DCA Hardened Distributed Tracing Backend for Jaeger — Support & Quick Start

At a glance

Status	Live on Oracle Cloud Marketplace
Version	2.21.0
Platform	Oracle Linux 9
Ports open in the host firewall	SSH (22/tcp), 16686/tcp, 4317/tcp, 4318/tcp
Category	Cloud management
Upstream licence	Apache-2.0
Pricing	Pay-as-you-go software fee per OCPU-hour, billed by Oracle on your OCI invoice — see the listing's Pricing tab

Quick start

This is the listing's usage information, verbatim. Every command in it is run by our QA on a freshly launched instance before an image version can publish, so the text and the tested procedure cannot drift apart.

After launch:

1. Connect over SSH as the opc user with the key you supplied at launch:

   ssh opc@PUBLIC_IP

2. Jaeger runs as a systemd service in all-in-one mode: OTLP ingest on 4317 (gRPC) and 4318 (HTTP), query UI on 16686, loopback-bound. Check status:

   sudo systemctl status jaeger

3. Quickest look at the UI from your workstation — an SSH tunnel, no exposure at all:

   ssh -L 16686:127.0.0.1:16686 opc@PUBLIC_IP
   then browse http://localhost:16686

4. To accept traces from other hosts and open the UI to your network, move 16686, 4317, and 4318 to all interfaces (every other Jaeger port stays on 127.0.0.1):

   sudo sed -i 's/^JAEGER_LISTEN_HOST=127.0.0.1$/JAEGER_LISTEN_HOST=0.0.0.0/' /etc/jaeger/jaeger.env && sudo systemctl restart jaeger

   The instance firewall already permits 16686, 4317, and 4318; your VCN security list must allow them too. The UI has no built-in authentication — keep it inside a private subnet or behind a reverse proxy that adds auth. The query API and MCP tools (/api/ai/mcp/) share port 16686 and the same caveat.

5. The default storage is in-memory: traces do not survive a restart and older traces are evicted under memory pressure. For persistence, configure the badger backend (embedded, on /var/lib/jaeger) or an external Elasticsearch/OpenSearch cluster in /etc/jaeger/config.yaml (reference: https://www.jaegertracing.io/docs/latest/configuration/), then restart.
6. Send a test trace from the instance itself with any OpenTelemetry example app pointed at http://127.0.0.1:4318.

The image is CVE-patched at build time. Apply ongoing updates with:

sudo dnf -y update

What the image provides

• Jaeger 2.21.0 all-in-one, installed from the project's official release with its SHA-256 checksum verified at build time, running as a dedicated unprivileged service.
• OTLP ingest on the standard ports (4317 gRPC, 4318 HTTP) and the query UI on 16686, all loopback-bound by default — you expose them deliberately, and the host firewall already declares exactly these three ports and nothing else.
• A locked-down systemd sandbox (NoNewPrivileges, ProtectSystem, ProtectHome, PrivateTmp) and least-privilege service account.
• Security hardening aligned to the Oracle Cloud Marketplace image standards: SELinux enforcing, host firewall default-deny with only SSH and the three declared ports permitted, no account with a usable password, no stray keys, and the image fully patched at build time.

Fixed issues

Found by our customer-path QA, fixed in a new image version. Launch the current version for new deployments.

• Fixed in 2.21.0 (2026-10-07): On version 2.19.0 the query UI/API (16686, which has no authentication) and the query gRPC port (16685) listened on all interfaces instead of loopback as documented, and the host firewall permitted 16686. 2.21.0 ships an explicit configuration: everything stays on 127.0.0.1 until you run the documented exposure command.
  On an instance launched from 2.19.0: close the UI port in the host firewall and keep it closed in your VCN security list:

  sudo firewall-cmd --permanent --remove-port=16686/tcp && sudo firewall-cmd --reload

Still stuck?

Email support@dcassociatesgroup.com (response within 1 business day) or use the contact form. Include the listing name, your OCI region, the instance OCID and the output of sudo journalctl -u <service> -n 100 for the unit named in the quick start.

Jaeger is a trademark of The Linux Foundation. This image is an independent hardened distribution and is not affiliated with, endorsed by, or sponsored by the Jaeger project, the CNCF, or The Linux Foundation.