# Configuration

## Docker Compose

The root `docker-compose.yml` defines the application container.

Default port mapping:

- Host: `8088`
- Container: `8080`

Change the port mapping in `docker-compose.yml` if host port `8088` is already in use.

## Application settings

The Spring Boot configuration is maintained in:

`backend/src/main/resources/application.yaml`

Review the actual configuration file before changing application properties. This document intentionally does not assume environment variables or settings that may not exist in the current implementation.

## Container permissions and monitoring scope

System metrics available to the application depend on the operating system, container runtime, mounted filesystems, and granted permissions.

### Volume mounts

The application mounts specific host directories rather than the entire root filesystem, to minimize the attack surface:

| Host path | Container path | Purpose |
|---|---|---|
| `/proc` | `/host/proc` | CPU, memory, processes, network, disk mounts |
| `/sys` | `/host/sys` | Network interface details |
| `/etc/hostname` | `/host/etc/hostname` | Host name |
| `/etc/os-release` | `/host/etc/os-release` | OS information |
| `/var` | `/host/var` | Disk space for `/var` mounts |
| `/home` | `/host/home` | Disk space for `/home` mounts |
| `/opt` | `/host/opt` | Disk space for `/opt` mounts |
| `/tmp` | `/host/tmp` | Disk space for `/tmp` mounts |
| `/srv` | `/host/srv` | Disk space for `/srv` mounts |
| `/usr` | `/host/usr` | Disk space for `/usr` mounts |

If your system has additional mount points (e.g., `/data`, `/mnt`), add them to the `volumes` section in `docker-compose.yml`:

```yaml
volumes:
  - /data:/host/data:ro
```

### Security hardening

The container runs with these security settings:

- `read_only: true` — container filesystem is read-only
- `no-new-privileges:true` — prevents privilege escalation
- `tmpfs` on `/tmp` — temporary storage in memory
- Non-root user (`appuser`) — application does not run as root
- `pid: host` — required to see host processes

### Docker Desktop limitation

A container does not automatically have complete visibility into its host. Docker Desktop on Windows runs Linux containers in a virtualized Linux environment, so reported metrics may describe that environment rather than Windows itself.

Do not expose the monitoring interface to untrusted networks without appropriate access controls and network security.