agent docs: Linux agent monitors Docker containers

src/content/docs/docs/kloudmate-agent/auto-instrumentation/dotnet.mdx

@@ -73,7 +73,7 @@ On Amazon ECS, the agent injects the .NET instrumentation into the services you
 
 ## On Docker
 
-When the agent runs in Docker mode, eBPF traces your .NET containers per service through the **Off / eBPF** toggle in Discovered Services, with no code change and no restart.
+When the agent monitors Docker containers, whether in Docker mode or as a Linux service on a Docker host, eBPF traces your .NET containers per service through the **Off / eBPF** toggle in Discovered Services, with no code change and no restart.
 
 The agent can't inject the in-process SDK into a running container, so SDK mode isn't offered for containers. For full SDK depth, add OpenTelemetry to your image yourself and point it at the KloudMate agent's OTLP endpoint. See [Docker platform notes](../../platform-notes/docker/) for the endpoint addresses. On Windows, systemd, Kubernetes, or Amazon ECS, the agent injects the profiler for you instead.
 

src/content/docs/docs/kloudmate-agent/auto-instrumentation/java.mdx

@@ -52,7 +52,7 @@ On Amazon ECS, the agent injects the OpenTelemetry Java agent into the services
 
 ## On Docker
 
-When the agent runs in Docker mode, eBPF traces your Java containers per service through the **Off / eBPF** toggle in Discovered Services, with no code change and no restart.
+When the agent monitors Docker containers, whether in Docker mode or as a Linux service on a Docker host, eBPF traces your Java containers per service through the **Off / eBPF** toggle in Discovered Services, with no code change and no restart.
 
 The agent can't inject the in-process SDK into a running container, so SDK mode isn't offered for containers. For full SDK depth, add the OpenTelemetry Java agent to your image yourself and point it at the KloudMate agent's OTLP endpoint. See [Docker platform notes](../../platform-notes/docker/) for the endpoint addresses. On systemd, Kubernetes, or Amazon ECS, the agent injects the Java agent for you instead.
 

src/content/docs/docs/kloudmate-agent/auto-instrumentation/nodejs.mdx

@@ -43,7 +43,7 @@ On Amazon ECS, the agent injects the Node.js instrumentation into the services y
 
 ## On Docker
 
-When the agent runs in Docker mode, eBPF traces your Node.js containers per service through the **Off / eBPF** toggle in Discovered Services, with no code change and no restart.
+When the agent monitors Docker containers, whether in Docker mode or as a Linux service on a Docker host, eBPF traces your Node.js containers per service through the **Off / eBPF** toggle in Discovered Services, with no code change and no restart.
 
 The agent can't inject the in-process SDK into a running container, so SDK mode isn't offered for containers. For full SDK depth, add OpenTelemetry to your image yourself and point it at the KloudMate agent's OTLP endpoint. See [Docker platform notes](../../platform-notes/docker/) for the endpoint addresses. On systemd, Kubernetes, or Amazon ECS, the agent injects the instrumentation for you instead.
 

src/content/docs/docs/kloudmate-agent/auto-instrumentation/php.mdx

@@ -19,7 +19,9 @@ When you instrument a PHP service, the agent adds a config file for the target's
 
 ## On Docker
 
-In Docker mode, the agent instruments PHP containers automatically, in place, and matches the container's PHP build. It reloads the SAPI (Apache graceful or php-fpm) with no redeploy, so this is separate from the **Off / eBPF** toggle. Narrow or turn it off with the `KM_CONTAINER_INSTRUMENT_*` environment variables. The instrumented application sends traces to the agent through the container's host gateway.
+A PHP container offers an **SDK** option in Discovered Services. Turn it on and the agent injects the tracer, matches it to the container's PHP build, and reloads the web server (Apache graceful or php-fpm) with no redeploy and no container restart. The instrumented application sends traces to the agent through the container's host gateway.
+
+This SDK option is on by default in Docker mode. On a Linux host agent it's opt-in: set `KM_CONTAINER_INSTRUMENT_ENABLED=true`. To instrument PHP containers automatically without picking each one, use `KM_CONTAINER_INSTRUMENT_ALL`, `KM_CONTAINER_INSTRUMENT_NAMES`, or `KM_CONTAINER_INSTRUMENT_IMAGES`.
 
