diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 722fa5da14cf..af1b2c0406ad 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -240,6 +240,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix panic due to unhandled DeletedFinalStateUnknown in k8s OnDelete {pull}23419[23419]
 - Fix error loop with runaway CPU use when the Kafka output encounters some connection errors {pull}23484[23484]
 - Allow configuring credential_profile_name and shared_credential_file when using role_arn. {pull}24174[24174]
+- Fix issue discovering docker containers and metadata after reconnections {pull}24318[24318]
+- Allow cgroup self-monitoring to see alternate `hostfs` paths {pull}24334[24334]
 
 *Auditbeat*
 
diff --git a/libbeat/cmd/instance/beat.go b/libbeat/cmd/instance/beat.go
index 09631337c004..b4c8dae9d89c 100644
--- a/libbeat/cmd/instance/beat.go
+++ b/libbeat/cmd/instance/beat.go
@@ -44,6 +44,7 @@ import (
 	"github.com/elastic/beats/v7/libbeat/cloudid"
 	"github.com/elastic/beats/v7/libbeat/cmd/instance/metrics"
 	"github.com/elastic/beats/v7/libbeat/common"
+	"github.com/elastic/beats/v7/libbeat/common/cfgwarn"
 	"github.com/elastic/beats/v7/libbeat/common/file"
 	"github.com/elastic/beats/v7/libbeat/common/reload"
 	"github.com/elastic/beats/v7/libbeat/common/seccomp"
@@ -1083,13 +1084,22 @@ func initPaths(cfg *common.Config) error {
 	// the paths field. After we will unpack the complete configuration and keystore reference
 	// will be correctly replaced.
 	partialConfig := struct {
-		Path paths.Path `config:"path"`
+		Path   paths.Path `config:"path"`
+		Hostfs string     `config:"system.hostfs"`
 	}{}
 
+	if paths.IsCLISet() {
+		cfgwarn.Deprecate("8.0.0", "This flag will be removed in the future and replaced by a config value.")
+	}
+
 	if err := cfg.Unpack(&partialConfig); err != nil {
 		return fmt.Errorf("error extracting default paths: %+v", err)
 	}
 
+	// Read the value for hostfs as `system.hostfs`
+	// In the config, there is no `path.hostfs`, as we're merely using the path struct to carry the hostfs variable.
+	partialConfig.Path.Hostfs = partialConfig.Hostfs
+
 	if err := paths.InitPaths(&partialConfig.Path); err != nil {
 		return fmt.Errorf("error setting default paths: %+v", err)
 	}
diff --git a/libbeat/cmd/instance/metrics/metrics.go b/libbeat/cmd/instance/metrics/metrics.go
index fb3a61078c47..f47bf59a335f 100644
--- a/libbeat/cmd/instance/metrics/metrics.go
+++ b/libbeat/cmd/instance/metrics/metrics.go
@@ -29,6 +29,7 @@ import (
 	"github.com/elastic/beats/v7/libbeat/metric/system/cpu"
 	"github.com/elastic/beats/v7/libbeat/metric/system/process"
 	"github.com/elastic/beats/v7/libbeat/monitoring"
+	"github.com/elastic/beats/v7/libbeat/paths"
 	"github.com/elastic/gosigar/cgroup"
 )
 
@@ -285,6 +286,7 @@ func reportBeatCgroups(_ monitoring.Mode, V monitoring.Visitor) {
 	}
 
