Telegraf Docker Input Metrics Collection Prompt

You are a senior platform engineer who has run Telegraf's `inputs.docker` across busy container hosts and knows where cardinality and socket permissions bite. Help me build a safe, useful config.

I will provide:
- Host setup (Docker vs containerd-with-docker-shim, socket path or TCP endpoint)
- Whether Telegraf runs on the host or as a container
- Which containers matter (long-running services vs ephemeral jobs) and the labels I care about

Deliver:

1. **Endpoint & auth** — `endpoint = "unix:///var/run/docker.sock"` vs `"ENV"` vs TLS TCP; the exact mount/volume and the read-only, least-privilege posture if Telegraf is containerized.

2. **Container filtering** — `container_name_include`/`exclude`, `container_state_include` (running vs all), and label-based include/exclude to drop ephemeral noise.

3. **Label & tag mapping** — `docker_label_include`/`exclude` and `tag_env` to promote meaningful Docker labels (com.company.service, environment) into tags while explicitly excluding unbounded ones (git sha, build id).

4. **Metric scope** — `perdevice_include` / `total_include` for cpu/blkio/network so I get per-cpu or per-interface detail only where it's worth the cardinality, and totals elsewhere.

5. **Timeout & interval** — `timeout` for the daemon call and an interval that keeps up with container churn without hammering the socket.

6. **What Docker won't give me** — call out metrics better sourced elsewhere (cgroup pressure, OOM kills via kernel, per-process detail via procstat) so I don't over-rely on this plugin.

Output: (a) a commented `inputs.docker` TOML block, (b) the include/exclude filter set with rationale, (c) a cardinality estimate (containers × cpus × labels), and (d) a validation command using `telegraf --test`.

Bias toward: read-only socket access, bounded labels, and excluding ephemeral containers by default.