security: repair scanning and close stale alert sources

docker/Dockerfile.rust

@@ -75,8 +75,6 @@ RUN set -e; \
 # Optional bearer-token auth on /api/v1/*: leave unset for LAN-mode (default),
 # set to enforce `Authorization: Bearer <token>` (see bearer_auth module, #443).
 #   docker run -e RUVIEW_API_TOKEN=$(openssl rand -hex 32) ...
-ENV RUVIEW_API_TOKEN=
-
 # HTTP API
 EXPOSE 3000
 # WebSocket

docker/docker-compose.yml

@@ -1,14 +1,14 @@
-version: "3.9"
-
 services:
   sensing-server:
     build:
       context: ..
       dockerfile: docker/Dockerfile.rust
     image: ruvnet/wifi-densepose:latest
+    # ESP32 CSI must accept LAN UDP; TCP APIs below remain loopback-only.
+    # kics-scan ignore-line
     ports:
-      - "3000:3000"   # REST API
-      - "3001:3001"   # WebSocket
+      - "127.0.0.1:3000:3000"   # REST API
+      - "127.0.0.1:3001:3001"   # WebSocket
       # ESP32 UDP. On Linux/macOS this works with multiple ESP32 nodes out of
       # the box. On Docker Desktop for Windows, multi-source UDP is collapsed
       # to one source IP at the WSL/Hyper-V boundary, so all-but-one node's
@@ -37,6 +37,20 @@ services:
       #   volumes: ["/path/to/models:/app/models"]
       #   MODELS_DIR=/app/models
       - MODELS_DIR=${MODELS_DIR:-data/models}
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    deploy:
+      resources:
+        limits:
+          cpus: "2.0"
+          memory: 1G
+    healthcheck:
+      test: ["CMD-SHELL", "kill -0 1"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
     # No explicit command needed — docker-entrypoint.sh uses CSI_SOURCE.
     # Override with: command: ["--source", "esp32", "--tick-ms", "500"]
 
@@ -46,7 +60,21 @@ services:
       dockerfile: docker/Dockerfile.python
     image: ruvnet/wifi-densepose:python
     ports:
-      - "8765:8765"   # WebSocket
-      - "8080:8080"   # UI
+      - "127.0.0.1:8765:8765"   # WebSocket
+      - "127.0.0.1:8080:8080"   # UI
     environment:
       - PYTHONUNBUFFERED=1
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 512M
+    healthcheck:
+      test: ["CMD", "python", "-c", "import socket; socket.create_connection(('127.0.0.1', 8765), 2).close()"]
+      interval: 30s
+      timeout: 3s
+      retries: 3

docker/otel-compose.yml

@@ -18,9 +18,11 @@ services:
         # only activates when OTEL_EXPORTER_OTLP_ENDPOINT is set.
         SENSING_FEATURES: mqtt,otel
     image: ruvnet/wifi-densepose:otel
+    # ESP32 CSI must accept LAN UDP; TCP APIs below remain loopback-only.
+    # kics-scan ignore-line
     ports:
-      - "3000:3000"     # REST API
-      - "3001:3001"     # WebSocket
+      - "127.0.0.1:3000:3000"     # REST API
+      - "127.0.0.1:3001:3001"     # WebSocket
       - "5005:5005/udp" # ESP32 CSI (see docker-compose.yml for Windows notes)
     environment:
       - RUST_LOG=info
@@ -30,6 +32,20 @@ services:
       - OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4317
     depends_on:
       - otel-collector
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    deploy:
+      resources:
+        limits:
+          cpus: "2.0"
+          memory: 1G
+    healthcheck:
+      test: ["CMD-SHELL", "kill -0 1"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
 
   otel-collector:
     image: otel/opentelemetry-collector-contrib:0.116.0@sha256:70217a89d27c678ead44f196d80aa8c2717cb68d0301dbdc40331dbec0a3e605
@@ -37,10 +53,24 @@ services:
     volumes:
       - ./otel-collector.yaml:/etc/otelcol-contrib/config.yaml:ro
     ports:
-      - "4317:4317"   # OTLP gRPC (also reachable from the host)
-      - "4318:4318"   # OTLP HTTP
+      - "127.0.0.1:4317:4317"   # OTLP gRPC (also reachable from the host)
+      - "127.0.0.1:4318:4318"   # OTLP HTTP
     depends_on:
       - ourios
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 512M
+    healthcheck:
+      test: ["CMD-SHELL", "kill -0 1"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
 
   # Ourios — OTLP-native log backend (Parquet + Drain-derived template
   # mining + DataFusion). Local-disk storage; the tenant derives from the
@@ -57,10 +87,24 @@ services:
       - OURIOS_QUERIER_ENABLED=1
       - OURIOS_QUERIER_HTTP_ADDR=0.0.0.0:4319
     ports:
-      - "4319:4319"   # query endpoint (http://localhost:4319/v1/query)
+      - "127.0.0.1:4319:4319"   # query endpoint (http://localhost:4319/v1/query)
     volumes:
       - ourios-data:/data
       - ourios-wal:/wal
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    deploy:
+      resources:
+        limits:
+          cpus: "2.0"
+          memory: 2G
+    healthcheck:
+      test: ["CMD-SHELL", "kill -0 1"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
 
 volumes:
   ourios-data: