admin
36c4aa4e69
gates / gates (push) Successful in 44s
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
16 lines
1.0 KiB
JSON
16 lines
1.0 KiB
JSON
{
|
|
"version": 1,
|
|
"note": "R-971 (operator decision D2 = A, 2026-10-17). The box's catalog allow-list, compiled into the controller. Each entry allows ONE exact setting for ONE service of ONE app, only while that service runs the entry's image repository with the image's own entrypoint and command and the exact healthcheck named; a changed setting is a different one and is refused. The catalog's scripts/privilege-allowlist.json is a byte-identical copy for its CI gate. Survey: felhom.eu documentation/audits/agent-allowlist-rotation-2026-10-17/P2/survey.md",
|
|
"entries": [
|
|
{
|
|
"app": "homepage",
|
|
"service": "homepage",
|
|
"setting": "bind /var/run/docker.sock -> /var/run/docker.sock ro",
|
|
"image": "ghcr.io/gethomepage/homepage",
|
|
"healthcheck": "[\"CMD\",\"wget\",\"--spider\",\"-q\",\"http://127.0.0.1:3000\"]",
|
|
"why": "the Docker widget and the docker service discovery list the household's containers and their state",
|
|
"doc": "https://gethomepage.dev/configs/docker/"
|
|
}
|
|
]
|
|
}
|