fix: Improve security for Redis container (#598)

* fix: Improving redis docker security

* fix: Fixing docker examples

* fix: Fixing docker files

* fix: Fixing docker examples

* fix: Fixing metrics example

Author: NicoMolinaOZ

docker-compose.integration.yml

@@ -3,8 +3,8 @@ services:
   redis:
     image: redis:7-alpine
     container_name: integration-redis
-    ports:
-      - 6379:6379
+    command:
+      - redis-server
     networks:
       - integration
     healthcheck:

examples/basic-example-logging/docker-compose.yaml

@@ -40,8 +40,6 @@ services:
     restart: on-failure:5
   redis:
     image: redis:bookworm
-    ports:
-      - 6379:6379/tcp
     security_opt:
       - no-new-privileges
     volumes:

examples/basic-example-metrics/.env.example

@@ -1,4 +1,4 @@
-REDIS_URL=redis://localhost:6379
+REDIS_URL=redis://redis:6379
 API_KEY=
 WEBHOOK_SIGNING_KEY=
 KEYSTORE_PASSPHRASE=

examples/basic-example-metrics/README.md

@@ -2,17 +2,14 @@
 
 This guide demonstrates how to configure and use the OpenZeppelin Relayer service with metrics monitoring. In this example, we configure and utilize an Ethereum Sepolia Relayer integrated with Prometheus and Grafana for comprehensive performance tracking.
 
-
 ## Getting Started
 
-
 ### Prerequisites
 
 - [Docker](https://docs.docker.com/get-docker/)
 - [Docker Compose](https://docs.docker.com/compose/install/)
 - Rust (for key generation tools)
 
-
 ### Step 1: Clone the Repository
 
 Clone this repository to your local machine:
@@ -22,7 +19,6 @@ git clone https://github.com/OpenZeppelin/openzeppelin-relayer
 cd openzeppelin-relayer
 ```
 
-
 ### Step 2: Create a Signer
 
 Create a new signer keystore using the provided key generation tool:
@@ -36,28 +32,22 @@ cargo run --example create_key -- \
 
 Note: Replace <DEFINE_YOUR_PASSWORD> with a strong password for the keystore.
 
-
 Create `examples/basic-example-metrics/.env` file from `examples/basic-example-metrics/.env.example`.
 
 ```bash
 cp examples/basic-example-metrics/.env.example examples/basic-example-metrics/.env
 ```
 
-
 Then, update the `KEYSTORE_PASSPHRASE` field in the `examples/basic-example-metrics/.env` file with the password you used.
 
-
-
 ### Step 3: Configure Notifications
 
-
 #### Configure Webhook URL
 
 `examples/basic-example-metrics/config/config.json` file is partially pre-configured. You need to specify the webhook URL that will receive updates from the relayer service.
 
 For simplicity, visit [Webhook.site](https://webhook.site), copy your unique URL, and then update the notifications[0].url field in `examples/basic-example-metrics/config/config.json` with this value.
 
-
 #### Configure Webhook Signing Key
 
 To sign webhook notification payloads, populate the `WEBHOOK_SIGNING_KEY` entry in the `examples/basic-example-metrics/.env` file.
@@ -67,12 +57,11 @@ For development purposes, you can generate the signing key using:
 ```bash
 cargo run --example generate_uuid
 ```
-> Note: Alternatively, you can use any online UUID generator.
 
+> Note: Alternatively, you can use any online UUID generator.
 
 Copy the generated UUID and update the `WEBHOOK_SIGNING_KEY` entry in the `examples/basic-example-metrics/.env` file.
 
-
 #### Configure Webhook Signing Key
 
 To sign webhook notification payloads, populate the `WEBHOOK_SIGNING_KEY` entry in the `examples/basic-example/.env` file.
@@ -82,35 +71,31 @@ For development purposes, you can generate the signing key using:
 ```bash
 cargo run --example generate_uuid
 ```
-> Note: Alternatively, you can use any online UUID generator.
 
+> Note: Alternatively, you can use any online UUID generator.
 
 Copy the generated UUID and update the `WEBHOOK_SIGNING_KEY` entry in the `examples/basic-example/.env` file.
 
-
 ### Step 4: Configure API Key
 
 Generate an API key signing key for development purposes using:
 
 ```bash
 cargo run --example generate_uuid
 ```
-> Note: Alternatively, you can use any online UUID generator.
 
+> Note: Alternatively, you can use any online UUID generator.
 
 Copy the generated UUID and update the `API_KEY` entry in the `examples/basic-example-metrics/.env` file.
 
-
-
 ### Step 5: Run the Service
 
-Start the service with Docker Compose:
+Start the service with Docker Compose and metrics (Prometheus and Grafana):
 
