pprof unreachable for gitea in docker #9259

New Issue

GiteaMirror · 2025-11-02T08:33:26-06:00

GiteaMirror commented

2025-11-02 08:33:26 -06:00

Originally created by @philipphutterer on GitHub (Jul 22, 2022).

Description

For Gitea in Docker the ENABLE_PPROF = true flag in app.ini does not work as expected since the pprof service is bound to localhost instead of 0.0.0.0 (here) and can thus not be mapped in the container port mapping to be accessed from outside the container.

I suggest binding pprof to 0.0.0.0 instead.

Gitea Version

running 1.16.5 (but still in latest)

Originally created by @philipphutterer on GitHub (Jul 22, 2022). ### Description For Gitea in Docker the `ENABLE_PPROF = true` flag in `app.ini` does not work as expected since the pprof service is bound to `localhost` instead of `0.0.0.0` ([here](https://github.com/go-gitea/gitea/blob/90f3365d93448c45bcb646d4449f9af8f3568bb8/cmd/web.go#L152)) and can thus not be mapped in the container port mapping to be accessed from outside the container. I suggest binding pprof to `0.0.0.0` instead. ### Gitea Version running 1.16.5 (but still in latest)

GiteaMirror added the type/bug label 2025-11-02 08:33:26 -06:00

GiteaMirror closed this issue

2025-11-02 08:33:26 -06:00

GiteaMirror commented

2025-11-02 08:33:27 -06:00

@zeripath commented on GitHub (Jul 22, 2022):

I think we would need to be very very careful about allowing this port to be opened across all adaptors. We'd need to make it a lot more configurable.

I suspect the correct answer is probably going to be to move the pprof endpoints to be under the /api/private, /metrics or /admin/monitor endpoints - perhaps all three. Then we can probably drop the ENABLE_PPROF option.

Certainly I think making them downloadable directly from /admin/monitor UI would be of some use.

@zeripath commented on GitHub (Jul 22, 2022): I think we would need to be very very careful about allowing this port to be opened across all adaptors. We'd need to make it a lot more configurable. I suspect the correct answer is probably going to be to move the pprof endpoints to be under the /api/private, /metrics or /admin/monitor endpoints - perhaps all three. Then we can probably drop the ENABLE_PPROF option. Certainly I think making them downloadable directly from /admin/monitor UI would be of some use.

GiteaMirror commented

2025-11-02 08:33:27 -06:00

@philipphutterer commented on GitHub (Jul 22, 2022):

In my opinion the docs are not precise enough regarding the property. It says

ENABLE_PPROF: false: Application profiling (memory and cpu). For “web” command it listens on localhost:6060. For “serv” command it dumps to disk at PPROF_DATA_PATH...

What does that "web / serv command" mean, how else can I get to that data in the docker case if I am not able to map the port to the docker host, ie. how exactly can that data be dumped to disk. Sorry for my misunderstanding here.

@philipphutterer commented on GitHub (Jul 22, 2022): In my opinion the docs are not precise enough regarding the property. It says > `ENABLE_PPROF`: false: Application profiling (memory and cpu). For “web” command it listens on localhost:6060. For “serv” command it dumps to disk at `PPROF_DATA_PATH`... What does that "web / serv command" mean, how else can I get to that data in the docker case if I am not able to map the port to the docker host, ie. how exactly can that data be dumped to disk. Sorry for my misunderstanding here.

GiteaMirror commented

2025-11-02 08:33:27 -06:00

@zeripath commented on GitHub (Jul 22, 2022):

When you run gitea you're actually running gitea web so the web here is referring to the webserver.

gitea serv is used in ssh authentication. If you were to want or need to have pprof output from this command you'd need to dump the profile to disk as the command is short-lived and does not open listening ports. (The likelihood of ever need this is extremely low so we feel there is almost zero point explaining how to do this and in fact telling people how to do will only lead to problems but we do need the option in case it is ever needed.)

Similarly for gitea hook is called by git within the repositories as pre-receive, post-receive and proc-receive hooks.

@zeripath commented on GitHub (Jul 22, 2022): When you run `gitea` you're actually running `gitea web` so the `web` here is referring to the webserver. --- `gitea serv` is used in ssh authentication. If you were to want or need to have pprof output from this command you'd need to dump the profile to disk as the command is short-lived and does not open listening ports. (The likelihood of ever need this is extremely low so we feel there is almost zero point explaining how to do this and in fact telling people how to do will only lead to problems but we do need the option in case it is ever needed.) Similarly for `gitea hook` is called by git within the repositories as pre-receive, post-receive and proc-receive hooks.

GiteaMirror commented

2025-11-02 08:33:27 -06:00

@wxiaoguang commented on GitHub (Jul 23, 2022):

Docker users can use docker exec ... curl ... to collect pprof results, it can be written into document.

I do not think it's ideal to expose the pprof port on a public IP.

@wxiaoguang commented on GitHub (Jul 23, 2022): Docker users can use `docker exec ... curl ...` to collect pprof results, it can be written into document. I do not think it's ideal to expose the pprof port on a public IP.

GiteaMirror commented

2025-11-02 08:33:27 -06:00

@philipphutterer commented on GitHub (Jul 23, 2022):

Okay, thanks for the explanation. I already did run curl within the docker container to check if the pprof is served within it at all, and it worked. But I honestly did not know what content was in there so I thought it would be necessary to view it in the browser. Thanks for clarifying that as well. I also think giving some hint in the docs would be helpful.

Other than that, the issue can be closed imo.
Thanks

@philipphutterer commented on GitHub (Jul 23, 2022): Okay, thanks for the explanation. I already did run curl within the docker container to check if the pprof is served within it at all, and it worked. But I honestly did not know what content was in there so I thought it would be necessary to view it in the browser. Thanks for clarifying that as well. I also think giving some hint in the docs would be helpful. Other than that, the issue can be closed imo. Thanks

GiteaMirror commented

2025-11-02 08:33:28 -06:00

@wxiaoguang commented on GitHub (Jul 23, 2022):

I prepared a PR for it