robintra/perf-sentinel v0.4.6

on GitHub

What's new in v0.4.6

Container and Linux-release hardening release. The official Docker image and the published Linux binaries now work out of the box on any distribution, they used to fail silently on anything other than the exact glibc version of the CI runner (glibc 2.39), and the daemon was bound to the container's loopback by default, making the published ports unreachable from the host. No library or detection-logic changes; all fixes are in the deployment path.

Added

• --listen-address, --listen-port-http and --listen-port-grpc flags on perf-sentinel watch. Override the corresponding [daemon] config keys without needing a config file, primarily so container and Kubernetes deployments can bind 0.0.0.0 from the command line while 127.0.0.1 stays the secure default for local use. CLI overrides are applied after load_config and the full Config::validate pass is re-run, so validate_listen_addr still emits the non-loopback security warning when the override binds outside the loopback interface. crates/sentinel-cli/src/main.rs.
• musl-smoke CI job in .github/workflows/ci.yml that builds the release profile against x86_64-unknown-linux-musl on every PR, asserts the produced binary is fully static via file | grep -E "statically linked|static-pie linked" and runs --version to catch runtime-init regressions. Mirrors the amd64 path of the release workflow so a dependency that breaks musl (new C-FFI crate, ring toolchain change, missing musl-tools) surfaces at PR time instead of at tag-push time. aarch64-unknown-linux-musl is not duplicated here since cross 0.2.5 is pinned in release.yml and the amd64 smoke catches dependency-level regressions.

Changed

• Dockerfile splits ENTRYPOINT from CMD: ENTRYPOINT ["/perf-sentinel"] + CMD ["watch"] instead of the previous combined ENTRYPOINT ["/perf-sentinel", "watch"]. Users can now override the subcommand cleanly (docker run image analyze ..., docker run image query ...) without passing --entrypoint. Also corrects a latent bug in the three examples/docker-compose-*.yml files that pass command: ["watch", ...]: the old ENTRYPOINT resolved those to /perf-sentinel watch watch ... (duplicate subcommand); the new shape resolves them to the expected /perf-sentinel watch ....
• Linux release binaries now target musl (x86_64-unknown-linux-musl, aarch64-unknown-linux-musl) instead of glibc. Binaries are fully statically linked and run on any distribution (Alpine, Debian, RHEL, Ubuntu any version) regardless of the host glibc version, and inside FROM scratch images. Previously the ubuntu-latest runner's glibc (2.39) was baked into every release artifact, so the binaries refused to start on Debian bookworm (glibc 2.36), Ubuntu 22.04 (2.35), CentOS Stream 9 and inside the official FROM scratch Docker image itself. release.yml installs musl-tools on the native amd64 build (needed by ring's build.rs); the aarch64 path continues to use cross 0.2.5 which ships its own musl toolchain. Artifact names (perf-sentinel-linux-amd64, perf-sentinel-linux-arm64) are unchanged. Benchmark on aarch64: 1.08M events/sec under musl vs. 1.47M under glibc (both well above the documented 100k events/sec target), RSS effectively identical.

Fixed

• Docker quickstart in README.md and README-FR.md now produces a reachable daemon. Previously docker run --rm -p 4317:4317 -p 4318:4318 ghcr.io/robintra/perf-sentinel:latest started the daemon bound to 127.0.0.1 inside the container: the mapped ports appeared open on the host but any connection was refused at the app level. The quickstart now reads docker run ... watch --listen-address 0.0.0.0 with a paragraph explaining the default bind and the reverse-proxy / NetworkPolicy recommendation for real deployments.
• CI and release workflows install the cross-compile target on the toolchain that actually runs. rust-toolchain.toml pins the Rust version, but the dtolnay/rust-toolchain action with targets: was adding the requested target to the stable channel, leaving the pinned toolchain without musl support and failing every Linux musl build with error[E0463]: can't find crate for core. The musl-smoke job and the release workflow now add the target to the pinned toolchain via an explicit rustup target add step after cargo --version triggers the install.
• musl-smoke static-link verification accepts both phrasings GNU file uses for fully-static Rust binaries. Rust's musl target emits a Position Independent Executable that modern file on Ubuntu 24.04 reports as "static-pie linked", while older file (Debian bookworm and earlier) reports it as "statically linked". The original smoke-test grep matched only the second wording, producing a false positive on modern runners. The check is now a regex alternation plus an explicit negative assertion against "dynamically linked" to catch any future regression that reintroduces a glibc dependency.

Security

• Official Docker image attack surface reduced. The FROM scratch image now contains only a fully static musl binary, so the image carries no libc, no ld-linux, no shell and no package manager. Combined with the existing USER 65534 (nobody) directive, the runtime environment is the minimal viable one for an OTLP daemon.

Tests

• 2 new e2e tests in crates/sentinel-cli/tests/e2e.rs: cli_watch_help_documents_listen_address_override (asserts the three new flags appear in watch --help output) and cli_watch_listen_address_override_starts_cleanly (asserts the daemon spawns successfully on non-default ports 14317/14318 and stays alive past 500 ms, catching any parse or validation regression).

Install

Prebuilt binaries (Linux amd64 / arm64, macOS arm64, Windows amd64):

curl -LO https://github.com/robintra/perf-sentinel/releases/download/v0.4.6/perf-sentinel-linux-amd64
chmod +x perf-sentinel-linux-amd64
sudo mv perf-sentinel-linux-amd64 /usr/local/bin/perf-sentinel

From crates.io:

cargo install perf-sentinel

Docker:

docker pull robintrassard/perf-sentinel:0.4.6

Also available on GHCR: ghcr.io/robintra/perf-sentinel:0.4.6.

Verify the binary against SHA256SUMS.txt:

curl -LO https://github.com/robintra/perf-sentinel/releases/download/v0.4.6/SHA256SUMS.txt
sha256sum -c SHA256SUMS.txt --ignore-missing

Full diff: v0.4.5...v0.4.6