[FEAT] GC 로그 및 JVM 프로파일링 환경 설정#104
Merged
Hidden character warning
The head ref may contain hidden characters: "feat/#103/gc-\ub85c\uadf8-\ubc0f-jvm-\ud504\ub85c\ud30c\uc77c\ub9c1\uc744-\uc704\ud55c-\ud658\uacbd-\uc124\uc815"
Merged
Conversation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
Walkthrough빌드·버전관리에서 JVM 프로파일링 산출물을 제외하고, 컨테이너에 JFR 기록 옵션과 로그 마운트를 추가했으며, 시크릿을 서브모듈로 관리하도록 docker-compose/Dockerfile/CI를 변경하고 Grafana k6 JVM GC 로드 테스트 대시보드를 추가했습니다. ChangesJVM 프로파일링 및 런타임 설정 (관련 파일 그룹)
시크릿 공급 및 배포 흐름 변경 (동일 DAG 내 연쇄 변경)
Sequence Diagram(s)sequenceDiagram
participant Actions
participant TempRepo
participant LocalRepo
participant COMPOSE
Actions->>TempRepo: clone + submodule update --init --recursive
Actions->>LocalRepo: copy temp_repo/.../secrets -> secrets
Actions->>LocalRepo: chmod 600 secrets 파일
Actions->>LocalRepo: validate secrets/.env & firebase json
Actions->>COMPOSE: docker compose --env-file secrets/.env -f docker-compose.yml up -d ...
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related issues
Possibly related PRs
Suggested reviewers
검토 노트
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.gitignore:
- Line 67: 현재 .gitignore에 있는 단일 패턴 "docs/"는 소스 문서 전체를 추적에서 제외해 문서 변경이 Git에 반영되지
않으므로, 의도된 산출물(예: 빌드된 정적 사이트)만 제외하도록 "docs/" 항목을 제거하거나 더 좁은 패턴으로 대체하세요; 예를 들어 정적
빌드 결과를 무시하려면 "docs/_build/" 또는 "docs/site/" 같은 구체적 디렉터리명으로 바꾸고 .gitignore의
"docs/" 항목을 삭제해서 소스 문서(예: docs/*.md 등)는 정상적으로 버전관리되도록 수정하세요.
In `@docker-compose.yml`:
- Around line 49-50: The JAVA_OPTS interpolation uses ${JFR_RUN_ID} but Compose
will not interpolate variables defined only in an env_file, so JFR_RUN_ID falls
back to the default and every JFR file is named the same; to fix this, ensure
JFR_RUN_ID is provided to Docker Compose via a .env file or the shell
environment (export JFR_RUN_ID=...) so the expression in JAVA_OPTS picks up the
real run id, e.g. set JFR_RUN_ID in .env or export it before docker-compose up
rather than relying solely on env_file; keep the existing JAVA_OPTS string
unchanged and reference the same JFR_RUN_ID symbol.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 13a75dd5-4cd1-4b22-8dbd-045b68d544f4
📒 Files selected for processing (3)
.dockerignore.gitignoredocker-compose.yml
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/cicd.yml (1)
125-126:⚠️ Potential issue | 🟠 Major | ⚡ Quick win
GITHUB_TOKEN만으로는 privatesecrets서브모듈 fetch가 실패할 수 있어요.
GITHUB_TOKEN은 워크플로가 실행되는 저장소로만 제한되기 때문에,DorumDorum/secrets가 private 저장소라면 현재 코드의git submodule update가 인증 오류로 실패할 가능성이 있습니다.지금 코드에서는
git insteadOf트릭으로 토큰을 전달하고 있지만, 이 방식도 토큰이 해당 저장소에 접근할 권한이 있어야만 작동합니다. 더 안정적으로 하려면:
- 전용 PAT(Personal Access Token) 또는 GitHub App 토큰을 별도 secret으로 생성한 후, SSH 스크립트에 전달해 주세요
- 해당 토큰에
DorumDorum/secrets저장소 접근 권한이 있는지 확인해 주세요이렇게 하면 배포가 저장소 설정에 의존하지 않고 더 예측 가능해질 거예요.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/cicd.yml around lines 125 - 126, Replace relying solely on GITHUB_TOKEN for submodule fetch with a dedicated PAT/GitHub App token: create a secret (e.g., SECRETS_PAT) containing a PAT that has access to DorumDorum/secrets, update the workflow to export/use that secret instead of GITHUB_TOKEN when running git submodule update (and in any git insteadOf injection), and pass the secret into your SSH/script step so the submodule fetch uses the PAT; verify the PAT has repository access and remove or fallback to GITHUB_TOKEN only for non-private-submodule cases.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile.pinpoint`:
- Around line 41-49: The ENTRYPOINT currently runs java inside a shell via sh -c
which prevents signals from being forwarded to the JVM; update the ENTRYPOINT to
use exec so the shell replaces itself with the java process (e.g., prepend exec
to the java invocation inside the existing sh -c command), keeping the existing
DEFAULT_JAVA_OPTS/EFFECTIVE_JAVA_OPTS logic and all -D flags and -jar
/app/app.jar intact so SIGTERM reaches the JVM and JFR dumponexit works
reliably.
