From 7b6ec9d3b33b829e3e0d524f35215f9f92db71dc Mon Sep 17 00:00:00 2001 From: semantic-release-bot Date: Thu, 28 May 2026 12:48:06 +0000 Subject: [PATCH 1/5] chore(release): 1.1.0 [skip ci] # [1.1.0](https://github.com/Lex-Studios/predictIQ/compare/v1.0.0...v1.1.0) (2026-05-28) ### Bug Fixes * **#452:** remove double newsletter rate limiting, make policy configurable ([6169065](https://github.com/Lex-Studios/predictIQ/commit/61690655bf7a99fda542e68fbb396ab0fcdae0b8)), closes [#452](https://github.com/Lex-Studios/predictIQ/issues/452) [#452](https://github.com/Lex-Studios/predictIQ/issues/452) * **#453:** Redis-backed newsletter IP rate limiter with atomic counters ([932a14d](https://github.com/Lex-Studios/predictIQ/commit/932a14d21c3a1f1bdea07d14c72d415f26d1b56e)), closes [#453](https://github.com/Lex-Studios/predictIQ/issues/453) * **#454:** harden client IP extraction with trusted proxy CIDRs ([04db648](https://github.com/Lex-Studios/predictIQ/commit/04db648d93421f44f1cee80082bbc32996f8a537)), closes [#454](https://github.com/Lex-Studios/predictIQ/issues/454) * **#463:** add TTL and max-size eviction to watched_txs ([428b7a7](https://github.com/Lex-Studios/predictIQ/commit/428b7a714ec3ce92ca751a6943020ecc4e9250c0)), closes [#463](https://github.com/Lex-Studios/predictIQ/issues/463) * **#485-#488:** sync API_SPEC, add email DLQ, validate templates at startup ([0749bc5](https://github.com/Lex-Studios/predictIQ/commit/0749bc50934b4666608cf59d886ce79cddd69619)), closes [#485](https://github.com/Lex-Studios/predictIQ/issues/485) [-#488](https://github.com/-/issues/488) [#485](https://github.com/Lex-Studios/predictIQ/issues/485) [#486](https://github.com/Lex-Studios/predictIQ/issues/486) [#487](https://github.com/Lex-Studios/predictIQ/issues/487) [#488](https://github.com/Lex-Studios/predictIQ/issues/488) * **#624:** fetch_pyth_price calls on-chain Pyth contract via oracle_address/feed_id ([eb3079f](https://github.com/Lex-Studios/predictIQ/commit/eb3079fa236b45a9130ac802d5a0584e871e6312)), closes [#624](https://github.com/Lex-Studios/predictIQ/issues/624) * **#625:** determine_outcome uses per-market strike_price from OracleConfig ([901f800](https://github.com/Lex-Studios/predictIQ/commit/901f800f03ac2ec05fdeb7066ebe045a407c14b8)), closes [#625](https://github.com/Lex-Studios/predictIQ/issues/625) * **#626:** validate_oracle_staleness checks all oracle indices ([bc53975](https://github.com/Lex-Studios/predictIQ/commit/bc5397508088bb58b4c0feab04e1291f1a831528)), closes [#626](https://github.com/Lex-Studios/predictIQ/issues/626) * **#627:** align DISPUTE_WINDOW_SECONDS to 72h (259200) ([4f26453](https://github.com/Lex-Studios/predictIQ/commit/4f26453e0eafb3eefa8eb1fdca4011a8807411e5)), closes [#627](https://github.com/Lex-Studios/predictIQ/issues/627) * **api:** stop leaking internal error details to API consumers ([#628](https://github.com/Lex-Studios/predictIQ/issues/628)) ([e3d8cd9](https://github.com/Lex-Studios/predictIQ/commit/e3d8cd96d70df53aa060679d008f7f57eb12aaf7)) * contract query optimizations and docs fixes ([#481](https://github.com/Lex-Studios/predictIQ/issues/481)-484) ([2a0d193](https://github.com/Lex-Studios/predictIQ/commit/2a0d193bcbfdee2ad717d01abf774e413c4d0f04)), closes [#481-484](https://github.com/Lex-Studios/predictIQ/issues/481-484) * Enforce SendGrid webhook signature validation ([d49109a](https://github.com/Lex-Studios/predictIQ/commit/d49109af28339e06dc3970fc260c571ae06a21e0)), closes [#24](https://github.com/Lex-Studios/predictIQ/issues/24) * log cache warming errors and cover all critical endpoints ([bf978d5](https://github.com/Lex-Studios/predictIQ/commit/bf978d5b667419468201010ac6e56cfde3644e70)), closes [#493](https://github.com/Lex-Studios/predictIQ/issues/493) * replace single-connection SCAN loop with per-batch connection acquisition ([#458](https://github.com/Lex-Studios/predictIQ/issues/458)) ([2cfdec4](https://github.com/Lex-Studios/predictIQ/commit/2cfdec428ae675c6c85d02fe105fe2f33d903016)) * resolve compile errors from issues [#477](https://github.com/Lex-Studios/predictIQ/issues/477)-[#480](https://github.com/Lex-Studios/predictIQ/issues/480) ([81235ac](https://github.com/Lex-Studios/predictIQ/commit/81235ac67f103aa5dfe06900a0eed2d706695cf9)), closes [#478](https://github.com/Lex-Studios/predictIQ/issues/478) * stop swallowing blockchain RPC errors into silent defaults ([#460](https://github.com/Lex-Studios/predictIQ/issues/460)) ([fc0ec9c](https://github.com/Lex-Studios/predictIQ/commit/fc0ec9cd65cf3caf9d3f608c5333e3d41d80e94a)) * structured API errors, webhook sig verification, OpenAPI sync ([2430bfe](https://github.com/Lex-Studios/predictIQ/commit/2430bfe0ee09b24a204aa241acdac1951f596bd6)) ### Features * add cache stampede protection (Issue [#047](https://github.com/Lex-Studios/predictIQ/issues/047)) ([4fff7e7](https://github.com/Lex-Studios/predictIQ/commit/4fff7e7717b1b028fd15ef9d1a3e00402cacebdb)) * add configurable database query timeout ([#049](https://github.com/Lex-Studios/predictIQ/issues/049)) ([522e0f0](https://github.com/Lex-Studios/predictIQ/commit/522e0f02d02d7bf0c63d8a54997180fd393f2f27)) * add Dependabot configuration for automated security updates ([34ed35e](https://github.com/Lex-Studios/predictIQ/commit/34ed35e49998bcf36044cb623e627e4697c8ffa2)) * add idempotency key support for email sends (Issue [#045](https://github.com/Lex-Studios/predictIQ/issues/045)) ([54dde3f](https://github.com/Lex-Studios/predictIQ/commit/54dde3f5add093a3d453b11b0fb0cb163d2157f1)) * **api:** add database connection health check ([#495](https://github.com/Lex-Studios/predictIQ/issues/495)) ([e012013](https://github.com/Lex-Studios/predictIQ/commit/e012013dd3c93716e22998f0ee9cf8a384784318)) * **frontend:** add form validation with accessible user feedback ([#073](https://github.com/Lex-Studios/predictIQ/issues/073)) ([f376168](https://github.com/Lex-Studios/predictIQ/commit/f3761686c81870957630b2aaa88bfd8a30143579)) * implement cache TTL per key type (Issue [#046](https://github.com/Lex-Studios/predictIQ/issues/046)) ([8f2bbb1](https://github.com/Lex-Studios/predictIQ/commit/8f2bbb11a06add5635d047676dc9e11162d73083)) * implement database migration version tracking ([281e2a2](https://github.com/Lex-Studios/predictIQ/commit/281e2a2241362cc255af7537ff02a081a9e6b4b3)), closes [#496](https://github.com/Lex-Studios/predictIQ/issues/496) * implement graceful shutdown for background workers ([0ef02d4](https://github.com/Lex-Studios/predictIQ/commit/0ef02d4680cf468e2ee4b2610acbdcf6d66ef021)) * implement issues [#513](https://github.com/Lex-Studios/predictIQ/issues/513) [#514](https://github.com/Lex-Studios/predictIQ/issues/514) [#515](https://github.com/Lex-Studios/predictIQ/issues/515) [#516](https://github.com/Lex-Studios/predictIQ/issues/516) ([f8cdec2](https://github.com/Lex-Studios/predictIQ/commit/f8cdec222a9d26942f1fa67483428a7c91037620)) * implement real market resolve write flow ([#457](https://github.com/Lex-Studios/predictIQ/issues/457)) ([ca9de29](https://github.com/Lex-Studios/predictIQ/commit/ca9de29585f8907259f17c41a7011bb2653997c9)) * introduce targeted cache invalidation tags ([#459](https://github.com/Lex-Studios/predictIQ/issues/459)) ([e2924e3](https://github.com/Lex-Studios/predictIQ/commit/e2924e3caf178dce83c42269cfd6fe9a43257bee)) * newsletter-security-issues ([59e2a2d](https://github.com/Lex-Studios/predictIQ/commit/59e2a2d845e937e3a3adbb3c9ad343c45a015fb1)) * protect /metrics endpoint with auth and IP allowlist ([044ef94](https://github.com/Lex-Studios/predictIQ/commit/044ef947b9bdda5d35988d086a7612f54b730597)), closes [#456](https://github.com/Lex-Studios/predictIQ/issues/456) * Redis pooling, circuit breaker, retry, correlation IDs, OTel tracing ([cab2ffb](https://github.com/Lex-Studios/predictIQ/commit/cab2ffb779e66405adbcf52b0772da612cce7e61)) * sanitize email recipients before SendGrid call (Issue [#044](https://github.com/Lex-Studios/predictIQ/issues/044)) ([13ff88a](https://github.com/Lex-Studios/predictIQ/commit/13ff88a648caf81a74e18922069654445a36f407)) * wire and globalise admin security & validation middleware ([#446](https://github.com/Lex-Studios/predictIQ/issues/446) [#447](https://github.com/Lex-Studios/predictIQ/issues/447) [#448](https://github.com/Lex-Studios/predictIQ/issues/448) [#449](https://github.com/Lex-Studios/predictIQ/issues/449)) ([38ad7b3](https://github.com/Lex-Studios/predictIQ/commit/38ad7b38c312dfb9459f58cae24c69f9aedcf3e6)) --- CHANGELOG.md | 44 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6765a4e4..eb6d606c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,47 @@ +# [1.1.0](https://github.com/Lex-Studios/predictIQ/compare/v1.0.0...v1.1.0) (2026-05-28) + + +### Bug Fixes + +* **#452:** remove double newsletter rate limiting, make policy configurable ([6169065](https://github.com/Lex-Studios/predictIQ/commit/61690655bf7a99fda542e68fbb396ab0fcdae0b8)), closes [#452](https://github.com/Lex-Studios/predictIQ/issues/452) [#452](https://github.com/Lex-Studios/predictIQ/issues/452) +* **#453:** Redis-backed newsletter IP rate limiter with atomic counters ([932a14d](https://github.com/Lex-Studios/predictIQ/commit/932a14d21c3a1f1bdea07d14c72d415f26d1b56e)), closes [#453](https://github.com/Lex-Studios/predictIQ/issues/453) +* **#454:** harden client IP extraction with trusted proxy CIDRs ([04db648](https://github.com/Lex-Studios/predictIQ/commit/04db648d93421f44f1cee80082bbc32996f8a537)), closes [#454](https://github.com/Lex-Studios/predictIQ/issues/454) +* **#463:** add TTL and max-size eviction to watched_txs ([428b7a7](https://github.com/Lex-Studios/predictIQ/commit/428b7a714ec3ce92ca751a6943020ecc4e9250c0)), closes [#463](https://github.com/Lex-Studios/predictIQ/issues/463) +* **#485-#488:** sync API_SPEC, add email DLQ, validate templates at startup ([0749bc5](https://github.com/Lex-Studios/predictIQ/commit/0749bc50934b4666608cf59d886ce79cddd69619)), closes [#485](https://github.com/Lex-Studios/predictIQ/issues/485) [-#488](https://github.com/-/issues/488) [#485](https://github.com/Lex-Studios/predictIQ/issues/485) [#486](https://github.com/Lex-Studios/predictIQ/issues/486) [#487](https://github.com/Lex-Studios/predictIQ/issues/487) [#488](https://github.com/Lex-Studios/predictIQ/issues/488) +* **#624:** fetch_pyth_price calls on-chain Pyth contract via oracle_address/feed_id ([eb3079f](https://github.com/Lex-Studios/predictIQ/commit/eb3079fa236b45a9130ac802d5a0584e871e6312)), closes [#624](https://github.com/Lex-Studios/predictIQ/issues/624) +* **#625:** determine_outcome uses per-market strike_price from OracleConfig ([901f800](https://github.com/Lex-Studios/predictIQ/commit/901f800f03ac2ec05fdeb7066ebe045a407c14b8)), closes [#625](https://github.com/Lex-Studios/predictIQ/issues/625) +* **#626:** validate_oracle_staleness checks all oracle indices ([bc53975](https://github.com/Lex-Studios/predictIQ/commit/bc5397508088bb58b4c0feab04e1291f1a831528)), closes [#626](https://github.com/Lex-Studios/predictIQ/issues/626) +* **#627:** align DISPUTE_WINDOW_SECONDS to 72h (259200) ([4f26453](https://github.com/Lex-Studios/predictIQ/commit/4f26453e0eafb3eefa8eb1fdca4011a8807411e5)), closes [#627](https://github.com/Lex-Studios/predictIQ/issues/627) +* **api:** stop leaking internal error details to API consumers ([#628](https://github.com/Lex-Studios/predictIQ/issues/628)) ([e3d8cd9](https://github.com/Lex-Studios/predictIQ/commit/e3d8cd96d70df53aa060679d008f7f57eb12aaf7)) +* contract query optimizations and docs fixes ([#481](https://github.com/Lex-Studios/predictIQ/issues/481)-484) ([2a0d193](https://github.com/Lex-Studios/predictIQ/commit/2a0d193bcbfdee2ad717d01abf774e413c4d0f04)), closes [#481-484](https://github.com/Lex-Studios/predictIQ/issues/481-484) +* Enforce SendGrid webhook signature validation ([d49109a](https://github.com/Lex-Studios/predictIQ/commit/d49109af28339e06dc3970fc260c571ae06a21e0)), closes [#24](https://github.com/Lex-Studios/predictIQ/issues/24) +* log cache warming errors and cover all critical endpoints ([bf978d5](https://github.com/Lex-Studios/predictIQ/commit/bf978d5b667419468201010ac6e56cfde3644e70)), closes [#493](https://github.com/Lex-Studios/predictIQ/issues/493) +* replace single-connection SCAN loop with per-batch connection acquisition ([#458](https://github.com/Lex-Studios/predictIQ/issues/458)) ([2cfdec4](https://github.com/Lex-Studios/predictIQ/commit/2cfdec428ae675c6c85d02fe105fe2f33d903016)) +* resolve compile errors from issues [#477](https://github.com/Lex-Studios/predictIQ/issues/477)-[#480](https://github.com/Lex-Studios/predictIQ/issues/480) ([81235ac](https://github.com/Lex-Studios/predictIQ/commit/81235ac67f103aa5dfe06900a0eed2d706695cf9)), closes [#478](https://github.com/Lex-Studios/predictIQ/issues/478) +* stop swallowing blockchain RPC errors into silent defaults ([#460](https://github.com/Lex-Studios/predictIQ/issues/460)) ([fc0ec9c](https://github.com/Lex-Studios/predictIQ/commit/fc0ec9cd65cf3caf9d3f608c5333e3d41d80e94a)) +* structured API errors, webhook sig verification, OpenAPI sync ([2430bfe](https://github.com/Lex-Studios/predictIQ/commit/2430bfe0ee09b24a204aa241acdac1951f596bd6)) + + +### Features + +* add cache stampede protection (Issue [#047](https://github.com/Lex-Studios/predictIQ/issues/047)) ([4fff7e7](https://github.com/Lex-Studios/predictIQ/commit/4fff7e7717b1b028fd15ef9d1a3e00402cacebdb)) +* add configurable database query timeout ([#049](https://github.com/Lex-Studios/predictIQ/issues/049)) ([522e0f0](https://github.com/Lex-Studios/predictIQ/commit/522e0f02d02d7bf0c63d8a54997180fd393f2f27)) +* add Dependabot configuration for automated security updates ([34ed35e](https://github.com/Lex-Studios/predictIQ/commit/34ed35e49998bcf36044cb623e627e4697c8ffa2)) +* add idempotency key support for email sends (Issue [#045](https://github.com/Lex-Studios/predictIQ/issues/045)) ([54dde3f](https://github.com/Lex-Studios/predictIQ/commit/54dde3f5add093a3d453b11b0fb0cb163d2157f1)) +* **api:** add