diff --git a/passwords/docker-compose.yml b/passwords/docker-compose.yml
index dc58419..0c90afd 100644
--- a/passwords/docker-compose.yml
+++ b/passwords/docker-compose.yml
@@ -33,6 +33,19 @@ services:
     networks:
       - pass-net
 
+  promtail:
+    image: grafana/promtail:latest
+    container_name: promtail
+    volumes:
+      - /var/log:/var/log:ro
+      - /var/lib/docker/containers:/var/lib/docker/containers:ro
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./promtail/config.yml:/etc/promtail/config.yml
+    command: -config.file=/etc/promtail/config.yml
+    restart: unless-stopped
+    networks:
+      - pass-net
+
 networks:
   pass-net:
     driver: bridge
\ No newline at end of file
diff --git a/passwords/promtail/config.yml b/passwords/promtail/config.yml
new file mode 100644
index 0000000..73af1a9
--- /dev/null
+++ b/passwords/promtail/config.yml
@@ -0,0 +1,31 @@
+server:
+  http_listen_port: 9080
+  grpc_listen_port: 0
+
+positions:
+  filename: /tmp/positions.yaml
+
+clients:
+  # Use the Tailscale IP of VM1 here
+  - url: http://100.80.179.128:3100/loki/api/v1/push
+
+scrape_configs:
+  - job_name: system
+    static_configs:
+    - targets:
+        - localhost
+      labels:
+        job: varlogs
+        host: cloud-passwords  # Update this to vm3, vm4, etc.
+        __path__: /var/log/*log
+
+  - job_name: docker
+    docker_sd_configs:
+      - host: unix:///var/run/docker.sock
+    relabel_configs:
+      - source_labels: ['__meta_docker_container_name']
+        regex: '/(.*)'
+        target_label: 'container'
+      - source_labels: ['__meta_docker_container_name']
+        target_label: 'host'
+        replacement: 'cloud-passwords' # Update this to vm3, vm4, etc.
\ No newline at end of file