 The built-in PHP server (`php -S`) and Alpine (musl) images aren't supported: the built-in server has no graceful reload, and the bundled tracer assets target glibc. For the details, including the PHP 7 build-time recipe, see [Docker platform notes](../../platform-notes/docker/).
 

src/content/docs/docs/kloudmate-agent/auto-instrumentation/python.mdx

@@ -43,7 +43,7 @@ On Amazon ECS, the agent injects the Python instrumentation into the services yo
 
 ## On Docker
 
-When the agent runs in Docker mode, eBPF traces your Python containers per service through the **Off / eBPF** toggle in Discovered Services, with no code change and no restart.
+When the agent monitors Docker containers, whether in Docker mode or as a Linux service on a Docker host, eBPF traces your Python containers per service through the **Off / eBPF** toggle in Discovered Services, with no code change and no restart.
 
 The agent can't inject the in-process SDK into a running container, so SDK mode isn't offered for containers. For full SDK depth, add OpenTelemetry to your image yourself and point it at the KloudMate agent's OTLP endpoint. See [Docker platform notes](../../platform-notes/docker/) for the endpoint addresses. On systemd, Kubernetes, or Amazon ECS, the agent injects the instrumentation for you instead.
 

src/content/docs/docs/kloudmate-agent/baseline/host-metrics-and-logs.mdx

@@ -11,13 +11,14 @@ Host metrics and logs are what the agent collects automatically, with no setup.
 
 ## What flows automatically
 
-What the agent collects depends on the deployment mode, because each platform exposes host telemetry differently.
+What the agent collects depends on the deployment mode, because each platform exposes host telemetry differently. Container telemetry is the exception: on any host with a Docker socket, container metrics and logs are collected automatically, whether the agent runs as a Linux service or in Docker mode.
 
 <Tabs>
 <TabItem label="Linux">
 
 - **Host metrics:** CPU, memory, disk, network, and process metrics.
 - **Logs:** none are collected from the host automatically. Add application log files with [log monitoring](../../log-monitoring/), or the systemd journal with a [custom config override](../../custom-config-override/).
+- **Docker containers:** if the host runs Docker, per-container metrics and logs are collected automatically, the same as in Docker mode. See [Monitor Docker containers on the host](../../installation/linux-agent/#monitor-docker-containers-on-the-host).
 
 </TabItem>
 <TabItem label="Windows">

src/content/docs/docs/kloudmate-agent/ebpf-observability.mdx

@@ -24,6 +24,8 @@ When eBPF monitoring is active, the agent collects:
 
 Because eBPF observes traffic in the kernel, it can trace a service with no code change and no restart — including Go and other services no language agent can inject. eBPF RED metrics and trace spans are a per-service choice you turn on (the **eBPF** APM mode); the network topology map and database activity monitoring run automatically. When a service also runs application APM, its eBPF spans and the application spans share the same trace, so hops you haven't put on the SDK still appear in end-to-end traces. See the [Application APM overview](../auto-instrumentation/overview/).
 
+On a host running Docker, the agent reads each container's name and listen ports from the Docker socket, so a container can be traced with eBPF the same way a host process can, whether the agent runs as a Linux service or in Docker mode. In **Discovered Services** a container offers **Off** or **eBPF**, because the agent can't attach an in-process SDK to a running container. PHP containers can also offer an **SDK** option that injects a tracer with no redeploy. See [Docker platform notes](../platform-notes/docker/).
+
 ## Deployment modes and requirements
 
 eBPF applies on **Linux, Kubernetes, and Docker**. It does **not** apply on **Windows**, which has no eBPF equivalent; on Windows the agent provides a comparable monitoring through Event Tracing for Windows (ETW) instead. See [Windows platform notes](../platform-notes/windows/).

src/content/docs/docs/kloudmate-agent/index.mdx

@@ -51,7 +51,7 @@ The agent runs across four deployment modes. Not every capability applies to eve
 | Agent health and self-logs | Yes | Yes | Yes | Yes |
 
