URI=mongodb://127.0.0.1:27017/graylog docker.io/graylog/graylog:7.0.6

Graylog Upgrade Procedure

Why this matters: controlled upgrades reduce the risk of stale containers, mismatched versions, or undocumented changes that are difficult to roll back.

Before upgrading: confirm backups exist for Graylog data, MongoDB data, and OpenSearch data. Record the currently running image versions, confirm the systemd unit contents, and decide how you will roll back if the new container fails health checks.

podman pull docker.io/graylog/graylog:7.0.6

systemctl daemon-reexec
systemctl daemon-reload
systemctl restart graylog-server

podman ps --format 'table {{.Names}} {{.Image}} {{.Status}}'

Post-Upgrade Validation

Confirm the Graylog web interface loads on the expected URL.
Verify Graylog can still reach MongoDB and OpenSearch.
Confirm new log messages are being ingested.
Check container status with podman ps.
Review service health with systemctl status graylog-server.
Review recent logs before considering the upgrade complete.

Troubleshooting

Verify the correct systemd unit file with systemctl cat graylog-server.service.
Check the active image version with systemctl show graylog-server.service -p ExecStart.
Confirm the running container image using podman inspect graylog-server.
Use podman logs graylog-server to verify startup and version information.

Best Practices

Keep persistent data directories outside containers.
Back up MongoDB and Graylog data before upgrades.
Validate OpenSearch cluster health before upgrades.
Use pinned image versions instead of latest tags.
Use systemctl instead of the legacy service command.
Document the tested upgrade and rollback sequence as part of the operational runbook.