In a nutshell: Metricbeat needs access to the Docker socket to retrieve stats from it, but the docker image we ship runs as a user by default (to make it more secure). There are several ways to allow Metricbeat accessing the docker socket:
- Running as root user inside the container
- Using file system ACLs
- Adding metricbeat user to docker group, check Trouble running metricbeat:5.3.0 with docker module