feat(observability): add cadvisor for container metrics

compose.yml

@@ -580,6 +580,25 @@ services:
       - no-new-privileges:true
     restart: unless-stopped
 
+  cadvisor:
+    image: gcr.io/cadvisor/cadvisor:latest
+    container_name: cadvisor
+    networks:
+      - observability
+    privileged: true
+    volumes:
+      - /:/rootfs:ro
+      - ${DOCKER_SOCK:-/run/user/1000/docker.sock}:/var/run/docker.sock:ro
+      - /sys:/sys:ro
+      - /dev/disk/:/dev/disk:ro
+    healthcheck:
+      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8080/healthz"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    restart: unless-stopped
+
   promtail:
     image: grafana/promtail:latest
     container_name: promtail

tests/test_observability.py

@@ -39,3 +39,23 @@ class TestTempo:
         svc = _services()["tempo"]
         mounts = [v for v in svc["volumes"] if "/etc/tempo" in v]
         assert any("./infra/tempo/tempo.yml" in v for v in mounts)
+
+
+class TestCadvisor:
+    def test_cadvisor_service_present(self):
+        svcs = _services()
+        assert "cadvisor" in svcs
+
+    def test_cadvisor_privileged(self):
+        # cadvisor needs privileged for cgroup reads
+        assert _services()["cadvisor"].get("privileged") is True
+
+    def test_cadvisor_mounts(self):
+        svc = _services()["cadvisor"]
+        sources = []
+        for v in svc["volumes"]:
+            if isinstance(v, str):
+                sources.append(v.split(":")[0])
+        # rootfs, sys, /dev/disk needed for resource introspection
+        assert any(s == "/" for s in sources)
+        assert any(s == "/sys" for s in sources)