 	cgroups, err := cgroup.NewReaderOptions(cgroup.ReaderOptions{
+		RootfsMountpoint:         paths.Paths.Hostfs,
 		IgnoreRootCgroups:        true,
 		CgroupsHierarchyOverride: os.Getenv(libbeatMonitoringCgroupsHierarchyOverride),
 	})
diff --git a/libbeat/cmd/root.go b/libbeat/cmd/root.go
index b748225fa924..879da55004ef 100644
--- a/libbeat/cmd/root.go
+++ b/libbeat/cmd/root.go
@@ -93,6 +93,7 @@ func GenRootCmdWithSettings(beatCreator beat.Creator, settings instance.Settings
 	rootCmd.PersistentFlags().AddGoFlag(flag.CommandLine.Lookup("path.data"))
 	rootCmd.PersistentFlags().AddGoFlag(flag.CommandLine.Lookup("path.logs"))
 	rootCmd.PersistentFlags().AddGoFlag(flag.CommandLine.Lookup("path.home"))
+	rootCmd.PersistentFlags().AddGoFlag(flag.CommandLine.Lookup("system.hostfs"))
 	rootCmd.PersistentFlags().AddGoFlag(flag.CommandLine.Lookup("strict.perms"))
 	if f := flag.CommandLine.Lookup("plugin"); f != nil {
 		rootCmd.PersistentFlags().AddGoFlag(f)
diff --git a/libbeat/docs/command-reference.asciidoc b/libbeat/docs/command-reference.asciidoc
index 3c393a3d332b..fbce53a84215 100644
--- a/libbeat/docs/command-reference.asciidoc
+++ b/libbeat/docs/command-reference.asciidoc
@@ -704,12 +704,10 @@ the end of the file is reached. By default harvesters are closed after
 `close_inactive` is reached.
 endif::[]
 
-ifeval::["{beatname_lc}"=="metricbeat"]
 *`--system.hostfs MOUNT_POINT`*::
 
-Specifies the mount point of the host's filesystem for use in monitoring a host
-from within a container.
-endif::[]
+Specifies the mount point of the host's filesystem for use in monitoring a host.
+
 
 ifeval::["{beatname_lc}"=="packetbeat"]
 *`-t`*::
diff --git a/libbeat/docs/shared-path-config.asciidoc b/libbeat/docs/shared-path-config.asciidoc
index e6264dbca6f1..36186585eaa5 100644
--- a/libbeat/docs/shared-path-config.asciidoc
+++ b/libbeat/docs/shared-path-config.asciidoc
@@ -106,3 +106,20 @@ Example:
 ------------------------------------------------------------------------------
 path.logs: /var/log/beats
 ------------------------------------------------------------------------------
+
+[float]
+==== `system.hostfs`
+
+Specifies the mount point of the host's filesystem for use in monitoring a host.
+This can either be set in the config, or with the `--system.hostfs` CLI flag. This is used for cgroup self-monitoring.
+ifeval::["{beatname_lc}"=="metricbeat"]
+This is also used by the system module to read files from `/proc` and `/sys`.
+endif::[]
+
+
+Example:
+
+[source,yaml]
+------------------------------------------------------------------------------
+path.logs: /var/log/beats
+------------------------------------------------------------------------------
\ No newline at end of file
diff --git a/libbeat/paths/paths.go b/libbeat/paths/paths.go
index 6e33940dc08a..25fbf2697e69 100644
--- a/libbeat/paths/paths.go
+++ b/libbeat/paths/paths.go
@@ -28,6 +28,8 @@
 //
 // path.config - Configuration files and Elasticsearch template default location
 //
+// system.hostfs - supplies an alternate filesystem root for containerized environments
+//
 // These settings can be set via the configuration file or via command line flags.
 // The CLI flags overwrite the configuration file options.
 //
@@ -38,16 +40,25 @@
 package paths
 
 import (
+	"flag"
 	"fmt"
 	"os"
 	"path/filepath"
 )
 
+var (
+	// TODO: remove this flag in 8.0 since it should be replaced by system.hostfs configuration option (config.HostFS)
+	// HostFS is an alternate mountpoint for the filesytem root, for when metricbeat is running inside a container.
+	hostFS = flag.String("system.hostfs", "", "Mount point of the host's filesystem for use in monitoring a host from within a container")
+)
+
+// Path tracks user-configurable path locations and directories
 type Path struct {
 	Home   string
 	Config string
 	Data   string
 	Logs   string
+	Hostfs string
 }
 
 // FileType is an enumeration type representing the file types.
@@ -55,10 +66,19 @@ type Path struct {
 type FileType string
 
 const (
-	Home   FileType = "home"
+	// Home is the "root" directory for the running beats instance
+	Home FileType = "home"
+	// Config is the path to the beat config
 	Config FileType = "config"
-	Data   FileType = "data"
-	Logs   FileType = "logs"
+	// Data is the path to the beat data directory
+	Data FileType = "data"
+	// Logs is the path to the beats logs directory
+	Logs FileType = "logs"
+	// Hostfs is an alternate path to the filesystem root,
+	// used for system metrics that interact with procfs and sysfs.
+	// Unlike the other values here, this corrisponds to `system.hostfs`
+	// and not `path.hostfs`.
+	Hostfs FileType = "hostfs"
 )
 
