Publish DevRunbook source

2026-09-03 04:09:17 +02:00
commit cfd2804e27
928 changed files with 161642 additions and 0 deletions
@@ -0,0 +1,220 @@
+apiVersion: devrunbook.io/v1alpha1
+kind: Playbook
+metadata:
+  id: audits.docker-self-hosting-audit
+  slug: docker-self-hosting-audit
+  version: 1.0.0
+  title: Docker and Self-Hosting Audit
+  summary: Review container security, image size, health checks, persistence, configuration and operability for self-hosted
+    deployment.
+  category: audits
+  tags:
+  - docker
+  - self-hosting
+  - unraid
+  lifecycle: reviewed
+  riskTier: moderate
+  authors:
+  - name: DevRunbook Core Team
+  license: MIT
+package:
+  files:
+  - path: prompt.md
+    role: template
+    digest: true
+    exportByDefault: false
+  - path: README.md
+    role: documentation
+    digest: true
+    exportByDefault: false
+  - path: CHANGELOG.md
+    role: changelog
+    digest: true
+    exportByDefault: false
+  - path: examples/minimal.yaml
+    role: example
+    digest: true
+    exportByDefault: false
+  - path: evaluations/static-structure.yaml
+    role: evaluation
+    digest: true
+    exportByDefault: false
+spec:
+  type: guided
+  intent:
+    problem: Development work around docker and self-hosting audit is often underspecified, inconsistently executed or reported
+      without enough evidence.
+    outcome: Review container security, image size, health checks, persistence, configuration and operability for self-hosted
+      deployment.
+    whenToUse:
+    - Use this playbook when the repository needs a bounded docker and self-hosting audit task with explicit evidence and
+      completion criteria.
+    - Use it when Codex should follow a repeatable workflow rather than improvise from a one-line request.
+    whenNotToUse:
+    - Do not use it when the desired outcome or authority boundaries are still materially undecided.
+    - Do not use it to access unavailable production credentials, bypass safeguards or claim validation that cannot be performed.
+  modes:
+  - inspect
+  - plan
+  defaultMode: inspect
+  autonomy:
+    min: observe
+    max: diagnose
+    default: diagnose
+  inputs:
+  - key: deploymentTarget
+    label: Deployment target
+    description: Describe the deployment environment and packaging model to assess.
+    type: enum
+    required: true
+    sensitive: false
+    includeInOutput: true
+    default: docker-compose
+    options:
+    - docker-compose
+    - unraid
+    - linux-host
+    - managed-container-platform
+    - other
+  - key: runtimeConstraints
+    label: Runtime constraints
+    description: Describe limits such as non-root execution, storage paths, network policy and available resources.
+    type: multiline
+    required: false
+    sensitive: false
+    includeInOutput: true
+    default: ''
+  compatibility:
+    repositoryRequired: true
+    languages: []
+    frameworks: []
+    packageManagers: []
+    databases: []
+    deploymentTypes: []
+    requiredProfileCapabilities: []
+    incompatibleConditions: []
+  guardrails:
+  - id: guardrail-1
+    severity: blocking
+    text: Do not run destructive cleanup commands or modify live container state in inspect mode.
+  - id: guardrail-2
+    severity: blocking
+    text: Treat environment files, mounted volumes and image history as potentially sensitive.
+  - id: guardrail-3
+    severity: blocking
+    text: Do not recommend privileged mode or broad host mounts without explicit justified need.
+  workflow:
+  - id: inventory-images
+    title: Inventory packaging
+    instruction: Inspect Dockerfiles, Compose files, healthchecks, users, ports, volumes, networks and build contexts.
+    required: true
+  - id: review-build
+    title: Review image build
+    instruction: Assess reproducibility, layer hygiene, dependency pinning, multi-stage use and secret exposure.
+    required: true
+  - id: review-runtime
+    title: Review runtime
+    instruction: Assess non-root execution, filesystem permissions, capabilities, resource limits and restart behavior.
