fix: rm sys_ptrace from services, explicit user rather than root, set…

docker/README.md

@@ -75,6 +75,7 @@ regarding FiftyOne Enterprise.
 - [Advanced Configuration](#advanced-configuration)
   - [Backup And Recovery](#backup-and-recovery)
   - [Secrets And Sensitive Data](#secrets-and-sensitive-data)
+  - [Telemetry](#telemetry)
   - [Snapshot Archival](#snapshot-archival)
   - [Static Banner Configuration](#static-banner-configuration)
   - [Storage Credentials and `FIFTYONE_ENCRYPTION_KEY`](#storage-credentials-and-fiftyone_encryption_key)
@@ -656,6 +657,17 @@ and
 [adding secrets](https://docs.voxel51.com/enterprise/secrets.html#adding-secrets)
 for questions regarding storage and encryption.
 
+### Telemetry
+
+FiftyOne Enterprise bundles a telemetry sidecar + Redis backend by
+default in every compose file. The Settings → Metrics page in teams-app
+exposes live per-service metrics (CPU, memory, FDs, thread counts) and
+tailed logs. No opt-in flags are required.
+
+Please refer to the
+[telemetry configuration documentation](./docs/configuring-telemetry.md)
+for full details.
+
 ### Snapshot Archival
 
 Since version v1.5, FiftyOne Enterprise supports

docker/common-services.yaml

@@ -17,6 +17,7 @@ services:
       FIFTYONE_MEDIA_CACHE_APP_IMAGES: false
       FIFTYONE_MEDIA_CACHE_SIZE_BYTES: -1
       FIFTYONE_SIGNED_URL_EXPIRATION: ${FIFTYONE_SIGNED_URL_EXPIRATION:-24}
+      FIFTYONE_TELEMETRY_REDIS_URL: ${FIFTYONE_TELEMETRY_REDIS_URL:-redis://telemetry-redis:6379}
       # If you are routing through a proxy server you will want to set
       #  HTTP_PROXY_URL, HTTPS_PROXY_URL, and NO_PROXY_LIST in your .env
       #  then add the following environment variables to your
@@ -43,6 +44,7 @@ services:
       FIFTYONE_ENV: ${FIFTYONE_ENV}
       FIFTYONE_INTERNAL_SERVICE: true
       FIFTYONE_LOGGING_FORMAT: ${FIFTYONE_LOGGING_FORMAT:-text}
+      FIFTYONE_TELEMETRY_REDIS_URL: ${FIFTYONE_TELEMETRY_REDIS_URL:-redis://telemetry-redis:6379}
       GRAPHQL_DEFAULT_LIMIT: ${GRAPHQL_DEFAULT_LIMIT}
       LOGGING_LEVEL: ${API_LOGGING_LEVEL:-INFO}
       MONGO_DEFAULT_DB: ${FIFTYONE_DATABASE_NAME}
@@ -72,6 +74,7 @@ services:
       FIFTYONE_SERVER_ADDRESS: ""
       FIFTYONE_SERVER_PATH_PREFIX: /api/proxy/fiftyone-teams
       FIFTYONE_TEAMS_PROXY_URL: ${FIFTYONE_TEAMS_PROXY_URL}
+      FIFTYONE_TELEMETRY_REDIS_URL: ${FIFTYONE_TELEMETRY_REDIS_URL:-redis://telemetry-redis:6379}
       NODE_ENV: production
       RECOIL_DUPLICATE_ATOM_KEY_CHECKING_ENABLED: false
       FIFTYONE_APP_ANONYMOUS_ANALYTICS_ENABLED: ${FIFTYONE_APP_ANONYMOUS_ANALYTICS_ENABLED:-true}
@@ -144,6 +147,7 @@ services:
       FIFTYONE_MEDIA_CACHE_APP_IMAGES: false
       FIFTYONE_MEDIA_CACHE_SIZE_BYTES: -1
       FIFTYONE_PLUGINS_DIR: /opt/plugins
+      FIFTYONE_TELEMETRY_REDIS_URL: ${FIFTYONE_TELEMETRY_REDIS_URL:-redis://telemetry-redis:6379}
       # If you are routing through a proxy server you will want to set
       #  HTTP_PROXY_URL, HTTPS_PROXY_URL, and NO_PROXY_LIST in your .env
       #  then add the following environment variables to your
@@ -158,8 +162,12 @@ services:
 