 // Paths is the Path singleton on which the top level functions from this
@@ -115,15 +135,31 @@ func (paths *Path) initPaths(cfg *Path) error {
 		paths.Logs = filepath.Join(paths.Home, "logs")
 	}
 
+	if *hostFS != "" {
+		paths.Hostfs = *hostFS
+	}
+
+	if paths.Hostfs == "" {
+		paths.Hostfs = "/"
+	}
+
 	return nil
 }
 
+// IsCLISet returns true if the CLI system.hostfs value has been set
+func IsCLISet() bool {
+	if *hostFS != "" {
+		return true
+	}
+	return false
+}
+
 // Resolve resolves a path to a location in one of the default
 // folders. For example, Resolve(Home, "test") returns an absolute
 // path for "test" in the home path.
 func (paths *Path) Resolve(fileType FileType, path string) string {
-	// absolute paths are not changed
-	if filepath.IsAbs(path) {
+	// absolute paths are not changed for non-hostfs file types, since hostfs is a little odd
+	if filepath.IsAbs(path) && fileType != Hostfs {
 		return path
 	}
 
@@ -136,6 +172,8 @@ func (paths *Path) Resolve(fileType FileType, path string) string {
 		return filepath.Join(paths.Data, path)
 	case Logs:
 		return filepath.Join(paths.Logs, path)
+	case Hostfs:
+		return filepath.Join(paths.Hostfs, path)
 	default:
 		panic(fmt.Sprintf("Unknown file type: %s", fileType))
 	}
diff --git a/metricbeat/module/system/diskio/diskio_test.go b/metricbeat/module/system/diskio/diskio_test.go
index b5494ac4bfe2..f157f5fcf124 100644
--- a/metricbeat/module/system/diskio/diskio_test.go
+++ b/metricbeat/module/system/diskio/diskio_test.go
@@ -26,16 +26,23 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
+	"github.com/elastic/beats/v7/libbeat/paths"
 	mbtest "github.com/elastic/beats/v7/metricbeat/mb/testing"
-	"github.com/elastic/beats/v7/metricbeat/module/system"
 )
 
+func setHostfs(pathString string) {
+	path := paths.Path{
+		Hostfs: pathString,
+	}
+	paths.InitPaths(&path)
+}
+
 func TestDataNameFilter(t *testing.T) {
-	oldFS := system.HostFS
-	newFS := "_meta/testdata"
-	system.HostFS = &newFS
+	oldFS := paths.Paths.Hostfs
+	setHostfs("_meta/testdata")
+
 	defer func() {
-		system.HostFS = oldFS
+		setHostfs(oldFS)
 	}()
 
 	conf := map[string]interface{}{
@@ -51,11 +58,11 @@ func TestDataNameFilter(t *testing.T) {
 }
 
 func TestDataEmptyFilter(t *testing.T) {
-	oldFS := system.HostFS
-	newFS := "_meta/testdata"
-	system.HostFS = &newFS
+	oldFS := paths.Paths.Hostfs
+	setHostfs("_meta/testdata")
+
 	defer func() {
-		system.HostFS = oldFS
+		setHostfs(oldFS)
 	}()
 
 	conf := map[string]interface{}{
@@ -67,6 +74,7 @@ func TestDataEmptyFilter(t *testing.T) {
 	data, errs := mbtest.ReportingFetchV2Error(f)
 	assert.Empty(t, errs)
 	assert.Equal(t, 10, len(data))
+
 }
 
 func TestFetch(t *testing.T) {
diff --git a/metricbeat/module/system/entropy/entropy.go b/metricbeat/module/system/entropy/entropy.go
index 15792ae07efd..3604c9d59fcc 100644
--- a/metricbeat/module/system/entropy/entropy.go
+++ b/metricbeat/module/system/entropy/entropy.go
@@ -29,8 +29,8 @@ import (
 
