admin/app-catalog-felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

persistence sweep: 53 templates measured; gramps-web + wishlist fixed; runtime gate added

Browse Source 
Campaign 10's R-156 found papra writing its database into the container's writable layer while the
volume the template preserves stayed empty — a backup that completes, verifies, and contains
nothing. papra was never the point: nothing anywhere checked that the folder a template preserves
is the folder the app writes to. All 53 templates have now been measured live.

43 CLEAN / 3 BROKEN / 7 UNDETERMINED. UNDETERMINED is counted separately, each with its reason,
and never folded into CLEAN.

FIXED (neither app is deployed anywhere, so nothing was stranded):
- gramps-web mounted /app/data, /app/media, /tmp — and /app/data is a path the application never
  writes. Its accounts database and ITS FAMILY TREE both landed in the writable layer while
  gramps_data was tarred nightly as an empty directory. Now persists the eight paths the image's
  own environment names, matching upstream's reference compose. Proven: users.sqlite and the
  family-tree files survive a redeploy byte-identical, same inode.
- wishlist mounted wishlist_data:/data, another path the app never writes; prod.db landed in the
  ANONYMOUS volume from the image's VOLUME directive — absent from ResolveDockerVolumeNames, so
  never backed up, and orphaned by a redeploy. Now mounts /usr/src/app/data + /usr/src/app/uploads.
  Proven: prod.db byte-identical, same inode, across a redeploy.

Every corrected path confirmed by two independent sources — the shipped image's own
environment/Config.Volumes and upstream's reference compose — never inferred from a directory name.

papra is NOT fixed. It is live on one box, and changing the mount target makes the next compose up
recreate the container and destroy the writable layer its documents live in. The fix is prepared
and proven in the scratch guest (current: db.sqlite differs after a redeploy, so a real account
created via the API is lost; fixed: byte-identical, it survives). Referred to the operator with the
two options; no migration written.

NEW GATE scripts/check-volume-persistence.py — the third catalog gate and the only RUNTIME one.
This class is invisible to static analysis, measured not assumed: a static audit of all 53 composes
reports the catalog clean AND reports papra clean. Exit 0 clean / 1 REFUSED / 2 undecided. It
refuses to report at all unless it has just re-proven itself in both directions against two canary
templates that differ only in which path the volume mounts at, so every run carries a live
demonstration of R-156 and of its fix. No docker exec anywhere (Campaign 7 §1.1). 44 fixture tests
driving check(), the function __main__ calls; every rule red-proofed.

Enforcement is convention, not CI — this repo has no CI. Stated plainly in the report; raising it
is proposed as R-160.

Report, per-app evidence, proofs and proposed register entries (R-158..R-161, NOT filed — felhom.eu
is fenced this session): audits/persistence-sweep-2026-08-02/
This commit is contained in:
authentik Default Admin
2026-08-02 12:21:30 +02:00
parent 4252121519
commit 2b22a23d60
92 changed files with 29956 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
audits/persistence-sweep-2026-08-02/state/verify-evidence/bentopdf/probe.json
+69
View File
@@ -0,0 +1,69 @@
{
"probe": {
"app": "bentopdf",
"containers": [
{
"diff_added": 6,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [
{
"added": [],
"changed_count": 2,
"db_signature": false,
"dir": "/",
"files": [
"etc",
"var"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/etc",
"files": [
"nginx"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/var",
"files": [
"cache"
]
}
],
"diff_token_dirs": [],
"diff_total": 14,
"diff_unresolved": [],
"exit": 0,
"gid": 101,
"health": "healthy",
"image": "ghcr.io/alam00000/bentopdf:v2.8.6",
"mounts": [],
"name": "bentopdf",
"restarts": null,
"status": "running",
"uid": 101
}
],
"declared_volumes": [],
"env_keys": [
"DOMAIN",
"HDD_PATH",
"IMPORT_PATH",
"SUBDOMAIN",
"TZ",
"USERDATA_PATH"
],
"exercise": [],
"ports": []
},
"reasons": [
"nothing was written to any mount and nothing data-classified in any writable layer \u2014 the app produced no data to locate. Health is not data: this is UNDETERMINED, not CLEAN"
],
"verdict": "UNDETERMINED"
}
audits/persistence-sweep-2026-08-02/state/verify-evidence/claper/probe.json
+176
View File
@@ -0,0 +1,176 @@
{
"probe": {
"app": "claper",
"containers": [
{
"diff_added": 2,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/",
"files": [
"app"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/app",
"files": [
"priv"
]
},
{
"added": [
"static"
],
"changed_count": 0,
"db_signature": false,
"dir": "/app/priv",
"files": [
"static"
]
},
{
"added": [
"uploads"
],
"changed_count": 0,
"db_signature": false,
"dir": "/app/priv/static",
"files": [
"uploads"
]
}
],
"diff_token_dirs": [],
"diff_total": 4,
"diff_unresolved": [],
"exit": 0,
"gid": 0,
"health": "healthy",
"image": "ghcr.io/claperco/claper:2.5",
"mounts": [
{
"class": "named-declared",
"files": 0,
"name": "volgate-claper_claper_uploads",
"sample": [],
"source": "/var/lib/docker/volumes/volgate-claper_claper_uploads/_data",
"target": "/app/priv/static/uploads",
"writable_by_app": "yes"
}
],
"name": "claper",
