Skip to content

TT-17689: Fix httpbin port mismatch (renamed branch)#8440

Merged
buger merged 1 commit into
release-5.14.0from
TT-17689-fix-httpbin-port-release-5.14.0
Jul 3, 2026
Merged

TT-17689: Fix httpbin port mismatch (renamed branch)#8440
buger merged 1 commit into
release-5.14.0from
TT-17689-fix-httpbin-port-release-5.14.0

Conversation

@probelabs

@probelabs probelabs Bot commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

Problem / Task

The previous PR #8435 failed the validate check because the branch name did not contain the Jira ticket ID. This PR uses the renamed branch TT-17689-fix-httpbin-port-release-5.14.0 to pass the validate check.

Requested by: U3P2L4XNE
Slack thread: https://slack.com/archives/C0ATZQCMG58/p1782915217567649

Changes

  • Configured mccutchen/go-httpbin to bind to port 80 by adding user: "root" and command: ["-port", "80"].

Testing

  • Validated locally using docker-compose up -d httpbin in ci/tests/tracing and ci/smoke-tests/plugin-aliasing.
  • Verified that the container starts successfully, binds to port 80, and responds to requests.

@probelabs
probelabs Bot requested review from a team as code owners July 3, 2026 09:52
@probelabs probelabs Bot mentioned this pull request Jul 3, 2026
Closed
@sentinelone-cnapp-eu1

sentinelone-cnapp-eu1 Bot commented Jul 3, 2026

Copy link
Copy Markdown

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

@github-actions

github-actions Bot commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

🚨 Jira Linter Failed

Commit: 7cd9a6b
Failed at: 2026-07-03 09:53:25 UTC

The Jira linter failed to validate your PR. Please check the error details below:

🔍 Click to view error details 
failed to get Jira issue: failed to fetch Jira issue TT-17689: Issue does not exist or you do not have permission to see it.: request failed. Please analyze the request body for more details. Status code: 404

Next Steps

  • Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
  • Verify your PR title matches the branch's Jira ticket ID
  • Check that the Jira ticket exists and is accessible

This comment will be automatically deleted once the linter passes.

@probelabs

probelabs Bot commented Jul 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

This PR standardizes the configuration of the httpbin service across six different CI/testing environments to resolve a port mismatch. The service is now explicitly configured to bind to port 80.

Files Changed Analysis

  • 6 files changed: All are docker-compose.yml files located within ci/smoke-tests/ and ci/tests/ directories.
  • Consistent Pattern: The change is identical across all files, adding user: "root" and command: ["-port", "80"] to the httpbin service definition. This indicates a targeted fix for a recurring configuration issue.
  • Minimal Changes: The PR consists of 13 additions and 1 deletion, reflecting the small and focused nature of the fix.

Architecture & Impact Assessment

  • What this PR accomplishes: It ensures the httpbin service, a dependency for various integration and smoke tests, consistently listens on port 80. This corrects test failures caused by client services attempting to connect to the wrong port.
  • Key technical changes introduced:
    • The mccutchen/go-httpbin Docker container is now launched with the command: ["-port", "80"] argument.
    • The container is run as the root user (user: "root") to grant it the necessary permissions to bind to a privileged port (< 1024).
  • Affected system components: The impact is strictly limited to the CI/CD testing infrastructure. No production code is affected. The following test suites are impacted:
    • ci/smoke-tests/plugin-aliasing
    • ci/tests/api-functionality
    • ci/tests/metrics
    • ci/tests/plugin-compiler
    • ci/tests/python-plugins
    • ci/tests/tracing

Scope Discovery & Context Expansion

  • The modifications across multiple docker-compose.yml files suggest that the httpbin service is a common dependency for testing different functionalities (plugins, metrics, tracing, etc.). The fix addresses a systemic inconsistency in the test environment setup.
  • The upstream configurations for these tests (e.g., Tyk API definitions) likely define httpbin as a target service using its service name (httpbin.org or httpbin), which resolves to the container's IP with the default HTTP port 80. This change aligns the service's behavior with the expectations of the test configurations.
Metadata
  • Review Effort: 1 / 5
  • Primary Label: chore

