Files

T

Liosha84andJunie 597d8f380a Major improvements: multi-stage Docker, security hardening, host metrics, tests

- Multi-stage Docker build: Dockerfile compiles frontend (Node.js) and
  backend (Gradle) inside Docker; no local Java/Node.js required
- Security hardening: replaced full host root mount with specific
  directory mounts (/proc, /sys, /etc, /var, /home, /opt, /tmp, /srv, /usr)
- Host metrics consistency: LinuxMemoryService and CpuDetailsService now
  read from /host/proc instead of container OSHI
- Concurrency: replaced synchronized with AtomicReference in 3 services
- Global error handling: added @RestControllerAdvice for JSON error responses
- Unit tests: added 32 tests for /proc parsers, CPU usage, process uptime
- Docker security: non-root user, read-only FS, no-new-privileges, healthcheck
- Debug logging: added log.debug() in silent catch blocks
- Documentation: updated README, INSTALLATION, DEVELOPMENT, CONFIGURATION,
  ARCHITECTURE, CHANGELOG

Co-authored-by: Junie <junie@jetbrains.com>

2026-10-28 23:18:01 +01:00

1.5 KiB

Raw Blame History

Changelog

All notable project changes should be documented here.

This project has not yet established a versioned changelog. Add entries as releases are published.

Unreleased

Multi-stage Docker build — the Dockerfile now compiles both the Angular frontend and Spring Boot backend inside Docker using three stages (Node.js → Gradle → JRE). Build the entire application with a single docker build command — no local Java or Node.js required.
Security hardening — replaced full host root mount (/:/host/root:ro) with specific directory mounts (/proc, /sys, /etc/hostname, /etc/os-release, /var, /home, /opt, /tmp, /srv, /usr) to minimize the attack surface.
Host metrics consistency — LinuxMemoryService and CpuDetailsService now read host metrics from /host/proc instead of container metrics from OSHI.
Concurrency improvements — replaced synchronized methods with AtomicReference in SystemMetricsService, SystemProcessesService, and CpuDetailsService to eliminate lock contention.
Global error handling — added @RestControllerAdvice for structured JSON error responses.
Unit tests — added 32 tests covering /proc file parsers, CPU usage calculations, and process uptime logic.
Docker security — added non-root user (appuser), read-only filesystem, no-new-privileges, and healthcheck to the container.
Debug logging — added log.debug() calls in silent catch blocks across all services.
Documentation structure established.

1.5 KiB Raw Blame History

Changelog

Unreleased

1.5 KiB

Raw Blame History