"restarts": null,
"status": "running",
"uid": 0
},
{
"diff_added": 2,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/",
"files": [
"run"
]
}
],
"diff_token_dirs": [],
"diff_total": 4,
"diff_unresolved": [],
"exit": 0,
"gid": 70,
"health": "healthy",
"image": "postgres:16-alpine",
"mounts": [
{
"class": "named-declared",
"files": 1469,
"name": "volgate-claper_claper_postgres_data",
"sample": [
"postmaster.opts",
"postgresql.conf",
"postgresql.auto.conf",
"pg_ident.conf",
"pg_hba.conf",
"postmaster.pid",
"PG_VERSION",
"base/1/826",
"base/1/2996",
"base/1/3764",
"base/1/2610_fsm",
"base/1/3603_fsm",
"base/1/1249_vm",
"base/1/3600_fsm",
"base/1/13512",
"base/1/3602",
"base/1/6228",
"base/1/4174",
"base/1/4157",
"base/1/4146",
"base/1/2611",
"base/1/2657",
"base/1/3079_vm",
"base/1/1247_vm",
"base/1/1259",
"base/1/3601_fsm",
"base/1/1417",
"base/1/4155",
"base/1/2668",
"base/1/2831",
"base/1/2841",
"base/1/3607",
"base/1/2836",
"base/1/1255_fsm",
"base/1/2615_vm",
"base/1/3575",
"base/1/2605_vm",
"base/1/2670",
"base/1/6106",
"base/1/4163"
],
"source": "/var/lib/docker/volumes/volgate-claper_claper_postgres_data/_data",
"target": "/var/lib/postgresql/data",
"writable_by_app": "yes"
}
],
"name": "claper-postgres",
"restarts": null,
"status": "running",
"uid": 70
}
],
"declared_volumes": [
"claper_postgres_data",
"claper_uploads"
],
"env_keys": [
"DB_PASSWORD",
"DOMAIN",
"HDD_PATH",
"IMPORT_PATH",
"SECRET_KEY_BASE",
"SUBDOMAIN",
"TZ",
"USERDATA_PATH"
],
"exercise": [],
"ports": []
},
"reasons": [
"claper: this container's mounts are all empty while it created entries in ['/app/priv', '/app/priv/static'] \u2014 benign when a sibling container holds the state, worth a look when none does",
"claper: declared volume /app/priv/static/uploads is EMPTY"
],
"verdict": "CLEAN"
}
audits/persistence-sweep-2026-08-02/state/verify-evidence/docmost/probe.json
+216
View File
@@ -0,0 +1,216 @@
{
"probe": {
"app": "docmost",
"containers": [
{
"diff_added": 1,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/",
"files": [
"app"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/app",
"files": [
"apps"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/app/apps",
"files": [
"client"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/app/apps/client",
"files": [
"dist"
]
},
{
"added": [
"index-template.html"
],
"changed_count": 1,
"db_signature": false,
"dir": "/app/apps/client/dist",
"files": [
"index-template.html"
]
}
],
"diff_token_dirs": [],
"diff_total": 6,
"diff_unresolved": [],
"exit": 0,
"gid": 1000,
"health": "healthy",
"image": "docmost/docmost:0.95.0",
"mounts": [
{
"class": "named-declared",
"files": 0,
"name": "volgate-docmost_docmost_storage",
"sample": [],
"source": "/var/lib/docker/volumes/volgate-docmost_docmost_storage/_data",
"target": "/app/data/storage",
"writable_by_app": "yes"
}
],
"name": "docmost",
"restarts": null,
"status": "running",
"uid": 1000
},
{
"diff_added": 2,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/",
"files": [
"run"
]
}
],
"diff_token_dirs": [],
"diff_total": 4,
"diff_unresolved": [],
"exit": 0,
"gid": 70,
"health": "healthy",
"image": "postgres:16-alpine",
"mounts": [
{
"class": "named-declared",
"files": 1540,
"name": "volgate-docmost_docmost_postgres_data",
"sample": [
"postmaster.opts",
"postgresql.conf",
"postgresql.auto.conf",
"pg_ident.conf",
"pg_hba.conf",
"postmaster.pid",
"PG_VERSION",
"base/1/826",
"base/1/2996",
"base/1/3764",
"base/1/2610_fsm",
"base/1/3603_fsm",
"base/1/1249_vm",
"base/1/3600_fsm",
"base/1/13512",
"base/1/3602",
"base/1/6228",
"base/1/4174",
"base/1/4157",
"base/1/4146",
"base/1/2611",
"base/1/2657",
"base/1/3079_vm",
"base/1/1247_vm",
"base/1/1259",
"base/1/3601_fsm",
"base/1/1417",
"base/1/4155",
"base/1/2668",
"base/1/2831",
"base/1/2841",
"base/1/3607",
"base/1/2836",
"base/1/1255_fsm",
"base/1/2615_vm",
"base/1/3575",
"base/1/2605_vm",
"base/1/2670",
"base/1/6106",
"base/1/4163"
],
"source": "/var/lib/docker/volumes/volgate-docmost_docmost_postgres_data/_data",
"target": "/var/lib/postgresql/data",
"writable_by_app": "yes"
}
],
"name": "docmost-postgres",
"restarts": null,
"status": "running",
"uid": 70
},
{
"diff_added": 0,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [],
"diff_token_dirs": [],
"diff_total": 0,
"diff_unresolved": [],
"exit": 0,
"gid": 1000,
"health": "healthy",
"image": "redis:7-alpine",
"mounts": [
{
"class": "named-declared",
"files": 3,
"name": "volgate-docmost_docmost_redis_data",
"sample": [
"appendonlydir/appendonly.aof.1.base.rdb",
"appendonlydir/appendonly.aof.1.incr.aof",
"appendonlydir/appendonly.aof.manifest"
],
"source": "/var/lib/docker/volumes/volgate-docmost_docmost_redis_data/_data",
"target": "/data",
"writable_by_app": "yes"
}
],
"name": "docmost-redis",
"restarts": null,
"status": "running",
"uid": 999
}
],
"declared_volumes": [
"docmost_postgres_data",
"docmost_redis_data",
"docmost_storage"
],
"env_keys": [
"APP_SECRET",
"DB_PASSWORD",
"DOMAIN",
"HDD_PATH",
"IMPORT_PATH",
"SUBDOMAIN",
"TZ",
"USERDATA_PATH"
],
"exercise": [],
"ports": []
},
"reasons": [
"docmost: this container's mounts are all empty while it created entries in ['/app/apps/client/dist'] \u2014 benign when a sibling container holds the state, worth a look when none does",
"docmost: declared volume /app/data/storage is EMPTY"
],
"verdict": "CLEAN"
}
audits/persistence-sweep-2026-08-02/state/verify-evidence/glance/probe.json