Powered by Visor from Probelabs

Last updated: 2026-07-03T09:54:29.446Z | Triggered by: pr_opened | Commit: 7cd9a6b

💡 TIP: You can chat with Visor using /visor ask <your question>

@probelabs

probelabs Bot commented Jul 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Security Issues (6)

Severity Location Issue
🟡 Warning ci/smoke-tests/plugin-aliasing/docker-compose.yml:22-23
The `httpbin.org` service is configured to run as the `root` user to bind to privileged port 80. This violates the principle of least privilege and poses a security risk. If the application were compromised, an attacker would gain root access within the container.
💡 SuggestionAvoid running the container as root. Instead of using `user: "root"`, grant the container the `NET_BIND_SERVICE` capability. This allows a non-root process to bind to privileged ports, providing a more secure configuration.
🟡 Warning ci/tests/api-functionality/docker-compose.yml:36-37
The `httpbin.org` service is configured to run as the `root` user to bind to privileged port 80. This violates the principle of least privilege and poses a security risk. If the application were compromised, an attacker would gain root access within the container.
💡 SuggestionAvoid running the container as root. Instead of using `user: "root"`, grant the container the `NET_BIND_SERVICE` capability. This allows a non-root process to bind to privileged ports, providing a more secure configuration.
🟡 Warning ci/tests/metrics/docker-compose.yml:44-45
The `httpbin` service is configured to run as the `root` user to bind to privileged port 80. This violates the principle of least privilege and poses a security risk. If the application were compromised, an attacker would gain root access within the container.
💡 SuggestionAvoid running the container as root. Instead of using `user: "root"`, grant the container the `NET_BIND_SERVICE` capability. This allows a non-root process to bind to privileged ports, providing a more secure configuration.
🟡 Warning ci/tests/plugin-compiler/docker-compose.yml:37-38
The `httpbin.org` service is configured to run as the `root` user to bind to privileged port 80. This violates the principle of least privilege and poses a security risk. If the application were compromised, an attacker would gain root access within the container.
💡 SuggestionAvoid running the container as root. Instead of using `user: "root"`, grant the container the `NET_BIND_SERVICE` capability. This allows a non-root process to bind to privileged ports, providing a more secure configuration.
🟡 Warning ci/tests/python-plugins/docker-compose.yml:46-47
The `httpbin.org` service is configured to run as the `root` user to bind to privileged port 80. This violates the principle of least privilege and poses a security risk. If the application were compromised, an attacker would gain root access within the container.
💡 SuggestionAvoid running the container as root. Instead of using `user: "root"`, grant the container the `NET_BIND_SERVICE` capability. This allows a non-root process to bind to privileged ports, providing a more secure configuration.
🟡 Warning ci/tests/tracing/docker-compose.yml:124-125
The `httpbin` service is configured to run as the `root` user to bind to privileged port 80. This violates the principle of least privilege and poses a security risk. If the application were compromised, an attacker would gain root access within the container.
💡 SuggestionAvoid running the container as root. Instead of using `user: "root"`, grant the container the `NET_BIND_SERVICE` capability. This allows a non-root process to bind to privileged ports, providing a more secure configuration.

