Document DEBUG_ENDPOINTS_ENABLED (debug endpoints disabled by default in v1.37.9)#450
Open
g-despot wants to merge 3 commits into
Open
Document DEBUG_ENDPOINTS_ENABLED (debug endpoints disabled by default in v1.37.9)#450g-despot wants to merge 3 commits into
g-despot wants to merge 3 commits into
Conversation
As of v1.37.9 (weaviate#11173), the debug HTTP listener on the profiling port (default 6060) is disabled by default: pprof/fgprof and /debug/config return 404 unless DEBUG_ENDPOINTS_ENABLED=true. This is a security hardening change; the main REST/gRPC API and /v1/debug/* endpoints are unaffected. - env-vars/index.md: document DEBUG_ENDPOINTS_ENABLED (default false, runtime-configurable), Added in v1.37.9 - best-practices/index.md: note that pprof profiling now requires DEBUG_ENDPOINTS_ENABLED=true on v1.37.9+ Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![orca-security-eu[bot]](https://avatars.githubusercontent.com/in/276244?s=60&v=4){kind=small}
There was a problem hiding this comment.
Orca Security Scan Summary
| Status | Check | Issues by priority | |
|---|---|---|---|
 Passed |
Infrastructure as Code |  0  0  0  0 |
View in Orca |
| Passed |
SAST | 0 0 0 0 |
View in Orca |
| Passed |
Secrets | 0 0 0 0 |
View in Orca |
| Passed |
Vulnerabilities | 0 0 0 0 |
View in Orca |
Contributor
There was a problem hiding this comment.
Pull request overview
Documents the DEBUG_ENDPOINTS_ENABLED environment variable introduced in Weaviate v1.37.9, clarifying that debug/profiling endpoints on the profiling port are disabled by default unless explicitly enabled, and updates profiling guidance accordingly.
Changes:
- Add
DEBUG_ENDPOINTS_ENABLEDto the environment variables reference (including default behavior and version note). - Add a
pprofprofiling note calling out the need to enableDEBUG_ENDPOINTS_ENABLED=trueonv1.37.9+.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| docs/deploy/configuration/env-vars/index.md | Adds DEBUG_ENDPOINTS_ENABLED reference entry near profiling-related variables. |
| docs/weaviate/best-practices/index.md | Adds a note in the pprof section that debug endpoints must be enabled in v1.37.9+. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - Have a go runtime installed, or start a Go-based docker container | ||
| - Expose port 6060 if running in docker/k8s | ||
|
|
||
| :::note `DEBUG_ENDPOINTS_ENABLED` required in `v1.37.9`+ |
| | `INVERTED_SORTER_DISABLED` | Forces the "objects bucket" strategy and doesn't consider inverted sorting. Most users should never set this flag; it exists for benchmarking and as a safety net. Default: `false` | `boolean` | `false` | | ||
| | `GO_PROFILING_DISABLE` | If `true`, disables Go profiling. Default: `false`. | `boolean` | `false` | | ||
| | `GO_PROFILING_PORT` | Sets the port for the Go profiler. Default: `6060` | `integer` | `6060` | | ||
| | `DEBUG_ENDPOINTS_ENABLED` | Gate for the debug HTTP listener (the profiling port set by `GO_PROFILING_PORT`, default `6060`), which serves the Go profiling endpoints (`/debug/pprof/*`, `/debug/fgprof`) and `/debug/config`. When `false`, the listener still binds but returns `404` for every request. Set to `true` to serve these endpoints. Runtime-configurable. Default: `false`<br/>Added in `v1.37.9` (previously these endpoints were always served). `GO_PROFILING_DISABLE` still controls whether the listener binds at all. | `boolean` | `true` | |
- runtime-config.md: add debug_endpoints_enabled runtime override (DEBUG_ENDPOINTS_ENABLED is wired into WeaviateRuntimeConfig) - env-vars/index.md: broaden the description — the listener serves unauthenticated debug AND profiling/maintenance routes, not just pprof; link the runtime override; add "do not expose this port" guidance - best-practices/index.md: note the endpoints are unauthenticated and include destructive operations; /debug/config redacts secrets but heap profiles may still contain in-memory secrets Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
In v1.37.9 (weaviate#11173, "fix: disable debug endpoints by default"), the debug HTTP listener on the profiling port (default
6060) is now disabled by default. Confirmed the change ships in v1.37.9 (git tag --containson the merge commit) and is runtime-configurable.The listener serves Weaviate's unauthenticated internal debug and profiling endpoints —
/debug/config, Go profiling (/debug/pprof/*,/debug/fgprof), and various maintenance/diagnostic routes. When disabled it still binds but returns404for every request. SetDEBUG_ENDPOINTS_ENABLED=true(or thedebug_endpoints_enabledruntime override) to serve them.This is a security-hardening behavior change, not a breaking API change:
8080) and gRPC are untouched. The/v1/debug/*REST endpoints (e.g. async-replication repair) live on the main API mux and are not gated by this flag.GO_PROFILING_DISABLEstill controls whether the listener binds at all (separate switch)./debug/config.:6060/debug/pprof/heap— so it's worth a clear callout for self-hosters.Changes
docs/deploy/configuration/env-vars/index.md— documentDEBUG_ENDPOINTS_ENABLED(defaultfalse, runtime-configurable, Added inv1.37.9) next to theGO_PROFILING_*vars; note the endpoints are unauthenticated and the port should not be exposed to untrusted networks.docs/deploy/configuration/env-vars/runtime-config.md— add thedebug_endpoints_enabledruntime override.docs/weaviate/best-practices/index.md— add a caution in thepprofprofiling section:DEBUG_ENDPOINTS_ENABLED=trueis required on v1.37.9+, the endpoints are unauthenticated and include destructive operations, and heap profiles may still contain in-memory secrets.Related: split out from the backup/export access-check docs in #449.
🤖 Generated with Claude Code