+73
View File
@@ -0,0 +1,73 @@
{
"probe": {
"app": "glance",
"containers": [
{
"diff_added": 1,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/",
"files": [
"app"
]
},
{
"added": [
"config"
],
"changed_count": 0,
"db_signature": false,
"dir": "/app",
"files": [
"config"
]
}
],
"diff_token_dirs": [],
"diff_total": 2,
"diff_unresolved": [],
"exit": 1,
"gid": null,
"health": "unhealthy",
"image": "glanceapp/glance:v0.8.5",
"mounts": [
{
"class": "named-declared",
"files": 0,
"name": "volgate-glance_glance_config",
"sample": [],
"source": "/var/lib/docker/volumes/volgate-glance_glance_config/_data",
"target": "/app/config",
"writable_by_app": "unknown-uid"
}
],
"name": "glance",
"restarts": null,
"status": "restarting",
"uid": null
}
],
"declared_volumes": [
"glance_config"
],
"env_keys": [
"DOMAIN",
"HDD_PATH",
"IMPORT_PATH",
"SUBDOMAIN",
"TZ",
"USERDATA_PATH"
],
"exercise": [],
"ports": []
},
"reasons": [
"glance: not running (status=restarting exit=1 restarts=None)"
],
"verdict": "UNDETERMINED"
}
audits/persistence-sweep-2026-08-02/state/verify-evidence/gramps-web/probe.json
+265
View File
@@ -0,0 +1,265 @@
{
"probe": {
"app": "gramps-web",
"containers": [
{
"diff_added": 127,
"diff_benign_db_touches": [],
"diff_data_dirs": [
{
"added": [
"users.sqlite"
],
"changed_count": 0,
"db_signature": true,
"dir": "/app/users",
"files": [
"users.sqlite"
]
}
],
"diff_other_dirs": [
{
"added": [],
"changed_count": 3,
"db_signature": false,
"dir": "/",
"files": [
"app",
"root",
"usr"
]
},
{
"added": [
"data"
],
"changed_count": 4,
"db_signature": false,
"dir": "/app",
"files": [
"data"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/app/cache",
"files": [
"request_cache"
]
},
{
"added": [
"2029240f6d1128be89ddc32729463129"
],
"changed_count": 0,
"db_signature": false,
"dir": "/app/cache/request_cache",
"files": [
"2029240f6d1128be89ddc32729463129"
]
},
{
"added": [],
"changed_count": 2,
"db_signature": false,
"dir": "/app/src",
"files": [
"alembic_users",
"gramps_webapi"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/app/src/alembic_users",
"files": [
"versions"
]
},
{
"added": [],
"changed_count": 3,
"db_signature": false,
"dir": "/app/src/gramps_webapi",
"files": [
"api",
"auth",
"util"
]
},
{
"added": [],
"changed_count": 2,
"db_signature": false,
"dir": "/app/src/gramps_webapi/api",
"files": [
"resources",
"search"
]
},
{
"added": [
"2029240f6d1128be89ddc32729463129"
],
"changed_count": 0,
"db_signature": false,
"dir": "/app/thumbnail_cache",
"files": [
"2029240f6d1128be89ddc32729463129"
]
},
{
"added": [
".gramps"
],
"changed_count": 1,
"db_signature": false,
"dir": "/root",
"files": [
".gramps"
]
},
{
"added": [
"grampsdb"
],
"changed_count": 0,
"db_signature": false,
"dir": "/root/.gramps",
"files": [
"grampsdb"
]
},
{
"added": [
"edaa44da-5ceb-4855-966e-8462f6b067f7"
],
"changed_count": 0,
"db_signature": false,
"dir": "/root/.gramps/grampsdb",
"files": [
"edaa44da-5ceb-4855-966e-8462f6b067f7"
]
},
{
"added": [
"name.txt",
"database.txt"
],
"changed_count": 0,
"db_signature": false,
"dir": "/root/.gramps/grampsdb/edaa44da-5ceb-4855-966e-8462f6b067f7",
"files": [
"name.txt",
"database.txt"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/root/gramps",
"files": [
"gramps60"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/root/gramps/gramps60",
"files": [
"plugins"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/root/gramps/gramps60/plugins",
"files": [
"FilterRules"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/usr",
"files": [
"lib"
]
}
],
"diff_token_dirs": [],
"diff_total": 153,
"diff_unresolved": [],
"exit": 0,
"gid": 0,
"health": "healthy",
"image": "ghcr.io/gramps-project/grampsweb:v25.6.0",
"mounts": [
{
"class": "named-declared",
"files": 0,
"name": "volgate-grampsweb_gramps_data",
"sample": [],
"source": "/var/lib/docker/volumes/volgate-grampsweb_gramps_data/_data",
"target": "/app/data",
"writable_by_app": "yes"
},
{
"class": "named-declared",
"files": 0,
"name": "volgate-grampsweb_gramps_media",
"sample": [],
"source": "/var/lib/docker/volumes/volgate-grampsweb_gramps_media/_data",
"target": "/app/media",
"writable_by_app": "yes"
},
{
"class": "named-declared",
"files": 0,
"name": "volgate-grampsweb_gramps_tmp",
"sample": [],
"source": "/var/lib/docker/volumes/volgate-grampsweb_gramps_tmp/_data",
"target": "/tmp",
"writable_by_app": "yes"
}
],
"name": "gramps-web",
"restarts": null,
"status": "running",
"uid": 0
}
],
"declared_volumes": [
"gramps_data",
"gramps_media",
"gramps_tmp"
],
"env_keys": [
"DOMAIN",
"GRAMPSWEB_SECRET_KEY",
"HDD_PATH",
"IMPORT_PATH",
"SUBDOMAIN",
"TZ",
"USERDATA_PATH"
],
"exercise": [],
"ports": []
},
"reasons": [
"gramps-web: DATA in the writable layer at /app/users (db_signature=True, e.g. ['users.sqlite'])",
"NOTHING this app wrote landed in ANY folder the template preserves: all 2 mount(s) across 1 container(s) are empty, yet entries were created in ['/app', '/app/cache/request_cache', '/app/thumbnail_cache', '/root']. Needs adjudication.",
"gramps-web: this container's mounts are all empty while it created entries in ['/app', '/app/cache/request_cache', '/app/thumbnail_cache'] \u2014 benign when a sibling container holds the state, worth a look when none does",
"gramps-web: declared volume /app/data is EMPTY",
"gramps-web: declared volume /app/media is EMPTY"
],
"verdict": "BROKEN"