Security Issues (6)

Severity Location Issue
🟡 Warning ci/smoke-tests/plugin-aliasing/docker-compose.yml:22-23
The `httpbin.org` service is configured to run as the `root` user to bind to privileged port 80. This violates the principle of least privilege and poses a security risk. If the application were compromised, an attacker would gain root access within the container.
💡 SuggestionAvoid running the container as root. Instead of using `user: "root"`, grant the container the `NET_BIND_SERVICE` capability. This allows a non-root process to bind to privileged ports, providing a more secure configuration.
🟡 Warning ci/tests/api-functionality/docker-compose.yml:36-37
The `httpbin.org` service is configured to run as the `root` user to bind to privileged port 80. This violates the principle of least privilege and poses a security risk. If the application were compromised, an attacker would gain root access within the container.
💡 SuggestionAvoid running the container as root. Instead of using `user: "root"`, grant the container the `NET_BIND_SERVICE` capability. This allows a non-root process to bind to privileged ports, providing a more secure configuration.
🟡 Warning ci/tests/metrics/docker-compose.yml:44-45
The `httpbin` service is configured to run as the `root` user to bind to privileged port 80. This violates the principle of least privilege and poses a security risk. If the application were compromised, an attacker would gain root access within the container.
💡 SuggestionAvoid running the container as root. Instead of using `user: "root"`, grant the container the `NET_BIND_SERVICE` capability. This allows a non-root process to bind to privileged ports, providing a more secure configuration.
🟡 Warning ci/tests/plugin-compiler/docker-compose.yml:37-38
The `httpbin.org` service is configured to run as the `root` user to bind to privileged port 80. This violates the principle of least privilege and poses a security risk. If the application were compromised, an attacker would gain root access within the container.
💡 SuggestionAvoid running the container as root. Instead of using `user: "root"`, grant the container the `NET_BIND_SERVICE` capability. This allows a non-root process to bind to privileged ports, providing a more secure configuration.
🟡 Warning ci/tests/python-plugins/docker-compose.yml:46-47
The `httpbin.org` service is configured to run as the `root` user to bind to privileged port 80. This violates the principle of least privilege and poses a security risk. If the application were compromised, an attacker would gain root access within the container.
💡 SuggestionAvoid running the container as root. Instead of using `user: "root"`, grant the container the `NET_BIND_SERVICE` capability. This allows a non-root process to bind to privileged ports, providing a more secure configuration.
🟡 Warning ci/tests/tracing/docker-compose.yml:124-125
The `httpbin` service is configured to run as the `root` user to bind to privileged port 80. This violates the principle of least privilege and poses a security risk. If the application were compromised, an attacker would gain root access within the container.
💡 SuggestionAvoid running the container as root. Instead of using `user: "root"`, grant the container the `NET_BIND_SERVICE` capability. This allows a non-root process to bind to privileged ports, providing a more secure configuration.
\n\n ### Architecture Issues (6)
Severity Location Issue
🟡 Warning ci/smoke-tests/plugin-aliasing/docker-compose.yml:23-25
The `httpbin.org` service definition is duplicated across multiple `docker-compose.yml` files. This leads to configuration drift and maintenance overhead, as changes like this one must be manually applied in every file. A base `docker-compose.yml` file with common service definitions should be created, and other files should use the `extends` keyword to inherit and customize these services. This would centralize the configuration for `httpbin.org` and other shared services.
💡 SuggestionTo reduce duplication, define the `httpbin.org` service in a shared `docker-compose.common.yml` or similar base file. Then, in this file and others, use Docker Compose's `extends` feature to inherit the common configuration. For example:

ci/tests/docker-compose.common.yml (New file):

version: &#39;3.8&#39;
services:
  httpbin.org:
    image: mccutchen/go-httpbin@sha256:90ac1702685468aa592938e65b2ba1b4757e0c006934a962ef7271a8717aaa3b
    user: &#34;root&#34;
    command: [&#34;-port&#34;, &#34;80&#34;]

ci/smoke-tests/plugin-aliasing/docker-compose.yml (Updated):

version: &#39;3.8&#39;
services:
  # ... other services

  httpbin.org:
    extends:
      file: ../tests/docker-compose.common.yml
      service: httpbin.org

