Repository navigation
Conversation
Contributor
|
Hi, looks good to me, can you please run pre-commit to fix the readme.md formatting issue? |
|
Nice catch: the hardening tool itself having a hole is the kind of drift that stays invisible. How did you find this one, a routine audit, an incident, or a code read? |
rob-paprocki
added a commit
to rob-paprocki/docker-pve
that referenced
this pull request
Oct 24, 2026
…aude workflows (#4) Paperwork: - .github/SECURITY.md names the private-reporting path, the single supported branch, the three documented residual risks (CVE-2026-78122 on docker-socket-proxy, the Debian cloud-image signing gap, and raw socket access held by Dockge/Watchtower-updater/Portainer/agent), and what is explicitly out of scope (upstream containers, Proxmox, Debian, Docker, network). - .github/CODEOWNERS requires repo-owner approval on every file. - .github/pull_request_template.md is a three-section Summary / Test plan / Rollback shape to match the PRs this repo already produces. Upstream tracking: - renovate.json includes config:recommended plus custom regex managers for the five Docker image tags in docker-stack-vm.sh (DOCKGE_TAG, PORTAINER_CE_TAG, PORTAINER_AGENT_TAG, WATCHTOWER_TAG, SOCKET_PROXY_TAG) so renovate opens PRs when any pinned image gets a new tag. Non-major bumps are grouped on a single Monday-morning PR; majors land on their own PR with a `breaking-candidate` label. docker-socket-proxy also gets a `security` label because the CVE-2026-78122 fix (Tecnativa PR #183) will ship as the next patch. - UPSTREAMS.md documents every pinned dependency: source link, breaking signals to watch, bump-by-hand steps, and how to add a new pinned dep so Renovate picks it up. Claude in the loop: - .github/workflows/claude-breaking-review.yml fires on any PR labeled `breaking-candidate`. Uses anthropics/claude-code-action@v1 to read the upstream changelog for the version range being crossed, grep this repo for symbols the upstream flagged as breaking, and comment on the PR with a REAL/NOT/UNCLEAR verdict. Does not approve or merge. Requires CLAUDE_CODE_OAUTH_TOKEN secret; without it the Claude step is a no-op. - .github/workflows/external-upstream-watch.yml runs on the 1st of every month and polls three things Renovate cannot track: * state of Tecnativa/docker-socket-proxy#183 (CVE-2026-78122 fix) * presence of SHA512SUMS.sign at cloud.debian.org/.../trixie/latest * commits touching misc/api.func on community-scripts/ProxmoxVE main since the pinned SHA Each check opens a GitHub issue on state change and dedupes by title to avoid monthly spam. The misc/api.func check uses the quoted-pattern form that actually appears in docker-stack-vm.sh. Humanizer passes applied to every prose file above per the standing rule ([[feedback-humanizer-default-for-docs]]). Claude-Session: https://claude.ai/code/session_01WPVmfNN5LQXUHotm9bJNVX Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR addresses a critical security vulnerability where enabling
CONTAINERS=1unintentionally exposed sensitive container filesystem endpoints (such as/export,/archive, and/logs) via GET requests, allowing arbitrary file reads and full filesystem exports from any container.Changes made
haproxy.cfgfor/archive,/export, and/logsendpoints before the blanketCONTAINERSallow rule.ALLOW_ARCHIVE,ALLOW_EXPORT,ALLOW_LOGS) to control these sensitive endpoints individually, defaulting to0in the Dockerfile.ALLOW_PAUSE=0andALLOW_UNPAUSE=0definitions to the Dockerfile.README.mdand clarified the behavior ofCONTAINERS.tests/test_service.pyto verify thatCONTAINERS=1alone no longer exposes these endpoints and that enabling the specific flags correctly grants access.This ensures that tools needing basic container listing do not inadvertently gain unauthorized filesystem and log access, while preserving backwards compatibility for safe endpoints.
fixes #182