feat: add opt-in anonymous telemetry and internal tracker dashboard - #21
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| const MAX_BODY = 16 * 1024; | ||
| const security = { 'cache-control':'no-store','content-type':'application/json; charset=utf-8','x-content-type-options':'nosniff','x-frame-options':'DENY','content-security-policy':"default-src 'none'; frame-ancestors 'none'; base-uri 'none'",'referrer-policy':'no-referrer' }; | ||
| function json(res,status,value){const body=JSON.stringify(value);res.writeHead(status,{...security,'content-length':Buffer.byteLength(body)});res.end(body);} |
| const MAX_BODY = 16 * 1024; | ||
|
|
||
| function headers(extra = {}) { return { 'cache-control': 'no-store', 'x-content-type-options': 'nosniff', 'x-frame-options': 'DENY', 'content-security-policy': "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; img-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'", 'permissions-policy': 'camera=(), microphone=(), geolocation=()', 'referrer-policy': 'no-referrer', ...extra }; } | ||
| function json(res, status, value, extra = {}) { const body = JSON.stringify(value); res.writeHead(status, headers({ 'content-type': 'application/json; charset=utf-8', 'content-length': Buffer.byteLength(body), ...extra })); res.end(body); } |
DeepZone
marked this pull request as ready for review
August 21, 2026 12:56
DeepZone
added a commit
that referenced
this pull request
Aug 21, 2026
) * feat: add telemetry state and payload builder * feat: add telemetry settings UI * feat: add telemetry collector and internal dashboard * test: add telemetry privacy and integration coverage * docs: document anonymous telemetry * fix: use explicit telemetry timeline aliases * release: prepare Container Pilot v0.9.0-rc.11 --------- Co-authored-by: Norman Sens <n.sens@noisens.de>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds explicit opt-in, privacy-minimizing anonymous usage telemetry to Container Pilot and a separately deployable PostgreSQL tracker with an authenticated internal statistics dashboard. Telemetry remains disabled for all existing and new installations until an administrator enables it.
Architecture
cp-track.noisens.determinates HTTPS and proxies only to public listener:3090.:3091, intended for localhost or a private management LAN only.Privacy model
Opt-in instead of opt-out; transparent instead of hidden; aggregated instead of detailed; minimal instead of curious. Tracker failures are fail-open and cannot block scans, updates, rollbacks, UI actions, or process startup. Remote addresses exist only briefly in in-memory rate-limit maps and are never stored or logged.
Collected data
Explicitly excluded data
No hostnames, Docker host names, IP/MAC addresses, machine IDs, hardware serials, container names/IDs, image names/tags/digests, repositories, registry domains/URLs, labels, Compose metadata, networks, volumes, mount paths, ports, environment variables, usernames, credentials, tokens, secrets, certificates, browser data, application data, or file contents.
Security review confirmed:
Nameis never read into telemetry./dashboard,/admin, and/api/dashboard/summary).Public endpoint
POST https://cp-track.noisens.de/api/v1/telemetryDELETE https://cp-track.noisens.de/api/v1/telemetry/:installation_idGET https://cp-track.noisens.de/healthzAll other public routes return 404. nginx and Caddy allow-list examples are documented.
Internal dashboard architecture
The internal listener requires login and provides 24h/7d/30d activity KPIs, version/architecture/Docker/OS distributions, container and feature adoption, registry categories, update/rollback statistics, 7/30/90-day time series, a shortened-ID installation list, details, and report history. Assets are local with no CDN, analytics, fonts, or external requests.
Database model
Versioned migration
001_initial.sqlcreatesinstallationssummaries and cascadingreportshistory. Each report transactionally inserts history and upserts current cumulative values, avoiding double counting. Raw reports default to 90-day retention.Security
Strict unknown-field rejection, bounded strings/counters, UUID v4 validation, 16 KiB body limit, per-installation and ephemeral IP rate limits, prepared queries, transactional migrations, login rate limiting, expiring server-side sessions, HttpOnly/SameSite cookies, optional Secure cookies, origin/CSRF checks, and browser security headers.
Tests
Deployment
tracker/compose.yml, Dockerfile, file-based secret wiring, healthchecks, migrations, backup/restore, update, retention, nginx, Caddy, hardening, and troubleshooting are documented intracker/README.md. Client behavior is documented indocs/telemetry.md.Known limitations
cp-track.noisens.de; deployment remains an explicit infrastructure step.Unreleasedas required.