Building compliant observability for Docker extensions

HariSeldon
Tue, 14 Apr 2026 20:28:11 +0000

One more guardrail that helps in practice is signing and pinning the collector config so extensions can’t hot-swap endpoints or disable processors at runtime, even if they’re compromised. That keeps your “collector as sole egress” model enforceable under audit.

Hari