 	"github.com/elastic/beats/v7/libbeat/common"
 	"github.com/elastic/beats/v7/libbeat/common/cfgwarn"
+	"github.com/elastic/beats/v7/libbeat/paths"
 	"github.com/elastic/beats/v7/metricbeat/mb"
-	"github.com/elastic/beats/v7/metricbeat/module/system"
 )
 
 // init registers the MetricSet with the central registry as soon as the program
@@ -55,12 +55,7 @@ type MetricSet struct {
 func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
 	cfgwarn.Beta("The system entropy metricset is beta.")
 
-	systemModule, ok := base.Module().(*system.Module)
-	if !ok {
-		return nil, errors.New("unexpected module type")
-	}
-
-	totalPath := path.Join(systemModule.HostFS, "/proc/sys/kernel/random")
+	totalPath := paths.Resolve(paths.Hostfs, "/proc/sys/kernel/random")
 
 	return &MetricSet{
 		BaseMetricSet: base,
diff --git a/metricbeat/module/system/entropy/entropy_test.go b/metricbeat/module/system/entropy/entropy_test.go
index ed4f94595ea7..8c9f6805bbe7 100644
--- a/metricbeat/module/system/entropy/entropy_test.go
+++ b/metricbeat/module/system/entropy/entropy_test.go
@@ -24,13 +24,19 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
+	"github.com/elastic/beats/v7/libbeat/paths"
 	mbtest "github.com/elastic/beats/v7/metricbeat/mb/testing"
-	"github.com/elastic/beats/v7/metricbeat/module/system"
 )
 
 func TestData(t *testing.T) {
-	testdata := "./_meta/testdata"
-	system.HostFS = &testdata
+	testPath := paths.Path{
+		Hostfs: "./_meta/testdata",
+	}
+
+	if err := paths.InitPaths(&testPath); err != nil {
+		t.Errorf("error setting default paths: %+v", err)
+		t.FailNow()
+	}
 	f := mbtest.NewReportingMetricSetV2Error(t, getConfig())
 	err := mbtest.WriteEventsReporterV2Error(f, t, ".")
 	if err != nil {
@@ -39,8 +45,14 @@ func TestData(t *testing.T) {
 }
 
 func TestFetch(t *testing.T) {
-	testdata := "./_meta/testdata"
-	system.HostFS = &testdata
+	testPath := paths.Path{
+		Hostfs: "./_meta/testdata",
+	}
+
+	if err := paths.InitPaths(&testPath); err != nil {
+		t.Errorf("error setting default paths: %+v", err)
+		t.FailNow()
+	}
 	f := mbtest.NewReportingMetricSetV2Error(t, getConfig())
 	events, errs := mbtest.ReportingFetchV2Error(f)
 
diff --git a/metricbeat/module/system/filesystem/helper.go b/metricbeat/module/system/filesystem/helper.go
index 77c8bf3244fb..cd6e338c0e2f 100644
--- a/metricbeat/module/system/filesystem/helper.go
+++ b/metricbeat/module/system/filesystem/helper.go
@@ -22,7 +22,6 @@ package filesystem
 import (
 	"bufio"
 	"os"
-	"path"
 	"path/filepath"
 	"strings"
 	"time"
@@ -30,7 +29,7 @@ import (
 	"runtime"
 
 	"github.com/elastic/beats/v7/libbeat/common"
-	"github.com/elastic/beats/v7/metricbeat/module/system"
+	"github.com/elastic/beats/v7/libbeat/paths"
 	sigar "github.com/elastic/gosigar"
 )
 