---
Outside diff comments:
In @.github/workflows/cicd.yml:
- Around line 125-126: Replace relying solely on GITHUB_TOKEN for submodule
fetch with a dedicated PAT/GitHub App token: create a secret (e.g., SECRETS_PAT)
containing a PAT that has access to DorumDorum/secrets, update the workflow to
export/use that secret instead of GITHUB_TOKEN when running git submodule update
(and in any git insteadOf injection), and pass the secret into your SSH/script
step so the submodule fetch uses the PAT; verify the PAT has repository access
and remove or fallback to GITHUB_TOKEN only for non-private-submodule cases.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: d10f15e1-c97e-43e2-afaa-451018850a6d
📒 Files selected for processing (7)
.dockerignore.github/workflows/cicd.yml.gitmodulesDockerfileDockerfile.pinpointdocker-compose.ymlsecrets
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docker-compose.yml`:
- Around line 162-180: The k6 service only sets entrypoint and therefore prints
help and exits; add a command to actually run a test script so the container
executes a scenario. Update the k6 service (the block with entrypoint: ["k6"]
and volumes mapping ./load-testing/k6 -> /scripts) to include a command that
invokes k6 to run a script from the mounted /scripts directory (for example use
a run subcommand pointing to /scripts/smoke.js or your chosen script) so the
container starts the load test instead of exiting.
- Around line 50-53: The jfr_logs volume is currently a Docker named volume so
.jfr files are stored inside Docker-managed storage and not accessible on the
host; change the volumes entry that references jfr_logs to a bind mount to the
host path (e.g., replace the named volume reference jfr_logs:/app/logs/jfr with
a bind mount to ./logs/jfr:/app/logs/jfr) so container-created JFR files written
by the application path /app/logs/jfr are persisted to and accessible from the
host ./logs/jfr directory; ensure the mount has appropriate permissions
(read/write) for the container user.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 05cd7c60-c527-4d6d-b003-abf388f0740a
⛔ Files ignored due to path filters (1)
load-testing/README.mdis excluded by!**/*.md
📒 Files selected for processing (8)
.github/workflows/cicd.yml.gitignoreDockerfileDockerfile.pinpointdocker-compose.ymlload-testing/k6/.gitkeepmonitoring/grafana/provisioning/dashboards/json/k6-jvm-gc-load-test.jsonsecrets
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
docker-compose.yml (1)
125-125:⚠️ Potential issue | 🟠 Major | ⚡ Quick win
env_file변경만으로는${SPRING_DATASOURCE_*}보간 안정성이 보장되지 않습니다.
env_file은 컨테이너 환경 주입용이고, Compose 파일의${VAR}보간 소스는 별개라서 실행 방식에 따라 DB 변수들이 빈 값으로 들어가거나env_file값을 덮어쓸 수 있습니다.pinpoint-web의 해당 변수는 보간형 대신 패스스루(또는env_file단독)로 맞춰주시는 게 안전합니다.수정 예시
pinpoint-web: env_file: - ./secrets/.env @@ environment: - SPRING_PROFILES_ACTIVE=release - PINPOINT_ZOOKEEPER_ADDRESS=zoo1:2181 - HBASE_HOST=zoo1 - HBASE_PORT=2181 - - SPRING_DATASOURCE_URL=${SPRING_DATASOURCE_URL} - - SPRING_DATASOURCE_USERNAME=${SPRING_DATASOURCE_USERNAME} - - SPRING_DATASOURCE_PASSWORD=${SPRING_DATASOURCE_PASSWORD} + - SPRING_DATASOURCE_URL + - SPRING_DATASOURCE_USERNAME + - SPRING_DATASOURCE_PASSWORD - SPRING_DATASOURCE_DRIVER_CLASS_NAME=org.postgresql.Driver🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docker-compose.yml` at line 125, 현재 docker-compose 설정에서 pinpoint-web의 DB 관련 변수들이 `${SPRING_DATASOURCE_*}` 보간을 사용하고 있는데, env_file은 컨테이너 런타임 환경 주입용이고 Compose 보간과 충돌할 수 있으므로 보간을 제거하고 패스스루 또는 env_file 단독 방식으로 바꿔야 합니다: pinpoint-web 서비스의 SPRING_DATASOURCE_* 항목을 Docker Compose 상수 보간(`${...}`) 대신 env_file에만 두거나 environment에 그대로 노출(passthrough)되게 변경하여 env_file ./secrets/.env 값을 신뢰하도록 수정하세요.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docker-compose.yml`:
- Line 155: 현재 docker-compose 설정에 남아 있는 "--web.enable-remote-write-receiver"
플래그로 Prometheus가 원격 쓰기 수신을 허용하고 있고 포트 9090이 0.0.0.0에 바인딩되어 있어 인증 없이 접근이 가능합니다;
수정 방법은 docker-compose.yml에서 해당 서비스의 포트 매핑이나 Prometheus 인수 중 하나를 변경하여 접근을 제한하는
것입니다: (1) 가장 간단하게는 Prometheus 런타임 인수에 "--web.listen-address=127.0.0.1:9090"을 추가해
로컬호스트 바인딩으로 제한하거나, (2) 도커 포트 매핑을 127.0.0.1:9090:9090으로 바꿔 외부 노출을 차단하거나, (3) 외부
접근이 필요하면 "--web.enable-remote-write-receiver"를 제거하고 대신 인증/프록시(리버스 프록시나 인증을 적용한
엔드포인트) 뒤에서만 원격 쓰기를 허용하도록 구성하세요; 관련 식별자: "--web.enable-remote-write-receiver",
"--web.listen-address", 포트 9090, docker-compose.yml 서비스의 ports 섹션을 수정하면 됩니다.
---
Duplicate comments:
In `@docker-compose.yml`:
- Line 125: 현재 docker-compose 설정에서 pinpoint-web의 DB 관련 변수들이
`${SPRING_DATASOURCE_*}` 보간을 사용하고 있는데, env_file은 컨테이너 런타임 환경 주입용이고 Compose 보간과
충돌할 수 있으므로 보간을 제거하고 패스스루 또는 env_file 단독 방식으로 바꿔야 합니다: pinpoint-web 서비스의
SPRING_DATASOURCE_* 항목을 Docker Compose 상수 보간(`${...}`) 대신 env_file에만 두거나
environment에 그대로 노출(passthrough)되게 변경하여 env_file ./secrets/.env 값을 신뢰하도록 수정하세요.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: c5ea8c71-c079-45b5-8d52-5a577c368bf5
📒 Files selected for processing (1)
docker-compose.yml
There was a problem hiding this comment.
Pull request overview
Docker Compose 기반 백엔드 컨테이너에 JFR(JVM Flight Recorder) 기록 및 GC 로그 수집 환경을 추가하고, k6 부하테스트 + Prometheus remote-write + Grafana 대시보드로 JVM/GC 관측이 가능하도록 구성한 PR입니다(이슈 #103 해결 목적).
Changes:
- 백엔드 컨테이너 기본 JVM 옵션에 JFR 자동 recording 및 JFR 저장 경로(
/app/logs/jfr)를 추가하고 호스트 볼륨으로 보존 - Prometheus remote-write receiver 활성화 및 k6(loadtest profile) 서비스/대시보드(“k6 JVM GC Load Test”) 추가
- 배포 워크플로우에서 secrets 서브모듈 기반으로
.env/Firebase 키를 제공하도록 변경하고, 로그/프로파일링 산출물 ignore 규칙 정리
Reviewed changes
Copilot reviewed 10 out of 11 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| monitoring/grafana/provisioning/dashboards/json/k6-jvm-gc-load-test.json | k6 + JVM/GC 핵심 지표를 한 화면에서 보는 Grafana 대시보드 추가 |
| load-testing/README.md | k6 실행 방법 및 메트릭 전송(REMOTE WRITE) 기본값 문서화 |
| load-testing/k6/.gitkeep | k6 스크립트 디렉터리 유지용 placeholder 추가 |
| Dockerfile | 컨테이너 시작 시 JFR recording 기본 활성화 및 JFR 로그 디렉터리 생성 |
| Dockerfile.pinpoint | Pinpoint 에이전트 이미지에도 JFR recording 기본 활성화 및 저장 경로 생성 |
| docker-compose.yml | secrets 경로 변경, GC 로그/heap dump 옵션 강화, JFR 볼륨 추가, Prometheus remote-write receiver 및 k6 서비스 추가 |
| .gitmodules | secrets 서브모듈 추가 |
| .gitignore | JFR/heap dump/GC 로그 및 k6 결과물 등 산출물 ignore 추가 |
| .github/workflows/cicd.yml | 배포 시 secrets 서브모듈을 init/copy 하도록 로직 변경 및 불필요한 시크릿 주입 제거 |
| .dockerignore | 빌드 컨텍스트에서 env/secrets 및 프로파일링 산출물 제외 패턴 추가 |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+47
to
48
| - PINPOINT_AGENT_ID=${PINPOINT_AGENT_ID:-dorumdorum-backend-local} | ||
| - PINPOINT_AGENT_NAME=${PINPOINT_AGENT_NAME:-dorumdorum-be} |
| - dorumdorum-net | ||
|
|
||
| k6: | ||
| image: ${K6_IMAGE:-grafana/k6:latest} |
Comment on lines
7
to
+11
| out | ||
| logs | ||
| *.jfr | ||
| *.hprof | ||
| gc.log* |
ydking0911
approved these changes
May 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📝 Pull Request Template
📌 제목
📢 요약
🔗 연관 이슈: Resolves #103
🚀 PR 유형
✅ PR 체크리스트
📜 기타
Summary by CodeRabbit
Chores
New Features