 :::note
-On Linux, eBPF monitoring needs kernel 4.14 or newer, and does more on 5.8 and above. On Docker, host and container metrics and logs are automatic; application tracing is opt-in per service (Off / eBPF). PHP containers are traced in place without a redeploy, and Java, Node.js, Python, and .NET use eBPF (no SDK injection on Docker). See [Docker platform notes](platform-notes/docker/).
+On Linux, eBPF monitoring needs kernel 4.14 or newer, and does more on 5.8 and above. On any host with a Docker socket, container metrics and logs are collected automatically, whether the agent runs as a Linux service or in Docker mode. Container tracing is opt-in per service: **Off** or **eBPF**, plus an **SDK** option for PHP containers that traces without a redeploy. See [Docker platform notes](platform-notes/docker/).
 :::
 
 ## Install the agent

src/content/docs/docs/kloudmate-agent/installation/docker-agent.mdx

@@ -83,7 +83,7 @@ For a hand-written `filelog` receiver in manual mode, see [Collect File Logs wit
 
 ## Coverage and configuration
 
-In Docker mode, the agent collects host and container metrics and container and host logs, and, where the host kernel supports it, places your containers on the service map from [eBPF](../../ebpf-observability/) network flows — with no code changes. Application tracing is opt-in per service: set a container to **eBPF** for RED metrics and spans (no restart), or leave it **Off**. PHP containers are the exception — the agent instruments them in place, no redeploy. Java, Node.js, Python, and .NET use eBPF; SDK injection isn't available on Docker. See [Docker platform notes](../../platform-notes/docker/) for the per-runtime detail.
+In Docker mode, the agent collects host and container metrics and container and host logs, and, where the host kernel supports it, places your containers on the service map from [eBPF](../../ebpf-observability/) network flows, with no code changes. Application tracing is opt-in per service: set a container to **eBPF** for RED metrics and spans (no restart), or leave it **Off**. Java, Node.js, Python, .NET, and Go containers can't take the in-process SDK, so they use eBPF. PHP containers are the exception: they also offer an **SDK** option that injects the tracer and reloads the web server, with no redeploy. See [Docker platform notes](../../platform-notes/docker/) for the per-runtime detail.
 
 New agents start in managed mode, so KloudMate generates the collector configuration for you. See the [configuration model](../../concepts/config-model/).
 

src/content/docs/docs/kloudmate-agent/installation/linux-agent.mdx

@@ -25,6 +25,7 @@ Key capabilities:
 - Tracking performance trends over time
 - Detecting resource bottlenecks
 - Collecting and analyzing system and application logs
+- Monitoring Docker containers on the host, when Docker is present
 - Visualizing data with dashboards
 - Creating alerts for critical conditions
 
@@ -81,6 +82,16 @@ To collect your own application log **files**, use log monitoring. In the agent'
 
 For a hand-written `filelog` receiver in manual mode, see [Collect File Logs with KloudMate Agent](../../../logs/collect-file-logs/).
 
+## Monitor Docker containers on the host
+
+If the host runs Docker, the agent finds the Docker socket and starts collecting **container metrics and container logs** on its own, the same telemetry a Docker-mode agent collects. This happens as soon as the agent starts, before and independent of application tracing. To turn it off, set `KM_DOCKER_STATS=false` for metrics or `KM_DOCKER_LOGS=false` for logs.
+
+Each container also shows up in **Discovered Services**, where you can turn on per-container tracing. Most containers offer **Off** or **eBPF**: eBPF captures RED metrics and trace spans in the kernel, with no code change and no restart. There's no in-process **SDK** option for them, because the agent can't change a running container's start-time environment. Host processes that aren't containerized still offer **Off**, **eBPF**, or **SDK**.
+
+PHP containers are the exception: they can take an **SDK** option that injects the tracer and reloads the web server (Apache or php-fpm), with no redeploy and no container restart. On a Linux host this is opt-in. Set `KM_CONTAINER_INSTRUMENT_ENABLED=true`, and PHP containers start offering **SDK** in Discovered Services. In Docker mode that option is on by default.
+
+For monitoring containers, a Linux service and a Docker-mode agent are equivalent. Choose between them by how you want to run the agent, not by what they can see. See [Docker mode vs the Linux agent](../../platform-notes/docker/#docker-mode-vs-the-linux-agent).
+
 ## Configuration and next checks
 
 New agents start in **managed mode**, with a default of host metrics and eBPF monitoring. You review and change what is collected from the web interface, without editing files on the host. See the [configuration model](../../concepts/config-model/).