@@ -194,7 +193,7 @@ func BuildTypeFilter(ignoreType ...string) Predicate {
 func DefaultIgnoredTypes() (types []string) {
 	// If /proc/filesystems exist, default ignored types are all marked
 	// as nodev
-	fsListFile := path.Join(*system.HostFS, "/proc/filesystems")
+	fsListFile := paths.Resolve(paths.Hostfs, "/proc/filesystems")
 	if f, err := os.Open(fsListFile); err == nil {
 		scanner := bufio.NewScanner(f)
 		for scanner.Scan() {
diff --git a/metricbeat/module/system/process/process.go b/metricbeat/module/system/process/process.go
index 108cab390f8e..5b1bcee0b2e2 100644
--- a/metricbeat/module/system/process/process.go
+++ b/metricbeat/module/system/process/process.go
@@ -28,6 +28,7 @@ import (
 	"github.com/elastic/beats/v7/libbeat/common"
 	"github.com/elastic/beats/v7/libbeat/logp"
 	"github.com/elastic/beats/v7/libbeat/metric/system/process"
+	"github.com/elastic/beats/v7/libbeat/paths"
 	"github.com/elastic/beats/v7/metricbeat/mb"
 	"github.com/elastic/beats/v7/metricbeat/mb/parse"
 	"github.com/elastic/beats/v7/metricbeat/module/system"
@@ -83,8 +84,8 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
 
 	if runtime.GOOS == "linux" {
 		if config.Cgroups == nil || *config.Cgroups {
-			debugf("process cgroup data collection is enabled, using hostfs='%v'", systemModule.HostFS)
-			m.cgroup, err = cgroup.NewReader(systemModule.HostFS, true)
+			debugf("process cgroup data collection is enabled, using hostfs='%v'", paths.Paths.Hostfs)
+			m.cgroup, err = cgroup.NewReader(paths.Paths.Hostfs, true)
 			if err != nil {
 				if err == cgroup.ErrCgroupsMissing {
 					logp.Warn("cgroup data collection will be disabled: %v", err)
diff --git a/metricbeat/module/system/raid/raid.go b/metricbeat/module/system/raid/raid.go
index bf542dbb93b9..9ee16d9a1291 100644
--- a/metricbeat/module/system/raid/raid.go
+++ b/metricbeat/module/system/raid/raid.go
@@ -24,9 +24,9 @@ import (
 	"github.com/prometheus/procfs"
 
 	"github.com/elastic/beats/v7/libbeat/common"
+	"github.com/elastic/beats/v7/libbeat/paths"
 	"github.com/elastic/beats/v7/metricbeat/mb"
 	"github.com/elastic/beats/v7/metricbeat/mb/parse"
-	"github.com/elastic/beats/v7/metricbeat/module/system"
 	"github.com/elastic/beats/v7/metricbeat/module/system/raid/blockinfo"
 )
 
@@ -45,10 +45,6 @@ type MetricSet struct {
 
 // New creates a new instance of the raid metricset.
 func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
-	systemModule, ok := base.Module().(*system.Module)
-	if !ok {
-		return nil, errors.New("unexpected module type")
-	}
 
 	// Additional configuration options
 	config := struct {
@@ -60,7 +56,7 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
 	}
 
 	if config.MountPoint == "" {
-		config.MountPoint = systemModule.HostFS
+		config.MountPoint = paths.Paths.Hostfs
 	}
 
 	mountPoint := filepath.Join(config.MountPoint, procfs.DefaultMountPoint)
diff --git a/metricbeat/module/system/socket/socket.go b/metricbeat/module/system/socket/socket.go
index 4d2eb0707f95..6b768b565510 100644
--- a/metricbeat/module/system/socket/socket.go
+++ b/metricbeat/module/system/socket/socket.go
@@ -24,7 +24,6 @@ import (
 	"net"
 	"os"
 	"os/user"
-	"path/filepath"
 	"strconv"
 	"syscall"
 
@@ -32,10 +31,10 @@ import (
 
 	"github.com/elastic/beats/v7/libbeat/common"
 	"github.com/elastic/beats/v7/libbeat/logp"
+	"github.com/elastic/beats/v7/libbeat/paths"
 	sock "github.com/elastic/beats/v7/metricbeat/helper/socket"
 	"github.com/elastic/beats/v7/metricbeat/mb"
 	"github.com/elastic/beats/v7/metricbeat/mb/parse"
-	"github.com/elastic/beats/v7/metricbeat/module/system"
 	"github.com/elastic/gosigar/sys/linux"
 )
 