   teams-do-common:
     image: voxel51/fiftyone-teams-cv-full:v2.19.0
+    # Telemetry default-on requires teams-do to share its PID namespace
+    # with a single sidecar (compose's `pid: "service:<name>"` only joins
+    # one replica). Force replicas=1 to keep the 1:1 pairing deterministic.
+    # See docker/docs/configuring-telemetry.md for multi-worker patterns.
     deploy:
-      replicas: ${FIFTYONE_DELEGATED_OPERATOR_WORKER_REPLICAS:-3}
+      replicas: 1
     command: >
       /bin/sh -c "fiftyone delegated launch -t remote -m"
     environment:
@@ -171,6 +179,147 @@ services:
       FIFTYONE_INTERNAL_SERVICE: true
       FIFTYONE_MEDIA_CACHE_SIZE_BYTES: -1
       FIFTYONE_PLUGINS_DIR: /opt/plugins
+      FIFTYONE_TELEMETRY_REDIS_URL: ${FIFTYONE_TELEMETRY_REDIS_URL:-redis://telemetry-redis:6379}
+      TELEMETRY_SOCKET: /tmp/telemetry/agent.sock
     restart: always
     volumes:
       - plugins-vol:/opt/plugins:ro
+      - telemetry-socket:/tmp/telemetry
+
+  # ─── Telemetry common services ─────────────────────────────────────────
+  # Each base compose file (compose.yaml, compose.plugins.yaml,
+  # compose.dedicated-plugins.yaml) is a standalone alternative to the
+  # others — they can't be layered. Defining the telemetry services once
+  # here lets all three pull them in via `extends:` without duplicating
+  # image, env, and resource blocks.
+  #
+  # `extends` does NOT propagate `depends_on`; each extending service
+  # redeclares it locally.
+
+  telemetry-redis-common:
+    image: ${TELEMETRY_REDIS_IMAGE:-redis:7-alpine}
+    command:
+      - redis-server
+      - --save
+      - "60"
+      - "1"
+      - --dir
+      - /data
+      - --maxmemory
+      - ${TELEMETRY_REDIS_MAXMEMORY:-400mb}
+      - --maxmemory-policy
+      - ${TELEMETRY_REDIS_MAXMEMORY_POLICY:-allkeys-lru}
+    restart: always
+    deploy:
+      resources:
+        limits:
+          cpus: "0.25"
+          memory: 512M
+        reservations:
+          cpus: "0.10"
+          memory: 256M
+    volumes:
+      - telemetry-redis-data:/data
+
+  # One sidecar per observed service. `pid: "service:<target>"` joins the
+  # target's PID namespace so the sidecar can read /proc/<pid>/fd/1 and
+  # psutil can see the target's process.
+  fiftyone-app-telemetry-common:
+    image: voxel51/telemetry-sidecar:v2.19.0
+    pid: "service:fiftyone-app"
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    environment:
+      POD_NAME: fiftyone-app
+      POD_NAMESPACE: ${TELEMETRY_NAMESPACE:-docker}
+      SERVICE_TYPE: fiftyone-app
+      TARGET_NAME: ${FIFTYONE_APP_TARGET_NAME:-hypercorn}
+      FIFTYONE_TELEMETRY_REDIS_URL: ${FIFTYONE_TELEMETRY_REDIS_URL:-redis://telemetry-redis:6379}
+    deploy:
+      resources:
+        limits:
+          cpus: "0.10"
+          memory: 512M
+        reservations:
+          cpus: "0.10"
+          memory: 512M
+    restart: always
+
+  teams-api-telemetry-common:
+    image: voxel51/telemetry-sidecar:v2.19.0
+    pid: "service:teams-api"
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    environment:
+      POD_NAME: teams-api
+      POD_NAMESPACE: ${TELEMETRY_NAMESPACE:-docker}
+      SERVICE_TYPE: teams-api
+      TARGET_NAME: ${TEAMS_API_TARGET_NAME:-fiftyone-teams-api}
+      FIFTYONE_TELEMETRY_REDIS_URL: ${FIFTYONE_TELEMETRY_REDIS_URL:-redis://telemetry-redis:6379}
+    deploy:
+      resources:
+        limits:
+          cpus: "0.10"
+          memory: 512M
+        reservations:
+          cpus: "0.10"
+          memory: 512M
+    restart: always
+
+  teams-plugins-telemetry-common:
+    image: voxel51/telemetry-sidecar:v2.19.0
+    pid: "service:teams-plugins"
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    environment:
+      POD_NAME: teams-plugins
+      POD_NAMESPACE: ${TELEMETRY_NAMESPACE:-docker}
+      SERVICE_TYPE: teams-plugins
+      TARGET_NAME: ${TEAMS_PLUGINS_TARGET_NAME:-hypercorn}
+      FIFTYONE_TELEMETRY_REDIS_URL: ${FIFTYONE_TELEMETRY_REDIS_URL:-redis://telemetry-redis:6379}
+    deploy:
+      resources:
+        limits:
+          cpus: "0.10"
+          memory: 512M
+        reservations:
+          cpus: "0.10"
+          memory: 512M
+    restart: always
+
+  teams-do-telemetry-common:
+    image: voxel51/telemetry-sidecar:v2.19.0
+    pid: "service:teams-do"
+    cap_drop:
+      - ALL
+    cap_add:
+      - SYS_PTRACE
+    security_opt:
+      - no-new-privileges:true
+    environment:
+      POD_NAME: teams-do
+      POD_NAMESPACE: ${TELEMETRY_NAMESPACE:-docker}
+      SERVICE_TYPE: delegated-operator
+      TARGET_NAME: ${TEAMS_DO_TARGET_NAME:-fiftyone delegated}
+      EXECUTOR_SIDECAR: "true"
+      TELEMETRY_SOCKET: /tmp/telemetry/agent.sock
+      FIFTYONE_TELEMETRY_REDIS_URL: ${FIFTYONE_TELEMETRY_REDIS_URL:-redis://telemetry-redis:6379}
+      FIFTYONE_DATABASE_URI: ${FIFTYONE_DATABASE_URI}
+      FIFTYONE_DATABASE_NAME: ${FIFTYONE_DATABASE_NAME}
+    deploy:
+      resources:
+        limits:
+          cpus: "0.10"
+          memory: 512M
+        reservations:
+          cpus: "0.10"
+          memory: 512M
+    volumes:
+      - telemetry-socket:/tmp/telemetry
+    restart: always