Access teleport app service in external docker container via teleport node container

[gordianbahri]

I have a teleport cluster (community edition) up and running. Within this cluster, I have a Grafana Loki (a log aggregation system) instance registered as teleport app service under loki.teleport.example.com which resolves to localhost:3100 internally.

Now I'd like to send logs to it using the Grafana promtail agent within a docker container. Therefore, I set up a docker-compose.yaml with a container running teleport and a container running promtail.

My question now is how can I connect this promtail container so it is able to access loki.teleport.example.com? Do I need to tunnel the connection through the teleport-node via docker networking? How would this work?

docker-compose.yaml:

version: "3.8"

services:
  teleport-node:
    image: public.ecr.aws/gravitational/teleport-distroless:15.3.1
    volumes:
      - ./teleport.yaml:/etc/teleport/teleport.yaml
    networks:
      - teleport-network

  promtail:
    image: grafana/promtail:3.0.0
    depends_on:
      - teleport-node
    volumes:
      - ./promtail-config.yml:/etc/promtail/config.yml
      - /var/log:/var/log
    command: -config.file=/etc/promtail/config.yml
    networks:
      - teleport-network

networks:
  teleport-network:
    driver: bridge

promtail-config.yaml:

server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /tmp/positions.yaml

clients:
  - url: http://loki.teleport.example.com/loki/api/v1/push

scrape_configs:
  - job_name: system
    static_configs:
      - targets:
          - localhost
        labels:
          job: varlogs
          __path__: /var/log/*log

teleport.yaml (node):

version: v3
teleport:
  data_dir: /var/lib/teleport
  join_params:
    token_name: mytoken
    method: token
  proxy_server: teleport.example.com:443
  log:
    output: stderr
    severity: INFO
    format:
      output: text
  ca_pin: mysha
  diag_addr: ""
auth_service:
  enabled: "no"
ssh_service:
  enabled: "yes"
  commands:
    - name: hostname
      command: [hostname]
      period: 1m0s
proxy_service:
  enabled: "no"
  https_keypairs: []
  https_keypairs_reload_interval: 0s
  acme: {}