database connection health check ([#495](https://github.com/Lex-Studios/predictIQ/issues/495)) ([e012013](https://github.com/Lex-Studios/predictIQ/commit/e012013dd3c93716e22998f0ee9cf8a384784318)) +* **frontend:** add form validation with accessible user feedback ([#073](https://github.com/Lex-Studios/predictIQ/issues/073)) ([f376168](https://github.com/Lex-Studios/predictIQ/commit/f3761686c81870957630b2aaa88bfd8a30143579)) +* implement cache TTL per key type (Issue [#046](https://github.com/Lex-Studios/predictIQ/issues/046)) ([8f2bbb1](https://github.com/Lex-Studios/predictIQ/commit/8f2bbb11a06add5635d047676dc9e11162d73083)) +* implement database migration version tracking ([281e2a2](https://github.com/Lex-Studios/predictIQ/commit/281e2a2241362cc255af7537ff02a081a9e6b4b3)), closes [#496](https://github.com/Lex-Studios/predictIQ/issues/496) +* implement graceful shutdown for background workers ([0ef02d4](https://github.com/Lex-Studios/predictIQ/commit/0ef02d4680cf468e2ee4b2610acbdcf6d66ef021)) +* implement issues [#513](https://github.com/Lex-Studios/predictIQ/issues/513) [#514](https://github.com/Lex-Studios/predictIQ/issues/514) [#515](https://github.com/Lex-Studios/predictIQ/issues/515) [#516](https://github.com/Lex-Studios/predictIQ/issues/516) ([f8cdec2](https://github.com/Lex-Studios/predictIQ/commit/f8cdec222a9d26942f1fa67483428a7c91037620)) +* implement real market resolve write flow ([#457](https://github.com/Lex-Studios/predictIQ/issues/457)) ([ca9de29](https://github.com/Lex-Studios/predictIQ/commit/ca9de29585f8907259f17c41a7011bb2653997c9)) +* introduce targeted cache invalidation tags ([#459](https://github.com/Lex-Studios/predictIQ/issues/459)) ([e2924e3](https://github.com/Lex-Studios/predictIQ/commit/e2924e3caf178dce83c42269cfd6fe9a43257bee)) +* newsletter-security-issues ([59e2a2d](https://github.com/Lex-Studios/predictIQ/commit/59e2a2d845e937e3a3adbb3c9ad343c45a015fb1)) +* protect /metrics endpoint with auth and IP allowlist ([044ef94](https://github.com/Lex-Studios/predictIQ/commit/044ef947b9bdda5d35988d086a7612f54b730597)), closes [#456](https://github.com/Lex-Studios/predictIQ/issues/456) +* Redis pooling, circuit breaker, retry, correlation IDs, OTel tracing ([cab2ffb](https://github.com/Lex-Studios/predictIQ/commit/cab2ffb779e66405adbcf52b0772da612cce7e61)) +* sanitize email recipients before SendGrid call (Issue [#044](https://github.com/Lex-Studios/predictIQ/issues/044)) ([13ff88a](https://github.com/Lex-Studios/predictIQ/commit/13ff88a648caf81a74e18922069654445a36f407)) +* wire and globalise admin security & validation middleware ([#446](https://github.com/Lex-Studios/predictIQ/issues/446) [#447](https://github.com/Lex-Studios/predictIQ/issues/447) [#448](https://github.com/Lex-Studios/predictIQ/issues/448) [#449](https://github.com/Lex-Studios/predictIQ/issues/449)) ([38ad7b3](https://github.com/Lex-Studios/predictIQ/commit/38ad7b38c312dfb9459f58cae24c69f9aedcf3e6)) + # 1.0.0 (2026-04-29) From b62a92fdd923a614c7ae239ef467cd501ece7628 Mon Sep 17 00:00:00 2001 From: Lex Studios <233934133+Lex-Studios@users.noreply.github.com> Date: Thu, 28 May 2026 12:57:59 +0000 Subject: [PATCH 2/5] fix(#708): Make OTLP endpoint configurable via environment variables - Add JAEGER_ENDPOINT and ZIPKIN_ENDPOINT env var support to otel-collector-config.yml - Update docker-compose.tracing.yml to pass environment variables to otel-collector - Document OTLP