}
audits/persistence-sweep-2026-08-02/state/verify-evidence/immich/probe.json
+329
View File
@@ -0,0 +1,329 @@
{
"probe": {
"app": "immich",
"containers": [
{
"diff_added": 6,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [
{
"added": [
"cache"
],
"changed_count": 1,
"db_signature": false,
"dir": "/",
"files": [
"cache"
]
},
{
"added": [
".config"
],
"changed_count": 0,
"db_signature": false,
"dir": "/root",
"files": [
".config"
]
},
{
"added": [
"matplotlib"
],
"changed_count": 0,
"db_signature": false,
"dir": "/root/.config",
"files": [
"matplotlib"
]
}
],
"diff_token_dirs": [],
"diff_total": 7,
"diff_unresolved": [],
"exit": 0,
"gid": 0,
"health": "healthy",
"image": "ghcr.io/immich-app/immich-machine-learning:v3.0.3",
"mounts": [
{
"class": "named-declared",
"files": 0,
"name": "volgate-immich_immich_ml_cache",
"sample": [],
"source": "/var/lib/docker/volumes/volgate-immich_immich_ml_cache/_data",
"target": "/cache",
"writable_by_app": "yes"
}
],
"name": "immich-machine-learning",
"restarts": null,
"status": "running",
"uid": 0
},
{
"diff_added": 3,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [
{
"added": [],
"changed_count": 2,
"db_signature": false,
"dir": "/",
"files": [
"etc",
"run"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/etc",
"files": [
"postgresql"
]
},
{
"added": [
"postgresql.conf"
],
"changed_count": 0,
"db_signature": false,
"dir": "/etc/postgresql",
"files": [
"postgresql.conf"
]
}
],
"diff_token_dirs": [],
"diff_total": 7,
"diff_unresolved": [],
"exit": 0,
"gid": 999,
"health": "healthy",
"image": "ghcr.io/immich-app/postgres:16-vectorchord0.4.3-pgvectors0.2.0",
"mounts": [
{
"class": "named-declared",
"files": 1832,
"name": "volgate-immich_immich_postgres_data",
"sample": [
"postmaster.opts",
"postgresql.conf",
"postgresql.auto.conf",
"pg_ident.conf",
"pg_hba.conf",
"postmaster.pid",
"PG_VERSION",
"base/1/826",
"base/1/2996",
"base/1/3764",
"base/1/2610_fsm",
"base/1/3603_fsm",
"base/1/1249_vm",
"base/1/3600_fsm",
"base/1/3602",
"base/1/6228",
"base/1/4174",
"base/1/4157",
"base/1/4146",
"base/1/2611",
"base/1/2657",
"base/1/3079_vm",
"base/1/1247_vm",
"base/1/13406",
"base/1/1259",
"base/1/3601_fsm",
"base/1/1417",
"base/1/4155",
"base/1/2668",
"base/1/2831",
"base/1/2841",
"base/1/13414",
"base/1/3607",
"base/1/2836",
"base/1/1255_fsm",
"base/1/2615_vm",
"base/1/3575",
"base/1/2605_vm",
"base/1/2670",
"base/1/6106"
],
"source": "/var/lib/docker/volumes/volgate-immich_immich_postgres_data/_data",
"target": "/var/lib/postgresql/data",
"writable_by_app": "yes"
}
],
"name": "immich-postgres",
"restarts": null,
"status": "running",
"uid": 999
},
{
"diff_added": 0,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [],
"diff_token_dirs": [],
"diff_total": 0,
"diff_unresolved": [],
"exit": 0,
"gid": 1000,
"health": "healthy",
"image": "redis:7-alpine",
"mounts": [
{
"class": "named-declared",
"files": 3,
"name": "volgate-immich_immich_redis_data",
"sample": [
"appendonlydir/appendonly.aof.1.base.rdb",
"appendonlydir/appendonly.aof.1.incr.aof",
"appendonlydir/appendonly.aof.manifest"
],
"source": "/var/lib/docker/volumes/volgate-immich_immich_redis_data/_data",
"target": "/data",
"writable_by_app": "yes"
}
],
"name": "immich-redis",
"restarts": null,
"status": "running",
"uid": 999
},
{
"diff_added": 4,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [
{
"added": [
"external",
"data"
],
"changed_count": 1,
"db_signature": false,
"dir": "/",
"files": [
"external",
"data"
]
},
{
"added": [
"photos"
],
"changed_count": 0,
"db_signature": false,
"dir": "/external",
"files": [
"photos"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/usr",
"files": [
"src"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/usr/src",
"files": [
"app"
]
},
{
"added": [
"upload"
],
"changed_count": 0,
"db_signature": false,
"dir": "/usr/src/app",
"files": [
"upload"
]
}
],
"diff_token_dirs": [],
"diff_total": 7,
"diff_unresolved": [],
"exit": 0,
"gid": 0,
"health": "healthy",
"image": "ghcr.io/immich-app/immich-server:v3.0.3",
"mounts": [
{
"class": "bind",
"files": 6,
"name": null,
"sample": [
"library/.immich",
"upload/.immich",
"profile/.immich",
"encoded-video/.immich",
"thumbs/.immich",
"backups/.immich"
],
"source": "/srv/felhom-gate/hdd/appdata/immich",
"target": "/usr/src/app/upload",
"writable_by_app": "yes"
},
{
"class": "bind",
"files": 0,
"name": null,
"sample": [],
"source": "/srv/felhom-gate/hdd/userdata/media/photos",
"target": "/external/photos",
"writable_by_app": "yes"
},
{
"class": "anonymous",
"files": 0,
"name": "51538436a985b60deb1473d5837733528b3440627b2f7761b235f8bd92010975",
"sample": [],
"source": "/var/lib/docker/volumes/51538436a985b60deb1473d5837733528b3440627b2f7761b235f8bd92010975/_data",
"target": "/data",
"writable_by_app": "yes"
}
],
"name": "immich-server",
"restarts": null,
"status": "running",
"uid": 0
}
],
"declared_volumes": [
"immich_ml_cache",
"immich_postgres_data",
"immich_redis_data"
],
"env_keys": [
"DB_PASSWORD",
"DOMAIN",
"HDD_PATH",
"IMPORT_PATH",
"SUBDOMAIN",
"TZ",
"USERDATA_PATH"
],
"exercise": [],
"ports": []
},
"reasons": [
"immich-machine-learning: this container's mounts are all empty while it created entries in ['/', '/root', '/root/.config'] \u2014 benign when a sibling container holds the state, worth a look when none does",
"immich-machine-learning: declared volume /cache is EMPTY"
],
