
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
github.com/open-telemetry/opentelemetry-collector-contrib/extension/observer/dockerobserver
Advanced tools
| Status | |
|---|---|
| Stability | beta |
| Distributions | contrib |
| Issues | |
| Code coverage | |
| Code Owners | @MovieStoreGuy |
The Docker observer extension is a Receiver Creator-compatible "watch observer" that will detect and report
container endpoints discovered through the Docker API. Only containers that are in the state of Running and not Paused will emit endpoints.
This observer watches the Docker engine's stream of events to dynamically create, update, and remove endpoints as events are processed.
Requires Docker API Version 1.24+.
The collector will need permissions to access the Docker Engine API, specifically it will need
read access to the Docker socket (default unix:///var/run/docker.sock on non-Windows and npipe:////./pipe/docker_engine on Windows).
extensions:
docker_observer:
# url of the docker socket, defaults to unix:///var/run/docker.sock on non-Windows and npipe:////./pipe/docker_engine on Windows
endpoint: my/path/to/docker.sock
# list of container image names to exclude
excluded_images: ['redis', 'another_image_name']
# client API version, default to 1.24
api_version: "1.25"
# max amount of time to wait for a response from Docker API , default to 5s
timeout: 15s
receivers:
receiver_creator:
watch_observers: [docker_observer]
receivers:
nginx:
rule: type == "container" and name matches "nginx" and port == 80
config:
endpoint: '`endpoint`/status'
collection_interval: 10s
endpointThe URL of the docker server.
default: unix:///var/run/docker.sock on non-Windows and npipe:////./pipe/docker_engine on Windows
timeoutThe maximum amount of time to wait for docker API responses.
default: 5s
api_versionThe client API version. Make sure you input it as a string instead of a float (e.g. "1.4" instead of 1.4).
default: "1.24"
excluded_imagesA list of filters whose matching images are to be excluded. Supports literals, globs, and regex.
default: []
use_hostname_if_presentIf true, the Config.Hostname field (if present) of the docker
container will be used as the discovered host that is used to configure
receivers. If false or if no hostname is configured, the field
NetworkSettings.IPAddress is used instead. These settings can be found
in the output of the Docker API's Container Inspect json.
default: false
use_host_bindingsIf true, the observer will configure receivers for matching container endpoints using the host bound ip and port. This is useful if containers exist that are not accessible to an instance of the collector running outside of the docker network stack.
default: false
ignore_non_host_bindingsIf true, the observer will ignore discovered container endpoints that are not bound to host ports. This is useful if containers exist that are not accessible to an instance of the collector running outside of the docker network stack.
default: false
cache_sync_intervalThe time to wait before resyncing the list of containers the observer maintains
through the docker event listener example: cache_sync_interval: "20m"
default: 60m
The following endpoint variables are exposed to the receiver creator to be used in discovery rules:
| Variable | Type | Description |
|---|---|---|
| name | string | Primary name of the container |
| image | string | Name of the container image |
| port | uint16 | Exposed port of the container |
| alternate_port | uint16 | Exposed port accessed through redirection, such as a mapped port |
| command | string | The command used to invoke the process of the container |
| container_id | string | ID of the container |
| host | string | Hostname or IP of the underlying host the container is running on |
| transport | string | Transport protocol used by the endpoint (TCP or UDP) |
| labels | map[string]string | User-specified metadata labels on the container |
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.