Grafana Tempo 3 Tracing Stack

Why the cloudimg image

The two components that matter most here have no authentication of any kind, so an assembled stack usually ends up publishing an unauthenticated read and write path to its own trace data. cloudimg binds both to the loopback interface and puts a single TLS terminator in front, leaving only SSH and HTTPS reachable, with the plain HTTP port doing nothing but redirecting. Spans still reach the machine from anywhere, over TLS and behind a credential generated for that machine alone, and the unauthenticated transport is documented over an SSH tunnel instead of being exposed.

No credential is baked in, and the image ships with no dashboard database at all, so the administrator account, its password hash and even its salt are created on your own machine at first boot rather than shared between every copy of the image. The TLS key pair, the signing secret and the ingest credential are minted there too, and the query interface and the TLS terminator are both held shut by a boot gate so neither can serve a request before those secrets exist. The vendor default login, a blank password and common guesses are all refused.

Every build proves the product rather than the processes: a span is pushed over each transport, stored, and read back by trace identifier through the provisioned data source, with a control query for an identifier that was never sent. The base is fully patched with unattended security upgrades enabled, the four components are pinned to their minor lines so security fixes still flow, and every image is paired with a step by step deploy guide tested against this exact build and backed by 24/7 cloudimg support.