This approach should be applied to all docker-compose.yml files that use the httpbin.org or httpbin service.
🟡 Warning ci/tests/api-functionality/docker-compose.yml:36-38
The `httpbin.org` service definition is duplicated across multiple `docker-compose.yml` files. This leads to configuration drift and maintenance overhead, as changes like this one must be manually applied in every file. A base `docker-compose.yml` file with common service definitions should be created, and other files should use the `extends` keyword to inherit and customize these services. This would centralize the configuration for `httpbin.org` and other shared services.
💡 SuggestionTo reduce duplication, define the `httpbin.org` service in a shared `docker-compose.common.yml` or similar base file. Then, in this file and others, use Docker Compose's `extends` feature to inherit the common configuration. For example:

ci/tests/docker-compose.common.yml (New file):

version: &#39;3.8&#39;
services:
  httpbin.org:
    image: mccutchen/go-httpbin@sha256:90ac1702685468aa592938e65b2ba1b4757e0c006934a962ef7271a8717aaa3b
    user: &#34;root&#34;
    command: [&#34;-port&#34;, &#34;80&#34;]

ci/tests/api-functionality/docker-compose.yml (Updated):

version: &#39;3.8&#39;
services:
  # ... other services

  httpbin.org:
    extends:
      file: docker-compose.common.yml
      service: httpbin.org

This approach should be applied to all docker-compose.yml files that use the httpbin.org or httpbin service.
🟡 Warning ci/tests/metrics/docker-compose.yml:44-46
The `httpbin` service definition is duplicated across multiple `docker-compose.yml` files. This leads to configuration drift and maintenance overhead, as changes like this one must be manually applied in every file. A base `docker-compose.yml` file with common service definitions should be created, and other files should use the `extends` keyword to inherit and customize these services. This would centralize the configuration for `httpbin` and other shared services.
💡 SuggestionTo reduce duplication, define the `httpbin` service in a shared `docker-compose.common.yml` or similar base file. Then, in this file and others, use Docker Compose's `extends` feature to inherit the common configuration. For example:

ci/tests/docker-compose.common.yml (New file):

version: &#39;3.8&#39;
services:
  httpbin:
    platform: linux/amd64
    image: mccutchen/go-httpbin@sha256:90ac1702685468aa592938e65b2ba1b4757e0c006934a962ef7271a8717aaa3b
    user: &#34;root&#34;
    command: [&#34;-port&#34;, &#34;80&#34;]

ci/tests/metrics/docker-compose.yml (Updated):

version: &#39;3.8&#39;
services:
  # ... other services

  httpbin:
    extends:
      file: docker-compose.common.yml
      service: httpbin

This approach should be applied to all docker-compose.yml files that use the httpbin service.
🟡 Warning ci/tests/plugin-compiler/docker-compose.yml:37-39
The `httpbin.org` service definition is duplicated across multiple `docker-compose.yml` files. This leads to configuration drift and maintenance overhead, as changes like this one must be manually applied in every file. A base `docker-compose.yml` file with common service definitions should be created, and other files should use the `extends` keyword to inherit and customize these services. This would centralize the configuration for `httpbin.org` and other shared services.
💡 SuggestionTo reduce duplication, define the `httpbin.org` service in a shared `docker-compose.common.yml` or similar base file. Then, in this file and others, use Docker Compose's `extends` feature to inherit the common configuration. For example:

ci/tests/docker-compose.common.yml (New file):

version: &#39;3.8&#39;
services:
  httpbin.org:
    image: mccutchen/go-httpbin@sha256:90ac1702685468aa592938e65b2ba1b4757e0c006934a962ef7271a8717aaa3b
    user: &#34;root&#34;
    command: [&#34;-port&#34;, &#34;80&#34;]

ci/tests/plugin-compiler/docker-compose.yml (Updated):

version: &#39;3.8&#39;
services:
  # ... other services

  httpbin.org:
    extends:
      file: docker-compose.common.yml
      service: httpbin.org

