User-Focused Images¶

The official rsyslog image family provides layered container variants for custom builds, general-purpose forwarding, central collection, Docker log forwarding, and Vespa-oriented ETL pipelines.

Official images are built on Ubuntu LTS releases and install the latest rsyslog packages from the Adiscon daily-stable PPA. Images are tagged rsyslog/rsyslog[-<function>]:<version> where <version> follows the YYYY-MM rsyslog release.

Available variants include:

rsyslog/rsyslog-minimal – rsyslog core only.
rsyslog/rsyslog – standard image with common modules such as imhttp and omhttp.
rsyslog/rsyslog-collector – adds modules for centralized log collection, including RELP and optional TLS reception.
rsyslog/rsyslog-dockerlogs – includes imdocker to process logs from the Docker daemon.
rsyslog/rsyslog-etl – experimental image that receives syslog and forwards events to a Vespa HTTP endpoint using omhttp.
rsyslog/rsyslog-debug – planned variant with troubleshooting tools.

Images are built using the layered Makefile in packaging/docker/rsyslog:

make all
make standard
make VERSION=2025-06 minimal

Configuration snippets in each directory and environment variables allow enabling or disabling functionality at runtime. Consult the packaging/docker README for the latest details and feedback instructions.

For a complete centralized logging stack with Loki, Grafana, Prometheus, and Traefik, see ROSI Collector. ROSI Collector uses the rsyslog/rsyslog-collector image as one component inside a larger Docker Compose deployment.

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project