@@ -50,6 +49,10 @@ func init() {
 	)
 }
 
+// MetricSet holds any configuration or state information. It must implement
+// the mb.MetricSet interface. And this is best achieved by embedding
+// mb.BaseMetricSet because it implements all of the required mb.MetricSet
+// interface methods except for Fetch.
 type MetricSet struct {
 	mb.BaseMetricSet
 	netlink       *sock.NetlinkSession
@@ -62,18 +65,15 @@ type MetricSet struct {
 	users         UserCache
 }
 
+// New creates a new instance of the MetricSet. New is responsible for unpacking
+// any MetricSet specific configuration options if there are any.
 func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
 	c := defaultConfig
 	if err := base.Module().UnpackConfig(&c); err != nil {
 		return nil, err
 	}
 
-	systemModule, ok := base.Module().(*system.Module)
-	if !ok {
-		return nil, errors.New("unexpected module type")
-	}
-
-	ptable, err := sock.NewProcTable(filepath.Join(systemModule.HostFS, "/proc"))
+	ptable, err := sock.NewProcTable(paths.Resolve(paths.Hostfs, "/proc"))
 	if err != nil {
 		return nil, err
 	}
diff --git a/metricbeat/module/system/socket_summary/socket_summary.go b/metricbeat/module/system/socket_summary/socket_summary.go
index 928b5fe91f16..d34779ab345d 100644
--- a/metricbeat/module/system/socket_summary/socket_summary.go
+++ b/metricbeat/module/system/socket_summary/socket_summary.go
@@ -155,7 +155,7 @@ func (m *MetricSet) Fetch(report mb.ReporterV2) error {
 	}
 
 	stats := calculateConnStats(conns)
-	newStats, err := applyEnhancements(stats, m)
+	newStats, err := applyEnhancements(stats)
 	if err != nil {
 		m.Logger().Debugf("error applying enhancements: %s", err)
 		newStats = stats
diff --git a/metricbeat/module/system/socket_summary/sockstat_linux.go b/metricbeat/module/system/socket_summary/sockstat_linux.go
index 60836b6c1c28..70d4919f43ae 100644
--- a/metricbeat/module/system/socket_summary/sockstat_linux.go
+++ b/metricbeat/module/system/socket_summary/sockstat_linux.go
@@ -23,13 +23,12 @@ import (
 	"bufio"
 	"fmt"
 	"os"
-	"path/filepath"
 
 	"github.com/pkg/errors"
 	"github.com/shirou/gopsutil/net"
 
 	"github.com/elastic/beats/v7/libbeat/common"
-	"github.com/elastic/beats/v7/metricbeat/module/system"
+	"github.com/elastic/beats/v7/libbeat/paths"
 )
 
 // SockStat contains data from /proc/net/sockstat
@@ -61,12 +60,8 @@ type SockStat struct {
 }
 
 // applyEnhancements gets a list of platform-specific enhancements and apply them to our mapStr object.
-func applyEnhancements(data common.MapStr, m *MetricSet) (common.MapStr, error) {
-	systemModule, ok := m.BaseMetricSet.Module().(*system.Module)
-	if !ok {
-		return nil, errors.New("unexpected module type")
-	}
-	dir := filepath.Join(systemModule.HostFS, "/proc/net/sockstat")
+func applyEnhancements(data common.MapStr) (common.MapStr, error) {
+	dir := paths.Resolve(paths.Hostfs, "/proc/net/sockstat")
 	pageSize := os.Getpagesize()
 
 	stat, err := parseSockstat(dir)
diff --git a/metricbeat/module/system/socket_summary/sockstat_other.go b/metricbeat/module/system/socket_summary/sockstat_other.go
index 495c7d31c7b3..5d87f40cdd97 100644
--- a/metricbeat/module/system/socket_summary/sockstat_other.go
+++ b/metricbeat/module/system/socket_summary/sockstat_other.go
@@ -27,7 +27,7 @@ import (
 
 //a stub function for non-linux systems
 //get a list of platform-specific enhancements and apply them to our mapStr object.
-func applyEnhancements(data common.MapStr, m *MetricSet) (common.MapStr, error) {
+func applyEnhancements(data common.MapStr) (common.MapStr, error) {
 	return data, nil
 }
 
diff --git a/metricbeat/module/system/system.go b/metricbeat/module/system/system.go
index a6af865ca49d..d0a1f8c1eeb2 100644
--- a/metricbeat/module/system/system.go
+++ b/metricbeat/module/system/system.go
@@ -18,20 +18,13 @@
 package system
 
 import (
-	"flag"
 	"sync"
 