"verdict": "CLEAN"
}
audits/persistence-sweep-2026-08-02/state/verify-evidence/papra/probe.json
+99
View File
@@ -0,0 +1,99 @@
{
"probe": {
"app": "papra",
"containers": [
{
"diff_added": 173,
"diff_benign_db_touches": [],
"diff_data_dirs": [
{
"added": [
"db.sqlite"
],
"changed_count": 0,
"db_signature": true,
"dir": "/app/app-data/db",
"files": [
"db.sqlite"
]
}
],
"diff_other_dirs": [
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/",
"files": [
"app"
]
},
{
"added": [
"data"
],
"changed_count": 1,
"db_signature": false,
"dir": "/app",
"files": [
"data"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/app/app-data",
"files": [
"db"
]
}
],
"diff_token_dirs": [],
"diff_total": 177,
"diff_unresolved": [],
"exit": 0,
"gid": 999,
"health": "healthy",
"image": "ghcr.io/papra-hq/papra:26.6.1-rootless",
"mounts": [
{
"class": "named-declared",
"files": 0,
"name": "volgate-papra_papra_data",
"sample": [],
"source": "/var/lib/docker/volumes/volgate-papra_papra_data/_data",
"target": "/app/data",
"writable_by_app": "NO"
}
],
"name": "papra",
"restarts": null,
"status": "running",
"uid": 999
}
],
"declared_volumes": [
"papra_data"
],
"env_keys": [
"AUTH_SECRET",
"DOMAIN",
"HDD_PATH",
"IMPORT_PATH",
"SUBDOMAIN",
"TZ",
"USERDATA_PATH"
],
"exercise": [],
"ports": []
},
"reasons": [
"papra: mount /app/data is NOT writable by the app's own uid=999 gid=999",
"papra: DATA in the writable layer at /app/app-data/db (db_signature=True, e.g. ['db.sqlite'])",
"NOTHING this app wrote landed in ANY folder the template preserves: all 1 mount(s) across 1 container(s) are empty, yet entries were created in ['/app']. Needs adjudication.",
"papra: this container's mounts are all empty while it created entries in ['/app'] \u2014 benign when a sibling container holds the state, worth a look when none does",
"papra: declared volume /app/data is EMPTY"
],
"verdict": "BROKEN"
}
audits/persistence-sweep-2026-08-02/state/verify-evidence/plant-it/probe.json
+10
View File
@@ -0,0 +1,10 @@
{
"probe": {
"app": "plant-it",
"error": "no containers created (compose up rc=1: msdeluise/plant-it:0.10.0 Pulling \n Image msdeluise/plant-it:0.10.0 Error pull access denied for msdeluise/plant-it, repository does not exist or may require 'docker login'\nError response from daemon: pull access denied for msdeluise/plant-it, repository does not exist or may require 'docker login'\n)"
},
"reasons": [
"no containers created (compose up rc=1: msdeluise/plant-it:0.10.0 Pulling \n Image msdeluise/plant-it:0.10.0 Error pull access denied for msdeluise/plant-it, repository does not exist or may require 'docker login'\nError response from daemon: pull access denied for msdeluise/plant-it, repository does not exist or may require 'docker login'\n)"
],
"verdict": "UNDETERMINED"
}
audits/persistence-sweep-2026-08-02/state/verify-evidence/privatebin/probe.json
+95
View File
@@ -0,0 +1,95 @@
{
"probe": {
"app": "privatebin",
"containers": [
{
"diff_added": 0,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [],
"diff_token_dirs": [],
"diff_total": 0,
"diff_unresolved": [],
"exit": 0,
"gid": 82,
"health": "healthy",
"image": "privatebin/pdo:2.0.5",
"mounts": [
{
"class": "anonymous",
"files": 0,
"name": "81f6e29600a6e6cbaa58dda4e144909abf098adc3c6116ca85166068c6a02e34",
"sample": [],
"source": "/var/lib/docker/volumes/81f6e29600a6e6cbaa58dda4e144909abf098adc3c6116ca85166068c6a02e34/_data",
"target": "/var/lib/nginx/tmp",
"writable_by_app": "yes"
},
{
"class": "named-declared",
"files": 0,
"name": "volgate-privatebin_privatebin_data",
"sample": [],
"source": "/var/lib/docker/volumes/volgate-privatebin_privatebin_data/_data",
"target": "/srv/data",
"writable_by_app": "yes"
},
{
"class": "anonymous",
"files": 14,
"name": "6c40818b0f3ef0f6687a2394c61219df6a1d806829e2c6d45c137c9e62427a14",
"sample": [
"nginx.pid",
"php-fpm.sock",
"services/.s6-svscan/control",
"services/.s6-svscan/lock",
"services/php-fpm85/run",
"services/php-fpm85/supervise/control",
"services/php-fpm85/supervise/death_tally",
"services/php-fpm85/supervise/status",
"services/php-fpm85/supervise/lock",
"services/nginx/run",
"services/nginx/supervise/control",
"services/nginx/supervise/death_tally",
"services/nginx/supervise/status",
"services/nginx/supervise/lock"
],
"source": "/var/lib/docker/volumes/6c40818b0f3ef0f6687a2394c61219df6a1d806829e2c6d45c137c9e62427a14/_data",
"target": "/run",
"writable_by_app": "yes"
},
{
"class": "anonymous",
"files": 0,
"name": "660faab3050406b4dac39dedfc189331d712fb02b3990aed2e81033a08917cf3",
"sample": [],
"source": "/var/lib/docker/volumes/660faab3050406b4dac39dedfc189331d712fb02b3990aed2e81033a08917cf3/_data",
"target": "/tmp",
"writable_by_app": "yes"
}
],
"name": "privatebin",
"restarts": null,
"status": "running",
"uid": 65534
}
],
"declared_volumes": [
"privatebin_data"
],
"env_keys": [
"DOMAIN",
"HDD_PATH",
"IMPORT_PATH",
"SUBDOMAIN",
"TZ",
"USERDATA_PATH"
],
"exercise": [],
"ports": []
},
"reasons": [
"nothing was written to any mount and nothing data-classified in any writable layer \u2014 the app produced no data to locate. Health is not data: this is UNDETERMINED, not CLEAN",
"privatebin: declared volume /srv/data is EMPTY"
],
"verdict": "UNDETERMINED"
}
audits/persistence-sweep-2026-08-02/state/verify-evidence/recipe-importer/probe.json
+94
View File
@@ -0,0 +1,94 @@
{
"probe": {
"app": "recipe-importer",
"containers": [
