Change the default binding address to localhost.

[stefantalpalaru]

By default, the Prometheus collection endpoint should be served from 0.0.0.0:8008.

Avoid a whole set of HTTP server vulnerabilities by listening only on localhost by default.

[staccDOTsol]

To change the default binding address to localhost for the Prometheus collection endpoint, you can modify the configuration file. Locate the configuration file for Prometheus, which is typically named prometheus.yml. Open the file and find the scrape_configs section.

Within the scrape_configs section, you will find a list of targets. Look for the target that corresponds to the Prometheus collection endpoint, which is usually named prometheus. Under this target, you will find the params section.

To change the binding address to localhost, modify the params section as follows:

params:
  listen_address: localhost:8008

Save the changes to the configuration file and restart the Prometheus service for the changes to take effect. Now, the Prometheus collection endpoint will only be served from localhost on port 8008, reducing the exposure to potential HTTP server vulnerabilities.