Liosha84andJunie
597d8f380a
- Multi-stage Docker build: Dockerfile compiles frontend (Node.js) and backend (Gradle) inside Docker; no local Java/Node.js required - Security hardening: replaced full host root mount with specific directory mounts (/proc, /sys, /etc, /var, /home, /opt, /tmp, /srv, /usr) - Host metrics consistency: LinuxMemoryService and CpuDetailsService now read from /host/proc instead of container OSHI - Concurrency: replaced synchronized with AtomicReference in 3 services - Global error handling: added @RestControllerAdvice for JSON error responses - Unit tests: added 32 tests for /proc parsers, CPU usage, process uptime - Docker security: non-root user, read-only FS, no-new-privileges, healthcheck - Debug logging: added log.debug() in silent catch blocks - Documentation: updated README, INSTALLATION, DEVELOPMENT, CONFIGURATION, ARCHITECTURE, CHANGELOG Co-authored-by: Junie <junie@jetbrains.com>
65 lines
2.4 KiB
Markdown
65 lines
2.4 KiB
Markdown
# Configuration
|
|
|
|
## Docker Compose
|
|
|
|
The root `docker-compose.yml` defines the application container.
|
|
|
|
Default port mapping:
|
|
|
|
- Host: `8088`
|
|
- Container: `8080`
|
|
|
|
Change the port mapping in `docker-compose.yml` if host port `8088` is already in use.
|
|
|
|
## Application settings
|
|
|
|
The Spring Boot configuration is maintained in:
|
|
|
|
`backend/src/main/resources/application.yaml`
|
|
|
|
Review the actual configuration file before changing application properties. This document intentionally does not assume environment variables or settings that may not exist in the current implementation.
|
|
|
|
## Container permissions and monitoring scope
|
|
|
|
System metrics available to the application depend on the operating system, container runtime, mounted filesystems, and granted permissions.
|
|
|
|
### Volume mounts
|
|
|
|
The application mounts specific host directories rather than the entire root filesystem, to minimize the attack surface:
|
|
|
|
| Host path | Container path | Purpose |
|
|
|---|---|---|
|
|
| `/proc` | `/host/proc` | CPU, memory, processes, network, disk mounts |
|
|
| `/sys` | `/host/sys` | Network interface details |
|
|
| `/etc/hostname` | `/host/etc/hostname` | Host name |
|
|
| `/etc/os-release` | `/host/etc/os-release` | OS information |
|
|
| `/var` | `/host/var` | Disk space for `/var` mounts |
|
|
| `/home` | `/host/home` | Disk space for `/home` mounts |
|
|
| `/opt` | `/host/opt` | Disk space for `/opt` mounts |
|
|
| `/tmp` | `/host/tmp` | Disk space for `/tmp` mounts |
|
|
| `/srv` | `/host/srv` | Disk space for `/srv` mounts |
|
|
| `/usr` | `/host/usr` | Disk space for `/usr` mounts |
|
|
|
|
If your system has additional mount points (e.g., `/data`, `/mnt`), add them to the `volumes` section in `docker-compose.yml`:
|
|
|
|
```yaml
|
|
volumes:
|
|
- /data:/host/data:ro
|
|
```
|
|
|
|
### Security hardening
|
|
|
|
The container runs with these security settings:
|
|
|
|
- `read_only: true` — container filesystem is read-only
|
|
- `no-new-privileges:true` — prevents privilege escalation
|
|
- `tmpfs` on `/tmp` — temporary storage in memory
|
|
- Non-root user (`appuser`) — application does not run as root
|
|
- `pid: host` — required to see host processes
|
|
|
|
### Docker Desktop limitation
|
|
|
|
A container does not automatically have complete visibility into its host. Docker Desktop on Windows runs Linux containers in a virtualized Linux environment, so reported metrics may describe that environment rather than Windows itself.
|
|
|
|
Do not expose the monitoring interface to untrusted networks without appropriate access controls and network security.
|