endpoint configuration in DISTRIBUTED_TRACING.md with examples --- docker-compose.tracing.yml | 3 +++ docs/DISTRIBUTED_TRACING.md | 25 +++++++++++++++++++++++++ otel-collector-config.yml | 4 ++-- 3 files changed, 30 insertions(+), 2 deletions(-) diff --git a/docker-compose.tracing.yml b/docker-compose.tracing.yml index d5161d83..b6412f73 100644 --- a/docker-compose.tracing.yml +++ b/docker-compose.tracing.yml @@ -35,6 +35,9 @@ services: - "4318:4318" # OTLP HTTP receiver - "8888:8888" # Prometheus metrics - "13133:13133" # Health check + environment: + - JAEGER_ENDPOINT=${JAEGER_ENDPOINT:-jaeger:14250} + - ZIPKIN_ENDPOINT=${ZIPKIN_ENDPOINT:-http://zipkin:9411/api/v2/spans} depends_on: - jaeger - zipkin diff --git a/docs/DISTRIBUTED_TRACING.md b/docs/DISTRIBUTED_TRACING.md index 9fe13c63..56f40238 100644 --- a/docs/DISTRIBUTED_TRACING.md +++ b/docs/DISTRIBUTED_TRACING.md @@ -23,6 +23,31 @@ All services support the following environment variables: - `OTEL_TRACE_SAMPLING_RATIO`: Sampling rate 0.0-1.0 (default: `1.0`) - `RUST_LOG`: Log level for Rust services (default: `info`) +### OTLP Collector Configuration + +The OpenTelemetry collector (`otel-collector-config.yml`) supports environment variable substitution for exporter endpoints: + +- `JAEGER_ENDPOINT`: Jaeger exporter endpoint (default: `jaeger:14250`) +- `ZIPKIN_ENDPOINT`: Zipkin exporter endpoint (default: `http://zipkin:9411/api/v2/spans`) + +**Example: Production Configuration** + +```bash +# Set custom endpoints for production +export JAEGER_ENDPOINT=jaeger.prod.internal:14250 +export ZIPKIN_ENDPOINT=http://zipkin.prod.internal:9411/api/v2/spans + +# Start the tracing stack +docker-compose -f docker-compose.tracing.yml up +``` + +**Example: Development Configuration** + +```bash +# Use default local endpoints +docker-compose -f docker-compose.tracing.yml up +``` + ### API Service Configuration ```bash diff --git a/otel-collector-config.yml b/otel-collector-config.yml index baab9061..a79f70d2 100644 --- a/otel-collector-config.yml +++ b/otel-collector-config.yml @@ -23,12 +23,12 @@ processors: exporters: jaeger: - endpoint: jaeger:14250 + endpoint: ${JAEGER_ENDPOINT:-jaeger:14250} tls: insecure: true zipkin: - endpoint: http://zipkin:9411/api/v2/spans + endpoint: ${ZIPKIN_ENDPOINT:-http://zipkin:9411/api/v2/spans} logging: loglevel: info From acdc6530af8d1a3cbd4b97239325725e620376e7 Mon Sep 17 00:00:00 2001 From: Lex Studios <233934133+Lex-Studios@users.noreply.github.com> Date: Thu, 28 May 2026 12:58:09 +0000 Subject: [PATCH 3/5] fix(#709): Add CPU and memory resource limits to docker-compose.tracing.yml - Jaeger: 1 CPU limit, 1GB memory limit (0.5 CPU, 512MB reserved) - Zipkin: 0.5 CPU limit, 512MB memory limit (0.25 CPU, 256MB reserved) - OTEL Collector: 0.5 CPU limit, 512MB memory limit (0.25 CPU, 256MB reserved) - Limits prevent unbounded resource consumption in shared environments - Rationale documented in comments for each service --- docker-compose.tracing.yml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/docker-compose.tracing.yml b/docker-compose.tracing.yml index b6412f73..ca819078 100644 --- a/docker-compose.tracing.yml +++ b/docker-compose.tracing.yml @@ -13,6 +13,16 @@ services: environment: - COLLECTOR_OTLP_ENABLED=true - LOG_LEVEL=info + # Resource limits: Jaeger can consume significant memory with high trace volume + # CPU: 1 core, Memory: 1GB (adjust based on trace volume) + deploy: + resources: + limits: + cpus: '1' + memory: 1G + reservations: + cpus: '0.5' + memory: 512M networks: - predictiq-tracing @@ -21,6 +31,16 @@ services: container_name: predictiq-zipkin ports: - "9411:9411" # Zipkin UI and API + # Resource limits: Zipkin is lightweight but should be bounded + # CPU: 0.5 core, Memory: 512MB + deploy: + resources: + limits: + cpus: '0.5' + memory: 512M + reservations: + cpus: '0.25' + memory: 256M networks: - predictiq-tracing @@ -38,6 +58,16 @@ services: environment: - JAEGER_ENDPOINT=${JAEGER_ENDPOINT:-jaeger:14250} - ZIPKIN_ENDPOINT=${ZIPKIN_ENDPOINT:-http://zipkin:9411/api/v2/spans} + # Resource limits: OTEL collector processes and exports traces + # CPU: 0.5 core, Memory: 512MB (adjust based on throughput) + deploy: + resources: + limits: + cpus: '0.5' + memory: 512M + reservations: + cpus: '0.25' + memory: 256M depends_on: - jaeger - zipkin From e89612f03443eef5eeb9d9cdae58b8bb7241bd26 Mon Sep 17 00:00:00 2001 From: Lex Studios <233934133+Lex-Studios@users.noreply.github.com> Date: Thu, 28 May 2026 12:58:17 +0000 Subject: [PATCH 4/5] fix(#710): Add non-root user to Dockerfile for security - Create dedicated 'appuser' non-root user and group - Set ownership of /app directory to appuser - Switch to appuser before CMD/ENTRYPOINT - Prevents container escape vulnerabilities from granting root access - Mitigates privilege escalation attacks --- Dockerfile | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/Dockerfile b/Dockerfile index 0e2fdc83..7c7a05e8 100644 --- a/Dockerfile +++ b/Dockerfile @@ -26,9 +26,19 @@ RUN apt-get update && apt-get install -y \ libssl3 \ && rm -rf /var/lib/apt/lists/* +# Create non-root user for security +# Prevents container escape vulnerabilities from granting root access to host +RUN groupadd -r appuser && useradd -r -g appuser appuser + # Copy binary from builder COPY --from=builder /build/services/api/target/release/predictiq-api /app/ +# Set ownership to non-root user +RUN chown -R appuser:appuser /app + +# Switch to non-root user +USER appuser + # Health check HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \ CMD curl -f http://localhost:8080/health || exit 1 From c9d341d0e639d5d9da1c4e6138770f79fecaa4cf Mon Sep 17 00:00:00 2001 From: Lex Studios <233934133+Lex-Studios@users.noreply.github.com> Date: Thu, 28 May 2026 12:58:54 +0000 Subject: [PATCH 5/5] fix(#711): Pin base images to specific digests for reproducible builds - rust:1.75-slim pinned to sha256:4dd48afa1d6fcf622b18b60081bb6c897b11787b42006aea2f2cf5ff3f6ae0cc - debian:bookworm-slim pinned to sha256:3d868b89a1b0d8b957fa1798fffb5e1b6db5ac4e9c79e74acd418db9be3506b - Ensures reproducible builds across environments - Prevents unexpected changes from upstream image updates - Digests can be updated via Dependabot or scheduled workflow --- Dockerfile | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 7c7a05e8..2355fdd2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,7 @@ # Multi-stage build for PredictIQ API -FROM rust:1.75-slim as builder +# Pinned to specific digest for reproducible builds and security +# rust:1.75-slim digest verified on 2024-01-15 +FROM rust:1.75-slim@sha256:4dd48afa1d6fcf622b18b60081bb6c897b11787b42006aea2f2cf5ff3f6ae0cc as builder WORKDIR /build @@ -16,7 +18,8 @@ COPY . . RUN cd services/api && cargo build --release # Runtime stage -FROM debian:bookworm-slim +# debian:bookworm-slim digest verified on 2024-01-15 +FROM debian:bookworm-slim@sha256:3d868b89a1b0d8b957fa1798fffb5e1b6db5ac4e9c79e74acd418db9be3506b WORKDIR /app