1. Launch EC2 instance.
I will use t2.medium type, 2 cCPU / 4G RAM, 30G gp3 storage.

2. When the EC2 instance is ready, logon and install/configure PMM docker
sudo dnf install -y docker
sudo systemctl enable –now docker
sudo usermod -aG docker $USER (Log out and log back in for the group changes to take effect.)
docker pull percona/pmm-server:latest
docker create –name pmm-server \
-p 80:80 -p 443:443 \
-v pmm-data:/srv \
percona/pmm-server:latest
sudo docker start pmm-server

3. Now the PMM Server should be accessible at:

http://your-ec2-public-ip/
User: admin/admin

But trying http://your-ec2-public-ip/ doesn’t work. Lets try to find out what could be the reason. For this test I have the following inbound rules.
Rule Name Protocol Port Source
HTTP TCP 80 0.0.0.0/0
HTTPS TCP 443 0.0.0.0/0
SSH TCP 22 0.0.0.0/0
Of course this should not be set for production environment, it is too much, but for testing purposes it is fine, after finishing the lab all resources will be deleted.

My EC2 instance is in public subnet, there is access to/from internet. So, from the network side it should work.
Let see if curl is working for the localhost –

curl -I http://localhost
curl: (56) Recv failure: Connection reset by peer

Hm, the EC2 instance is not accepting connections on port 80 inside the instance, even locally.

sudo lsof -i -P -n | grep LISTEN | grep :80
docker-pr 28689 root 4u IPv4 72736 0t0 TCP *:80 (LISTEN)
docker-pr 28695 root 4u IPv6 72740 0t0 TCP *:80 (LISTEN)

docker inspect pmm-server –format='{{json .NetworkSettings.Ports}}’ | jq .
{
“443/tcp”: [
{
“HostIp”: “0.0.0.0”,
“HostPort”: “443”
},
{
“HostIp”: “::”,
“HostPort”: “443”
}
],
“80/tcp”: [
{
“HostIp”: “0.0.0.0”,
“HostPort”: “80”
},
{
“HostIp”: “::”,
“HostPort”: “80”
}
],
“8080/tcp”: null,
“8443/tcp”: null
}

Ok, Docker is binding port 80 correctly (both IPv4 and IPv6) – confirmed via lsof. The container is marked as healthy by Docker and the Security Groups are open. The last lines from the docker logfile (docker logs pmm-server –tail 50) is showing
2025-04-21 12:17:19,390 INFO success: qan-api2 entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
2025-04-21 12:17:20,529 INFO spawned: ‘pmm-agent’ with pid 407
2025-04-21 12:17:21,581 INFO success: pmm-agent entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
2025-04-21 12:17:21,643 INFO exited: pmm-init (exit status 0; expected)

This is also fine. Lets take a look inside the container.

docker exec -it pmm-server bash
and then from inside
docker exec -it pmm-server bash
[pmm@e39b524f3153 opt] # curl -I http://localhost
curl: (7) Failed to connect to localhost port 80: Connection refused

Great, we almost nailed it – inside the PMM container, nothing is listening on port 80. Let check the managed services inside the container –

supervisorctl status
clickhouse RUNNING pid 15, uptime 0:36:54
grafana RUNNING pid 16, uptime 0:36:54
nginx RUNNING pid 17, uptime 0:36:54
pmm-agent RUNNING pid 407, uptime 0:36:51
pmm-init EXITED Apr 21 12:17 PM
pmm-managed RUNNING pid 29, uptime 0:36:54
postgresql RUNNING pid 14, uptime 0:36:54
qan-api2 RUNNING pid 337, uptime 0:36:53
victoriametrics RUNNING pid 18, uptime 0:36:54
vmalert RUNNING pid 19, uptime 0:36:54
vmproxy RUNNING pid 23, uptime 0:36:54

nginx is indeed running inside the container — which means that
– the webserver is alive
– the container is healthy
– docker is exposing port 80 correctly