{
"diff_added": 13,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [
{
"added": [
"data"
],
"changed_count": 2,
"db_signature": false,
"dir": "/",
"files": [
"data"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/app",
"files": [
"app"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/usr",
"files": [
"local"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/usr/local",
"files": [
"lib"
]
}
],
"diff_token_dirs": [],
"diff_total": 22,
"diff_unresolved": [],
"exit": 0,
"gid": 0,
"health": "healthy",
"image": "gitea.dooplex.hu/admin/recipe-importer:v0.9.11",
"mounts": [
{
"class": "named-declared",
"files": 0,
"name": "volgate-recipeimporter_recipe_data",
"sample": [],
"source": "/var/lib/docker/volumes/volgate-recipeimporter_recipe_data/_data",
"target": "/data",
"writable_by_app": "yes"
}
],
"name": "recipe-importer",
"restarts": null,
"status": "running",
"uid": 0
}
],
"declared_volumes": [
"recipe_data"
],
"env_keys": [
"DOMAIN",
"HDD_PATH",
"IMPORT_PATH",
"SECRET_KEY",
"SUBDOMAIN",
"TZ",
"USERDATA_PATH"
],
"exercise": [],
"ports": []
},
"reasons": [
"NOTHING this app wrote landed in ANY folder the template preserves: all 1 mount(s) across 1 container(s) are empty, yet entries were created in ['/']. Needs adjudication.",
"recipe-importer: this container's mounts are all empty while it created entries in ['/'] \u2014 benign when a sibling container holds the state, worth a look when none does",
"recipe-importer: declared volume /data is EMPTY"
],
"verdict": "UNDETERMINED"
}
audits/persistence-sweep-2026-08-02/state/verify-evidence/sparkyfitness/probe.json
+230
View File
@@ -0,0 +1,230 @@
{
"probe": {
"app": "sparkyfitness",
"containers": [
{
"diff_added": 11,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [
{
"added": [],
"changed_count": 3,
"db_signature": false,
"dir": "/",
"files": [
"etc",
"var",
"run"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/etc",
"files": [
"nginx"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/var",
"files": [
"cache"
]
}
],
"diff_token_dirs": [],
"diff_total": 19,
"diff_unresolved": [],
"exit": 0,
"gid": 0,
"health": "healthy",
"image": "codewithcj/sparkyfitness:v0.17.3",
"mounts": [],
"name": "sparkyfitness",
"restarts": null,
"status": "running",
"uid": 0
},
{
"diff_added": 2,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/",
"files": [
"run"
]
}
],
"diff_token_dirs": [],
"diff_total": 4,
"diff_unresolved": [],
"exit": 0,
"gid": 70,
"health": "healthy",
"image": "postgres:15-alpine",
"mounts": [
{
"class": "named-declared",
"files": 1814,
"name": "volgate-sparkyfitness_sparkyfitness_db_data",
"sample": [
"pgdata/postmaster.opts",
"pgdata/postgresql.conf",
"pgdata/postgresql.auto.conf",
"pgdata/pg_ident.conf",
"pgdata/pg_hba.conf",
"pgdata/postmaster.pid",
"pgdata/PG_VERSION",
"pgdata/base/1/826",
"pgdata/base/1/2996",
"pgdata/base/1/3764",
"pgdata/base/1/2610_fsm",
"pgdata/base/1/3603_fsm",
"pgdata/base/1/1249_vm",
"pgdata/base/1/3600_fsm",
"pgdata/base/1/13506_vm",
"pgdata/base/1/3602",
"pgdata/base/1/6228",
"pgdata/base/1/4174",
"pgdata/base/1/4157",
"pgdata/base/1/4146",
"pgdata/base/1/2611",
"pgdata/base/1/2657",
"pgdata/base/1/3079_vm",
"pgdata/base/1/1247_vm",
"pgdata/base/1/13501_fsm",
"pgdata/base/1/1259",
"pgdata/base/1/3601_fsm",
"pgdata/base/1/1417",
"pgdata/base/1/4155",
"pgdata/base/1/2668",
"pgdata/base/1/13491_fsm",
"pgdata/base/1/2831",
"pgdata/base/1/2841",
"pgdata/base/1/3607",
"pgdata/base/1/2836",
"pgdata/base/1/1255_fsm",
"pgdata/base/1/2615_vm",
"pgdata/base/1/3575",
"pgdata/base/1/2605_vm",
"pgdata/base/1/2670"
],
"source": "/var/lib/docker/volumes/volgate-sparkyfitness_sparkyfitness_db_data/_data",
"target": "/var/lib/postgresql/data",
"writable_by_app": "yes"
}
],
"name": "sparkyfitness-db",
"restarts": null,
"status": "running",
"uid": 70
},
{
"diff_added": 392,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/",
"files": [
"app"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/app",
"files": [
"SparkyFitnessServer"
]
},
{
"added": [
"uploads",
"backup",
"temp_uploads"
],
"changed_count": 0,
"db_signature": false,
"dir": "/app/SparkyFitnessServer",
"files": [
"uploads",
"backup",
"temp_uploads"
]
}
],
"diff_token_dirs": [],
"diff_total": 395,
"diff_unresolved": [],
"exit": 0,
"gid": 0,
"health": "healthy",
"image": "codewithcj/sparkyfitness_server:v0.17.3",
"mounts": [
{
"class": "named-declared",
"files": 0,
"name": "volgate-sparkyfitness_sparkyfitness_uploads",
"sample": [],
"source": "/var/lib/docker/volumes/volgate-sparkyfitness_sparkyfitness_uploads/_data",
"target": "/app/SparkyFitnessServer/uploads",
"writable_by_app": "yes"
},
{
"class": "named-declared",
"files": 0,
"name": "volgate-sparkyfitness_sparkyfitness_backup",
"sample": [],
"source": "/var/lib/docker/volumes/volgate-sparkyfitness_sparkyfitness_backup/_data",
"target": "/app/SparkyFitnessServer/backup",
"writable_by_app": "yes"
}
],
"name": "sparkyfitness-server",
"restarts": null,
"status": "running",
"uid": 0
}
],
"declared_volumes": [
"sparkyfitness_backup",
"sparkyfitness_db_data",
"sparkyfitness_uploads"
],
"env_keys": [
"API_ENCRYPTION_KEY",
"APP_DB_PASSWORD",
"BETTER_AUTH_SECRET",
"DB_PASSWORD",
"DOMAIN",
"HDD_PATH",
"IMPORT_PATH",
"SUBDOMAIN",
"TZ",
"USERDATA_PATH"
],
"exercise": [],
"ports": []
},
"reasons": [
