Liosha84andJunie
597d8f380a
- Multi-stage Docker build: Dockerfile compiles frontend (Node.js) and backend (Gradle) inside Docker; no local Java/Node.js required - Security hardening: replaced full host root mount with specific directory mounts (/proc, /sys, /etc, /var, /home, /opt, /tmp, /srv, /usr) - Host metrics consistency: LinuxMemoryService and CpuDetailsService now read from /host/proc instead of container OSHI - Concurrency: replaced synchronized with AtomicReference in 3 services - Global error handling: added @RestControllerAdvice for JSON error responses - Unit tests: added 32 tests for /proc parsers, CPU usage, process uptime - Docker security: non-root user, read-only FS, no-new-privileges, healthcheck - Debug logging: added log.debug() in silent catch blocks - Documentation: updated README, INSTALLATION, DEVELOPMENT, CONFIGURATION, ARCHITECTURE, CHANGELOG Co-authored-by: Junie <junie@jetbrains.com>
2.4 KiB
Configuration
Docker Compose
The root docker-compose.yml defines the application container.
Default port mapping:
- Host:
8088 - Container:
8080
Change the port mapping in docker-compose.yml if host port 8088 is already in use.
Application settings
The Spring Boot configuration is maintained in:
backend/src/main/resources/application.yaml
Review the actual configuration file before changing application properties. This document intentionally does not assume environment variables or settings that may not exist in the current implementation.
Container permissions and monitoring scope
System metrics available to the application depend on the operating system, container runtime, mounted filesystems, and granted permissions.
Volume mounts
The application mounts specific host directories rather than the entire root filesystem, to minimize the attack surface:
| Host path | Container path | Purpose |
|---|---|---|
/proc |
/host/proc |
CPU, memory, processes, network, disk mounts |
/sys |
/host/sys |
Network interface details |
/etc/hostname |
/host/etc/hostname |
Host name |
/etc/os-release |
/host/etc/os-release |
OS information |
/var |
/host/var |
Disk space for /var mounts |
/home |
/host/home |
Disk space for /home mounts |
/opt |
/host/opt |
Disk space for /opt mounts |
/tmp |
/host/tmp |
Disk space for /tmp mounts |
/srv |
/host/srv |
Disk space for /srv mounts |
/usr |
/host/usr |
Disk space for /usr mounts |
If your system has additional mount points (e.g., /data, /mnt), add them to the volumes section in docker-compose.yml:
volumes:
- /data:/host/data:ro
Security hardening
The container runs with these security settings:
read_only: true— container filesystem is read-onlyno-new-privileges:true— prevents privilege escalationtmpfson/tmp— temporary storage in memory- Non-root user (
appuser) — application does not run as root pid: host— required to see host processes
Docker Desktop limitation
A container does not automatically have complete visibility into its host. Docker Desktop on Windows runs Linux containers in a virtualized Linux environment, so reported metrics may describe that environment rather than Windows itself.
Do not expose the monitoring interface to untrusted networks without appropriate access controls and network security.