From 3f510ecf443f529646a9bcd60c8f364ed168da5c Mon Sep 17 00:00:00 2001 From: Pratik Mankawde <3397372+pratikmankawde@users.noreply.github.com> Date: Tue, 22 Sep 2026 13:58:17 +0100 Subject: [PATCH 1/2] fix(telemetry): publish local stack ports on the host loopback The compose ports published on every host interface, so the collector's unauthenticated OTLP receivers, Tempo, and the anonymous-admin Grafana were reachable by anything that could route to the host. Nothing consumed the published ports from off-host: containers address each other by compose service name, and every doc and script uses localhost. --- docker/telemetry/docker-compose.yml | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/docker/telemetry/docker-compose.yml b/docker/telemetry/docker-compose.yml index 0b3f268aaf..6f2094d80d 100644 --- a/docker/telemetry/docker-compose.yml +++ b/docker/telemetry/docker-compose.yml @@ -23,10 +23,16 @@ services: otel-collector: image: otel/opentelemetry-collector-contrib:0.158.0 command: ["--config=/etc/otel-collector-config.yaml"] + # Published on the host loopback only. The receivers have no auth and no + # TLS, so only processes on this host may reach them. Note this 127.0.0.1 + # is the HOST interface docker listens on; the container-side bind lives in + # the collector config and is a separate choice. Upstream asks for a + # specific interface rather than 0.0.0.0 on either side (CWE-1327): + # https://opentelemetry.io/docs/security/config-best-practices/ ports: - - "4317:4317" # OTLP gRPC receiver - - "4318:4318" # OTLP HTTP receiver (xrpld sends traces here) - - "13133:13133" # Health check endpoint + - "127.0.0.1:4317:4317" # OTLP gRPC receiver + - "127.0.0.1:4318:4318" # OTLP HTTP receiver (xrpld sends traces here) + - "127.0.0.1:13133:13133" # Health check endpoint volumes: # Mount collector pipeline config (receivers → processors → exporters) - ./otel-collector-config.yaml:/etc/otel-collector-config.yaml:ro @@ -41,7 +47,7 @@ services: image: grafana/tempo:2.9.4 command: ["-config.file=/etc/tempo.yaml"] ports: - - "3200:3200" # Tempo HTTP API (health check, query) + - "127.0.0.1:3200:3200" # Tempo HTTP API (health check, query) volumes: # Mount Tempo storage and ingestion config - ./tempo.yaml:/etc/tempo.yaml:ro @@ -58,7 +64,7 @@ services: - GF_AUTH_ANONYMOUS_ENABLED=true # No login required for local dev - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin # Full access without auth ports: - - "3000:3000" # Grafana web UI + - "127.0.0.1:3000:3000" # Grafana web UI volumes: # Auto-provision Tempo datasource and search filters on startup - ./grafana/provisioning:/etc/grafana/provisioning:ro From 3cc9f330418667b80fc9c65835ef6a8058835461 Mon Sep 17 00:00:00 2001 From: Pratik Mankawde <3397372+pratikmankawde@users.noreply.github.com> Date: Tue, 22 Sep 2026 13:58:18 +0100 Subject: [PATCH 2/2] fix(telemetry): publish the Prometheus ports on the host loopback The StatsD port beside them was already loopback-bound with a comment saying why; the Prometheus exporter and Prometheus itself were not. Prometheus scrapes the collector as otel-collector:8889 over the compose network, so the published port had no consumer. --- docker/telemetry/docker-compose.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker/telemetry/docker-compose.yml b/docker/telemetry/docker-compose.yml index 13da6a56c9..5d61f58131 100644 --- a/docker/telemetry/docker-compose.yml +++ b/docker/telemetry/docker-compose.yml @@ -30,7 +30,7 @@ services: # receiver has no auth, and xrpld runs on the host, so it reaches the # collector via 127.0.0.1. Do not expose on 0.0.0.0 in shared setups. - "127.0.0.1:8125:8125/udp" - - "8889:8889" # Prometheus metrics (span_metrics + statsd) + - "127.0.0.1:8889:8889" # Prometheus metrics (span_metrics + statsd) - "13133:13133" # Health check volumes: # Mount collector pipeline config (receivers → processors → exporters) @@ -59,7 +59,7 @@ services: # Pinned to an exact patch release for reproducible, config-stable runs. image: prom/prometheus:v3.13.2 ports: - - "9090:9090" + - "127.0.0.1:9090:9090" volumes: - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro depends_on: