pprof unreachable for gitea in docker

[philipphutterer]

Description

For Gitea in Docker the ENABLE_PPROF = true flag in app.ini does not work as expected since the pprof service is bound to localhost instead of 0.0.0.0 (here) and can thus not be mapped in the container port mapping to be accessed from outside the container.

I suggest binding pprof to 0.0.0.0 instead.

Gitea Version

running 1.16.5 (but still in latest)

[zeripath]

I think we would need to be very very careful about allowing this port to be opened across all adaptors. We'd need to make it a lot more configurable.

I suspect the correct answer is probably going to be to move the pprof endpoints to be under the /api/private, /metrics or /admin/monitor endpoints - perhaps all three. Then we can probably drop the ENABLE_PPROF option.

Certainly I think making them downloadable directly from /admin/monitor UI would be of some use.

[philipphutterer]

In my opinion the docs are not precise enough regarding the property. It says

ENABLE_PPROF: false: Application profiling (memory and cpu). For “web” command it listens on localhost:6060. For “serv” command it dumps to disk at PPROF_DATA_PATH...

What does that "web / serv command" mean, how else can I get to that data in the docker case if I am not able to map the port to the docker host, ie. how exactly can that data be dumped to disk. Sorry for my misunderstanding here.

[zeripath]

When you run gitea you're actually running gitea web so the web here is referring to the webserver.

---

gitea serv is used in ssh authentication. If you were to want or need to have pprof output from this command you'd need to dump the profile to disk as the command is short-lived and does not open listening ports. (The likelihood of ever need this is extremely low so we feel there is almost zero point explaining how to do this and in fact telling people how to do will only lead to problems but we do need the option in case it is ever needed.)

Similarly for gitea hook is called by git within the repositories as pre-receive, post-receive and proc-receive hooks.

[wxiaoguang]

Docker users can use docker exec ... curl ... to collect pprof results, it can be written into document.

I do not think it's ideal to expose the pprof port on a public IP.

[philipphutterer]

Okay, thanks for the explanation. I already did run curl within the docker container to check if the pprof is served within it at all, and it worked. But I honestly did not know what content was in there so I thought it would be necessary to view it in the browser. Thanks for clarifying that as well. I also think giving some hint in the docs would be helpful.

Other than that, the issue can be closed imo.
Thanks

[wxiaoguang]

I prepared a PR for it

• Improve pprof doc #20463