Prometheus 3.10.0 introduces distroless Docker images for enhanced security, new PromQL fill() functions for handling missing data, and numerous performance improvements across query execution and TSDB operations.
enhancementConsider migrating to distroless images for production
The new distroless variant provides better security with minimal attack surface and uses proper nonroot UID/GID 65532. Plan migration by adjusting volume ownership and permissions - existing named volumes require ownership changes, and bind mounts may need permission adjustments depending on your setup.
enhancementOptimize memory usage with stale series compaction
Enable experimental `stale_series_compaction_threshold` in your config to automatically compact stale series in memory, reducing memory footprint for workloads with high series churn. Start with conservative thresholds and monitor memory usage patterns.
enhancementBuild custom Prometheus binaries for resource optimization
Use new build tags `remove_all_sd` and `enable_<sd name>_sd` to create smaller Prometheus binaries containing only the service discovery mechanisms you actually use, reducing binary size and potential attack surface in containerized deployments.
Key changes (5)
- Distroless Docker image variant with UID/GID 65532 for enhanced security alongside existing busybox image
- New PromQL fill(), fill_left(), and fill_right() functions for handling missing series with default values
- Experimental stale series compaction in memory with configurable threshold for TSDB optimization
- Independent alertmanager sendloops with new alertmanager dimension in notification metrics
- Modular service discovery build system allowing custom Prometheus builds with only required SDs
