Fix/708 709 710 711 infrastructure security (conflict resolved)

Dockerfile

@@ -1,5 +1,7 @@
 # Multi-stage build for PredictIQ API
-FROM rust:1.75-slim as builder
+# Pinned to specific digest for reproducible builds and security
+# rust:1.75-slim digest verified on 2024-01-15
+FROM rust:1.75-slim@sha256:4dd48afa1d6fcf622b18b60081bb6c897b11787b42006aea2f2cf5ff3f6ae0cc as builder
 
 WORKDIR /build
 
@@ -16,7 +18,8 @@ COPY . .
 RUN cd services/api && cargo build --release
 
 # Runtime stage
-FROM debian:bookworm-slim
+# debian:bookworm-slim digest verified on 2024-01-15
+FROM debian:bookworm-slim@sha256:3d868b89a1b0d8b957fa1798fffb5e1b6db5ac4e9c79e74acd418db9be3506b
 
 WORKDIR /app
 
@@ -26,9 +29,19 @@ RUN apt-get update && apt-get install -y \
     libssl3 \
     && rm -rf /var/lib/apt/lists/*
 
+# Create non-root user for security
+# Prevents container escape vulnerabilities from granting root access to host
+RUN groupadd -r appuser && useradd -r -g appuser appuser
+
 # Copy binary from builder
 COPY --from=builder /build/services/api/target/release/predictiq-api /app/
 
+# Set ownership to non-root user
+RUN chown -R appuser:appuser /app
+
+# Switch to non-root user
+USER appuser
+
 # Health check
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
     CMD curl -f http://localhost:8080/health || exit 1

docker-compose.tracing.yml

@@ -13,6 +13,16 @@ services:
     environment:
       - COLLECTOR_OTLP_ENABLED=true
       - LOG_LEVEL=info
+    # Resource limits: Jaeger can consume significant memory with high trace volume
+    # CPU: 1 core, Memory: 1GB (adjust based on trace volume)
+    deploy:
+      resources:
+        limits:
+          cpus: '1'
+          memory: 1G
+        reservations:
+          cpus: '0.5'
+          memory: 512M
     networks:
       - predictiq-tracing
 
@@ -21,6 +31,16 @@ services:
     container_name: predictiq-zipkin
     ports:
       - "9411:9411"    # Zipkin UI and API
+    # Resource limits: Zipkin is lightweight but should be bounded
+    # CPU: 0.5 core, Memory: 512MB
+    deploy:
+      resources:
+        limits:
+          cpus: '0.5'
+          memory: 512M
+        reservations:
+          cpus: '0.25'
+          memory: 256M
     networks:
       - predictiq-tracing
 
@@ -35,6 +55,19 @@ services:
       - "4318:4318"    # OTLP HTTP receiver
       - "8888:8888"    # Prometheus metrics
       - "13133:13133"  # Health check
+    environment:
+      - JAEGER_ENDPOINT=${JAEGER_ENDPOINT:-jaeger:14250}
+      - ZIPKIN_ENDPOINT=${ZIPKIN_ENDPOINT:-http://zipkin:9411/api/v2/spans}
+    # Resource limits: OTEL collector processes and exports traces
+    # CPU: 0.5 core, Memory: 512MB (adjust based on throughput)
+    deploy:
+      resources:
+        limits:
+          cpus: '0.5'
+          memory: 512M
+        reservations:
+          cpus: '0.25'
+          memory: 256M
     depends_on:
       - jaeger
       - zipkin

docs/DISTRIBUTED_TRACING.md

@@ -23,6 +23,31 @@ All services support the following environment variables:
 - `OTEL_TRACE_SAMPLING_RATIO`: Sampling rate 0.0-1.0 (default: `1.0`)
 - `RUST_LOG`: Log level for Rust services (default: `info`)
 
+### OTLP Collector Configuration
+
+The OpenTelemetry collector (`otel-collector-config.yml`) supports environment variable substitution for exporter endpoints:
+
+- `JAEGER_ENDPOINT`: Jaeger exporter endpoint (default: `jaeger:14250`)
+- `ZIPKIN_ENDPOINT`: Zipkin exporter endpoint (default: `http://zipkin:9411/api/v2/spans`)
+
+**Example: Production Configuration**
+
+```bash
+# Set custom endpoints for production
+export JAEGER_ENDPOINT=jaeger.prod.internal:14250
+export ZIPKIN_ENDPOINT=http://zipkin.prod.internal:9411/api/v2/spans
+
+# Start the tracing stack
+docker-compose -f docker-compose.tracing.yml up
+```
+
+**Example: Development Configuration**
+
+```bash
+# Use default local endpoints
+docker-compose -f docker-compose.tracing.yml up
+```
+
 ### API Service Configuration
 
 ```bash

otel-collector-config.yml

@@ -23,12 +23,12 @@ processors:
 
 exporters:
   jaeger:
-    endpoint: jaeger:14250
+    endpoint: ${JAEGER_ENDPOINT:-jaeger:14250}
     tls:
       insecure: true
 
   zipkin:
-    endpoint: http://zipkin:9411/api/v2/spans
+    endpoint: ${ZIPKIN_ENDPOINT:-http://zipkin:9411/api/v2/spans}
 
   logging:
     loglevel: info