This approach should be applied to all docker-compose.yml files that use the httpbin.org or httpbin service.
🟡 Warning ci/tests/python-plugins/docker-compose.yml:46-48
The `httpbin.org` service definition is duplicated across multiple `docker-compose.yml` files. This leads to configuration drift and maintenance overhead, as changes like this one must be manually applied in every file. A base `docker-compose.yml` file with common service definitions should be created, and other files should use the `extends` keyword to inherit and customize these services. This would centralize the configuration for `httpbin.org` and other shared services.
💡 SuggestionTo reduce duplication, define the `httpbin.org` service in a shared `docker-compose.common.yml` or similar base file. Then, in this file and others, use Docker Compose's `extends` feature to inherit the common configuration. For example:

ci/tests/docker-compose.common.yml (New file):

version: &#39;3.8&#39;
services:
  httpbin.org:
    image: mccutchen/go-httpbin@sha256:90ac1702685468aa592938e65b2ba1b4757e0c006934a962ef7271a8717aaa3b
    user: &#34;root&#34;
    command: [&#34;-port&#34;, &#34;80&#34;]

ci/tests/python-plugins/docker-compose.yml (Updated):

version: &#39;3.8&#39;
services:
  # ... other services

  httpbin.org:
    extends:
      file: docker-compose.common.yml
      service: httpbin.org

This approach should be applied to all docker-compose.yml files that use the httpbin.org or httpbin service.
🟡 Warning ci/tests/tracing/docker-compose.yml:124-126
The `httpbin` service definition is duplicated across multiple `docker-compose.yml` files. This leads to configuration drift and maintenance overhead, as changes like this one must be manually applied in every file. A base `docker-compose.yml` file with common service definitions should be created, and other files should use the `extends` keyword to inherit and customize these services. This would centralize the configuration for `httpbin` and other shared services.
💡 SuggestionTo reduce duplication, define the `httpbin` service in a shared `docker-compose.common.yml` or similar base file. Then, in this file and others, use Docker Compose's `extends` feature to inherit the common configuration. For example:

ci/tests/docker-compose.common.yml (New file):

version: &#39;3.8&#39;
services:
  httpbin:
    platform: linux/amd64
    image: mccutchen/go-httpbin@sha256:90ac1702685468aa592938e65b2ba1b4757e0c006934a962ef7271a8717aaa3b
    user: &#34;root&#34;
    command: [&#34;-port&#34;, &#34;80&#34;]

ci/tests/tracing/docker-compose.yml (Updated):

version: &#39;3.8&#39;
services:
  # ... other services

  httpbin:
    extends:
      file: docker-compose.common.yml
      service: httpbin

This approach should be applied to all docker-compose.yml files that use the httpbin service.

✅ Performance Check Passed

No performance issues found – changes LGTM.

Powered by Visor from Probelabs

Last updated: 2026-07-03T09:54:07.620Z | Triggered by: pr_opened | Commit: 7cd9a6b

💡 TIP: You can chat with Visor using /visor ask <your question>

@buger
buger merged commit 1f22f33 into release-5.14.0 Jul 3, 2026
31 of 60 checks passed
@buger
buger deleted the TT-17689-fix-httpbin-port-release-5.14.0 branch July 3, 2026 09:56
@probelabs probelabs Bot mentioned this pull request Jul 6, 2026
Merged
1 task
buger added a commit that referenced this pull request Jul 6, 2026
@probelabs @buger
DX-2386: Revert httpbin test-infra migration to pre-migration baselin…
ade1179 
…e (5.14.0) (#8450)

Reverts the httpbin test-infra migration back to the pre-migration
baseline.

Supersedes/Reverts:
- tyk #8418
- tyk #8428
- tyk #8440

Jira: https://tyktech.atlassian.net/browse/DX-2386
Requested by: U3P2L4XNE
Slack thread: https://slack.com/archives/D09SZABNLG3/p1783328328323169

- [x] No go.mod changes

---------

Co-authored-by: Leonid Bugaev <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@buger