 	"github.com/elastic/beats/v7/libbeat/common/fleetmode"
-	"github.com/elastic/beats/v7/libbeat/logp"
+	"github.com/elastic/beats/v7/libbeat/paths"
 	"github.com/elastic/beats/v7/metricbeat/mb"
 )
 
-var (
-	// TODO: remove this flag in 8.0 since it should be replaced by system.hostfs configuration option (config.HostFS)
-	// HostFS is an alternate mountpoint for the filesytem root, for when metricbeat is running inside a container.
-	HostFS = flag.String("system.hostfs", "", "mountpoint of the host's filesystem for use in monitoring a host from within a container")
-)
-
 var once sync.Once
 
 func init() {
@@ -41,39 +34,18 @@ func init() {
 	}
 }
 
-// Config for the system module.
-type Config struct {
-	HostFS string `config:"system.hostfs"` // Specifies the mount point of the host’s filesystem for use in monitoring a host from within a container.
-}
-
 // Module represents the system module
 type Module struct {
 	mb.BaseModule
-	HostFS  string // Mountpoint of the host's filesystem for use in monitoring inside a container.
-	IsAgent bool   // Looks to see if metricbeat is running under agent. Useful if we have breaking changes in one but not the other.
+	IsAgent bool // Looks to see if metricbeat is running under agent. Useful if we have breaking changes in one but not the other.
 }
 
 // NewModule instatiates the system module
 func NewModule(base mb.BaseModule) (mb.Module, error) {
 
-	config := Config{
-		HostFS: "",
-	}
-	err := base.UnpackConfig(&config)
-	if err != nil {
-		return nil, err
-	}
-	if *HostFS != "" {
-		if config.HostFS != "" {
-			logp.Warn("-system.hostfs flag is set and will override configuration setting")
-		}
-		config.HostFS = *HostFS
-	}
-
-	// This only needs to be configured once for all system modules.
 	once.Do(func() {
-		initModule(config)
+		initModule(paths.Paths.Hostfs)
 	})
 
-	return &Module{BaseModule: base, HostFS: config.HostFS, IsAgent: fleetmode.Enabled()}, nil
+	return &Module{BaseModule: base, IsAgent: fleetmode.Enabled()}, nil
 }
diff --git a/metricbeat/module/system/system_linux.go b/metricbeat/module/system/system_linux.go
index 6f3f15a1135c..2281bea3d0fa 100644
--- a/metricbeat/module/system/system_linux.go
+++ b/metricbeat/module/system/system_linux.go
@@ -24,12 +24,12 @@ import (
 	"github.com/elastic/gosigar"
 )
 
-func initModule(config Config) {
+func initModule(config string) {
 	configureHostFS(config)
 }
 
-func configureHostFS(config Config) {
-	dir := config.HostFS
+func configureHostFS(config string) {
+	dir := config
 	if dir == "" {
 		dir = "/"
 	}
diff --git a/metricbeat/module/system/system_other.go b/metricbeat/module/system/system_other.go
index c526d363b282..01c0053e922c 100644
--- a/metricbeat/module/system/system_other.go
+++ b/metricbeat/module/system/system_other.go
@@ -19,6 +19,6 @@
 
 package system
 
-func initModule(config Config) {
+func initModule(config string) {
 	// Stub method for non-linux.
 }
diff --git a/metricbeat/module/system/system_windows.go b/metricbeat/module/system/system_windows.go
index 1c95b3e92f96..bf6f457e24e1 100644
--- a/metricbeat/module/system/system_windows.go
+++ b/metricbeat/module/system/system_windows.go
@@ -22,7 +22,7 @@ import (
 	"github.com/elastic/beats/v7/metricbeat/helper"
 )
 
-func initModule(config Config) {
+func initModule(config string) {
 	if err := helper.CheckAndEnableSeDebugPrivilege(); err != nil {
 		logp.Warn("%v", err)
 	}