"sparkyfitness-server: this container's mounts are all empty while it created entries in ['/app/SparkyFitnessServer'] \u2014 benign when a sibling container holds the state, worth a look when none does",
"sparkyfitness-server: declared volume /app/SparkyFitnessServer/uploads is EMPTY",
"sparkyfitness-server: declared volume /app/SparkyFitnessServer/backup is EMPTY"
],
"verdict": "CLEAN"
}
audits/persistence-sweep-2026-08-02/state/verify-evidence/uptime-kuma/probe.json
+53
View File
@@ -0,0 +1,53 @@
{
"probe": {
"app": "uptime-kuma",
"containers": [
{
"diff_added": 0,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [],
"diff_token_dirs": [],
"diff_total": 0,
"diff_unresolved": [],
"exit": 0,
"gid": 0,
"health": "healthy",
"image": "louislam/uptime-kuma:2.4.0",
"mounts": [
{
"class": "named-declared",
"files": 0,
"name": "volgate-uptimekuma_uptime_kuma_data",
"sample": [],
"source": "/var/lib/docker/volumes/volgate-uptimekuma_uptime_kuma_data/_data",
"target": "/app/data",
"writable_by_app": "yes"
}
],
"name": "uptime-kuma",
"restarts": null,
"status": "running",
"uid": 0
}
],
"declared_volumes": [
"uptime_kuma_data"
],
"env_keys": [
"DOMAIN",
"HDD_PATH",
"IMPORT_PATH",
"SUBDOMAIN",
"TZ",
"USERDATA_PATH"
],
"exercise": [],
"ports": []
},
"reasons": [
"nothing was written to any mount and nothing data-classified in any writable layer \u2014 the app produced no data to locate. Health is not data: this is UNDETERMINED, not CLEAN",
"uptime-kuma: declared volume /app/data is EMPTY"
],
"verdict": "UNDETERMINED"
}
audits/persistence-sweep-2026-08-02/state/verify-evidence/wanderer/probe.json
+193
View File
@@ -0,0 +1,193 @@
{
"probe": {
"app": "wanderer",
"containers": [
{
"diff_added": 6,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/",
"files": [
"root"
]
},
{
"added": [
".npm"
],
"changed_count": 0,
"db_signature": false,
"dir": "/root",
"files": [
".npm"
]
}
],
"diff_token_dirs": [],
"diff_total": 8,
"diff_unresolved": [],
"exit": 0,
"gid": 0,
"health": "unhealthy",
"image": "flomp/wanderer-web:v0.20.0",
"mounts": [
{
"class": "named-declared",
"files": 0,
"name": "volgate-wanderer_wanderer_uploads",
"sample": [],
"source": "/var/lib/docker/volumes/volgate-wanderer_wanderer_uploads/_data",
"target": "/app/uploads",
"writable_by_app": "yes"
}
],
"name": "wanderer",
"restarts": null,
"status": "running",
"uid": 0
},
{
"diff_added": 3,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [
{
"added": [
"data",
"pb_data"
],
"changed_count": 0,
"db_signature": false,
"dir": "/",
"files": [
"data",
"pb_data"
]
}
],
"diff_token_dirs": [
{
"added": [
"plugins"
],
"changed_count": 0,
"db_signature": false,
"dir": "/data",
"files": [
"plugins"
]
}
],
"diff_total": 3,
"diff_unresolved": [],
"exit": 0,
"gid": 0,
"health": "healthy",
"image": "flomp/wanderer-db:v0.20.0",
"mounts": [
{
"class": "named-declared",
"files": 6,
"name": "volgate-wanderer_wanderer_data",
"sample": [
"auxiliary.db-wal",
"data.db",
"data.db-wal",
"auxiliary.db",
"auxiliary.db-shm",
"data.db-shm"
],
"source": "/var/lib/docker/volumes/volgate-wanderer_wanderer_data/_data",
"target": "/pb_data",
"writable_by_app": "yes"
},
{
"class": "named-declared",
"files": 0,
"name": "volgate-wanderer_wanderer_plugins",
"sample": [],
"source": "/var/lib/docker/volumes/volgate-wanderer_wanderer_plugins/_data",
"target": "/data/plugins",
"writable_by_app": "yes"
}
],
"name": "wanderer-db",
"restarts": null,
"status": "running",
"uid": 0
},
{
"diff_added": 0,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [],
"diff_token_dirs": [],
"diff_total": 0,
"diff_unresolved": [],
"exit": 0,
"gid": 0,
"health": "healthy",
"image": "getmeili/meilisearch:v1.36.0",
"mounts": [
{
"class": "named-declared",
"files": 11,
"name": "volgate-wanderer_wanderer_meili_data",
"sample": [
"data.ms/VERSION",
"data.ms/indexes/7ee7d19b-c036-412d-be25-65ae8f9e4801/data.mdb",
"data.ms/indexes/7ee7d19b-c036-412d-be25-65ae8f9e4801/lock.mdb",
"data.ms/indexes/82fdecc6-7425-4e45-989b-bdb644ecd606/data.mdb",
"data.ms/indexes/82fdecc6-7425-4e45-989b-bdb644ecd606/lock.mdb",
"data.ms/indexes/c48904e5-2b2a-41c0-a34c-c9575e31be45/data.mdb",
"data.ms/indexes/c48904e5-2b2a-41c0-a34c-c9575e31be45/lock.mdb",
"data.ms/auth/data.mdb",
"data.ms/auth/lock.mdb",
"data.ms/tasks/data.mdb",
"data.ms/tasks/lock.mdb"
],
"source": "/var/lib/docker/volumes/volgate-wanderer_wanderer_meili_data/_data",
"target": "/meili_data",
"writable_by_app": "yes"
}
],
"name": "wanderer-search",
"restarts": null,
"status": "running",
"uid": 0
}
],
"declared_volumes": [
"wanderer_data",
"wanderer_meili_data",
"wanderer_plugins",
"wanderer_uploads"
],
"env_keys": [
"DOMAIN",
"HDD_PATH",
"IMPORT_PATH",
"MEILI_MASTER_KEY",
"POCKETBASE_ENCRYPTION_KEY",
"SUBDOMAIN",
"SUBDOMAIN_DB",
"TZ",
"USERDATA_PATH"
],
"exercise": [],
"ports": []
},
"reasons": [
"wanderer: unhealthy",
"wanderer: this container's mounts are all empty while it created entries in ['/root'] \u2014 benign when a sibling container holds the state, worth a look when none does",
"wanderer: declared volume /app/uploads is EMPTY",
"wanderer-db: declared volume /data/plugins is EMPTY",
"wanderer-db: writable-layer writes at /data (path suggests state, no database signature \u2014 judgement needed): ['plugins']"
],
"verdict": "UNDETERMINED"
}
audits/persistence-sweep-2026-08-02/state/verify-evidence/wishlist/probe.json
+162
View File
@@ -0,0 +1,162 @@
{
"probe": {
"app": "wishlist",
"containers": [
{
"diff_added": 35,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [
{
"added": [
"data"
],
"changed_count": 2,
"db_signature": false,
"dir": "/",
"files": [
"data"
]
},
{
"added": [
".config",
".local"
],
"changed_count": 0,
"db_signature": false,
"dir": "/root",
"files": [
".config",
".local"
]
},
{
"added": [
"caddy"
],
"changed_count": 0,
"db_signature": false,
"dir": "/root/.config",
"files": [
"caddy"
]
},
{
"added": [
"autosave.json"
],
"changed_count": 0,
"db_signature": false,
"dir": "/root/.config/caddy",
"files": [
"autosave.json"
]
},
{
"added": [
"share"
],
"changed_count": 0,
"db_signature": false,
"dir": "/root/.local",
"files": [
"share"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/usr",
"files": [
"src"
]
},
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/usr/src",
"files": [
"app"
]
},
{
"added": [
"data",
"uploads"
],
"changed_count": 0,
"db_signature": false,
"dir": "/usr/src/app",
"files": [
"data",
"uploads"
]
}
],
"diff_token_dirs": [],
"diff_total": 45,
"diff_unresolved": [],
"exit": 0,
"gid": 0,
"health": "healthy",
"image": "ghcr.io/cmintey/wishlist:v0.66.0",
"mounts": [
{
"class": "named-declared",
"files": 0,
"name": "volgate-wishlist_wishlist_data",
"sample": [],
"source": "/var/lib/docker/volumes/volgate-wishlist_wishlist_data/_data",
"target": "/data",
"writable_by_app": "yes"
},
{
"class": "anonymous",
"files": 1,
"name": "c5b4a3bf4591884b54c90465299d2c299b60a9692efc85699222663c7cc8efcb",
"sample": [
"prod.db"
],
"source": "/var/lib/docker/volumes/c5b4a3bf4591884b54c90465299d2c299b60a9692efc85699222663c7cc8efcb/_data",
"target": "/usr/src/app/data",
"writable_by_app": "yes"
},
{
"class": "anonymous",
"files": 0,
"name": "0a719c708e8a1351e6e7661358e5f7376e1f81ad0bc6d883660aa79d29999fd4",
"sample": [],
"source": "/var/lib/docker/volumes/0a719c708e8a1351e6e7661358e5f7376e1f81ad0bc6d883660aa79d29999fd4/_data",
"target": "/usr/src/app/uploads",
"writable_by_app": "yes"
}
],
"name": "wishlist",
"restarts": null,
"status": "running",
"uid": 0
}
],
"declared_volumes": [
"wishlist_data"
],
"env_keys": [
"DOMAIN",
"HDD_PATH",
"IMPORT_PATH",
"SUBDOMAIN",
"TZ",
"USERDATA_PATH"
],
"exercise": [],
"ports": []
},
"reasons": [
"wishlist: 1 file(s) in an ANONYMOUS volume at /usr/src/app/data \u2014 not in the compose `volumes:` block, so it is never backed up and a redeploy orphans it",
"wishlist: declared volume /data is EMPTY"
],
"verdict": "BROKEN"
}
audits/persistence-sweep-2026-08-02/state/verify-evidence/zipline/probe.json
+169
View File
@@ -0,0 +1,169 @@
{
"probe": {
"app": "zipline",
"containers": [
{
"diff_added": 3,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/",
"files": [
"zipline"
]
},
{
"added": [
"uploads",
"public"
],
"changed_count": 0,
"db_signature": false,
"dir": "/zipline",
"files": [
"uploads",
"public"
]
}
],
"diff_token_dirs": [],
"diff_total": 5,
"diff_unresolved": [],
"exit": 0,
"gid": 0,
"health": "healthy",
"image": "ghcr.io/diced/zipline:4.6.1",
"mounts": [
{
"class": "named-declared",
"files": 0,
"name": "volgate-zipline_zipline_public",
"sample": [],
"source": "/var/lib/docker/volumes/volgate-zipline_zipline_public/_data",
"target": "/zipline/public",
"writable_by_app": "yes"
},
{
"class": "named-declared",
"files": 0,
"name": "volgate-zipline_zipline_uploads",
"sample": [],
"source": "/var/lib/docker/volumes/volgate-zipline_zipline_uploads/_data",
"target": "/zipline/uploads",
"writable_by_app": "yes"
}
],
"name": "zipline",
"restarts": null,
"status": "running",
"uid": 0
},
{
"diff_added": 2,
"diff_benign_db_touches": [],
"diff_data_dirs": [],
"diff_other_dirs": [
{
"added": [],
"changed_count": 1,
"db_signature": false,
"dir": "/",
"files": [
"run"
]
}
],
"diff_token_dirs": [],
"diff_total": 4,
"diff_unresolved": [],
"exit": 0,
"gid": 70,
"health": "healthy",
"image": "postgres:16-alpine",
"mounts": [
{
"class": "named-declared",
"files": 1356,
"name": "volgate-zipline_zipline_postgres_data",
"sample": [
"postmaster.opts",
"postgresql.conf",
"postgresql.auto.conf",
"pg_ident.conf",
"pg_hba.conf",
"postmaster.pid",
"PG_VERSION",
"base/1/826",
"base/1/2996",
"base/1/3764",
"base/1/2610_fsm",
"base/1/3603_fsm",
"base/1/1249_vm",
"base/1/3600_fsm",
"base/1/13512",
"base/1/3602",
"base/1/6228",
"base/1/4174",
"base/1/4157",
"base/1/4146",
"base/1/2611",
"base/1/2657",
"base/1/3079_vm",
"base/1/1247_vm",
"base/1/1259",
"base/1/3601_fsm",
"base/1/1417",
"base/1/4155",
"base/1/2668",
"base/1/2831",
"base/1/2841",
"base/1/3607",
"base/1/2836",
"base/1/1255_fsm",
"base/1/2615_vm",
"base/1/3575",
"base/1/2605_vm",
"base/1/2670",
"base/1/6106",
"base/1/4163"
],
"source": "/var/lib/docker/volumes/volgate-zipline_zipline_postgres_data/_data",
"target": "/var/lib/postgresql/data",
"writable_by_app": "yes"
}
],
"name": "zipline-postgres",
"restarts": null,
"status": "running",
"uid": 70
}
],
"declared_volumes": [
"zipline_postgres_data",
"zipline_public",
"zipline_uploads"
],
"env_keys": [
"CORE_SECRET",
"DB_PASSWORD",
"DOMAIN",
"HDD_PATH",
"IMPORT_PATH",
"SUBDOMAIN",
"TZ",
"USERDATA_PATH"
],
"exercise": [],
"ports": []
},
"reasons": [
"zipline: this container's mounts are all empty while it created entries in ['/zipline'] \u2014 benign when a sibling container holds the state, worth a look when none does",
"zipline: declared volume /zipline/public is EMPTY",
"zipline: declared volume /zipline/uploads is EMPTY"
],
"verdict": "CLEAN"
}