 ```bash
-docker compose -f examples/basic-example-metrics/docker-compose.yaml up
+docker compose -f examples/basic-example-metrics/docker-compose.yaml --profile metrics up -d
 ```
 
-
 ### Step 6: Test the Relayer
 
 The service is available at `http://localhost:8080/api/v1`
@@ -121,13 +106,13 @@ curl -X GET http://localhost:8080/api/v1/relayers \
   -H "AUTHORIZATION: Bearer YOUR_API_KEY"
 ```
 
-
 ### Step 7: Access Metrics Dashboards
 
 - Prometheus is available at: http://localhost:9090
 - Grafana is available at: http://localhost:3000
 
 The default Grafana login credentials are:
+
 - Username: admin
 - Password: admin
 

examples/basic-example-metrics/docker-compose.yaml

@@ -36,8 +36,6 @@ services:
       - metrics-network
   redis:
     image: redis:bookworm
-    ports:
-      - 6379:6379/tcp
     security_opt:
       - no-new-privileges
     volumes:
@@ -69,6 +67,8 @@ services:
   prometheus:
     container_name: openzeppelin-relayer-prometheus
     image: prom/prometheus:v3.1.0
+    user: 65534:65534
+    read_only: true
     security_opt:
       - no-new-privileges
     command: --log.level=warn --config.file=/etc/prometheus/prometheus.yml --storage.tsdb.path=/prometheus --storage.tsdb.retention.time=30d --web.console.libraries=/usr/share/prometheus/console_libraries --web.console.templates=/usr/share/prometheus/consoles
@@ -78,12 +78,17 @@ services:
       - metrics-network
       - relayer-network
     volumes:
-      - ./cmd/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
+      - ../../cmd/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
+      - prometheus_data:/prometheus
+    tmpfs:
+      - /tmp
     restart: on-failure:5
     profiles:
       - metrics
   grafana:
     image: grafana/grafana:11.5.1
+    user: 472:472
+    read_only: true
     security_opt:
       - no-new-privileges
     ports:
@@ -92,9 +97,13 @@ services:
       - metrics-network
       - relayer-network
     volumes:
-      - ./cmd/prometheus/grafana.ini:/etc/grafana/grafana.ini
-      - ./cmd/prometheus/datasources:/etc/grafana/provisioning/datasources
-      - ./cmd/prometheus/dashboards:/etc/grafana/provisioning/dashboards
+      - ../../cmd/prometheus/grafana.ini:/etc/grafana/grafana.ini:ro
+      - ../../cmd/prometheus/datasources:/etc/grafana/provisioning/datasources:ro
+      - ../../cmd/prometheus/dashboards:/etc/grafana/provisioning/dashboards:ro
+      - grafana_data:/var/lib/grafana
+    tmpfs:
+      - /tmp
+      - /var/log/grafana
     restart: on-failure:5
     profiles:
       - metrics
@@ -106,6 +115,10 @@ networks:
 volumes:
   redis_data:
     driver: local
+  prometheus_data:
+    driver: local
+  grafana_data:
+    driver: local
 secrets:
   api_key:
     environment: API_KEY

examples/basic-example-plugin/docker-compose.yaml

@@ -31,8 +31,6 @@ services:
     restart: on-failure:5
   redis:
     image: redis:bookworm
-    ports:
-      - 6379:6379/tcp
     security_opt:
       - no-new-privileges
     volumes:

examples/basic-example/docker-compose.yaml

@@ -31,8 +31,6 @@ services:
     restart: on-failure:5
   redis:
     image: redis:bookworm
-    ports:
-      - 6379:6379/tcp
     security_opt:
       - no-new-privileges
     volumes:

examples/channels-plugin-example/docker-compose.yaml

@@ -44,8 +44,6 @@ services:
     restart: on-failure:5
   redis:
     image: redis:bookworm
-    ports:
-      - 6379:6379/tcp
     security_opt:
       - no-new-privileges
     volumes:

examples/evm-aws-kms-signer/docker-compose.yaml

@@ -34,8 +34,6 @@ services:
     restart: on-failure:5
   redis:
     image: redis:bookworm
-    ports:
-      - 6379:6379/tcp
     security_opt:
       - no-new-privileges
     volumes:

examples/evm-cdp-signer/docker-compose.yaml

@@ -27,8 +27,6 @@ services:
     restart: on-failure:5
   redis:
     image: redis:bookworm
-    ports:
-      - 6379:6379/tcp
     security_opt:
       - no-new-privileges
     volumes: