admin
6d90374f63
gates / gates (push) Successful in 45s
internal/privpolicy checks the RENDERED compose (privileged, cap_add, devices, host namespaces, security_opt,
sysctls, volumes_from, build/include/extends, env_file/config files outside the stack dir, aliasing named volumes,
binds outside the box's data roots, the Docker socket, propagation, ${VAR} in a privileged key) against an
allow-list compiled into the controller (one entry: homepage's read-only socket). Asked before every compose
write: the 15-minute sync, the guarded update/ladder step, the install, both settings changes, both restores
(before the stop). A refusal writes nothing, keeps the app on its last good compose, raises the operator-only
event app_definition_refused once per definition and puts one line on the app page. The sync never copies a
template named like a controller infra stack. Structural guard TestAllowList_IsWiredIntoEveryComposeWriter.
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
17 lines
810 B
Go
17 lines
810 B
Go
package backup
|
|
|
|
// definitionAdmitter is the R-971 question a restore asks BEFORE it stops the app: would the unit's (or the snapshot's)
|
|
// compose, rendered with the restore's env, pass the box's catalog allow-list? Implemented by main.go's stackAdapter;
|
|
// a provider without it (the test fakes) asks nothing. A refusal leaves the live app running and untouched.
|
|
type definitionAdmitter interface {
|
|
AdmitDefinitionFromUnit(name, composeSrcDir string, fullEnv map[string]string) error
|
|
}
|
|
|
|
// admitRestoredDefinition asks the provider when it can answer; nil when it cannot.
|
|
func (m *Manager) admitRestoredDefinition(name, composeSrcDir string, env map[string]string) error {
|
|
if a, ok := m.stackProvider.(definitionAdmitter); ok {
|
|
return a.AdmitDefinitionFromUnit(name, composeSrcDir, env)
|
|
}
|
|
return nil
|
|
}
|