+    required: true
+  - id: review-storage
+    title: Review storage
+    instruction: Map persistent data, backups, upgrades and ownership across the target deployment.
+    required: true
+  - id: review-network
+    title: Review network exposure
+    instruction: Assess exposed ports, reverse proxy assumptions, internal services and outbound requirements.
+    required: true
+  - id: verify-deployment
+    title: Verify safe deployment
+    instruction: Build and smoke-test the reference deployment where safe and record exact blockers.
+    required: true
+  - id: report
+    title: Report remediation
+    instruction: Prioritize production blockers separately from optional optimization.
+    required: true
+  validation:
+    commandRoles:
+    - build
+    - smoke-test
+    - security-scan
+    checks:
+    - id: check-1
+      type: assertion
+      description: Build and runtime findings cite exact Docker or deployment evidence.
+      blocking: true
+      evidence: Referenced files, command results or explicit review notes.
+    - id: check-2
+      type: assertion
+      description: Persistent data, backup and upgrade behavior are explicitly assessed.
+      blocking: true
+      evidence: Referenced files, command results or explicit review notes.
+    - id: command-build
+      type: command
+      description: Run the resolved build command when the repository profile provides it and record the result.
+      blocking: true
+      evidence: Resolved command, exit status and concise result summary.
+    - id: command-smoke-test
+      type: command
+      description: Run the resolved smoke-test command when the repository profile provides it and record the result.
+      blocking: true
+      evidence: Resolved command, exit status and concise result summary.
+    - id: command-security-scan
+      type: command
+      description: Run the resolved security-scan command when the repository profile provides it and record the result.
+      blocking: false
+      evidence: Resolved command, exit status and concise result summary.
+  completion:
+    criteria:
+    - Findings cover build, runtime, persistence and upgrade behavior.
+    - Recommendations identify breaking deployment changes.
+    - Validation evidence and unresolved limitations are reported honestly.
+  failurePolicy:
+    onValidationFailure: Investigate failures caused by the current work, repair them when they remain within scope, rerun
+      affected validation and report any genuine blocker without claiming success.
+    onAmbiguity: Use repository evidence and existing conventions for minor reversible choices. Preserve current behavior
+      and stop before any material irreversible decision that the specification does not resolve.
+    onMissingContext: Inspect the repository for missing non-sensitive context. Never invent commands, credentials, production
+      behavior or validation results; report what remains unavailable.
+    onOutOfScopeCause: Explain the evidenced out-of-scope cause, avoid unrelated changes and provide the smallest safe follow-up
+      recommendation.
+    onExternalDependencyUnavailable: Use an approved local substitute or fixture only when it preserves the behavior under
+      test. Otherwise record the blocked validation and do not claim the external path succeeded.
+    onUnableToReproduce: Record attempted reproduction, environment and observed evidence. Do not apply speculative production
+      changes; provide the narrowest next diagnostic action.
+  reporting:
+    sections:
+    - id: outcome
+      title: Outcome
+      required: true
+      description: State the delivered result or audit conclusion without overstating evidence.
+    - id: evidence
+      title: Evidence and scope
+      required: true
+      description: List inspected or changed areas and the evidence supporting the result.
+    - id: validation
+      title: Validation
+      required: true
+      description: Report commands, manual checks and their actual outcomes.
+    - id: risks
+      title: Risks and limitations
+      required: true
+      description: State residual risk, inaccessible evidence and untested conditions.
+    - id: follow-up
+      title: Recommended follow-up
+      required: true
+      description: List the smallest useful next actions or state None.
+  template:
+    main: prompt.md
+    partials: []
+  exports:
+    prompt: true
+    markdown: true
+    runPack: false
+    agentsSuggestion: false
+quality:
+  reviewStatus: editorial-reviewed
+  testedStacks: []
+  knownLimitations:
+  - Repository-specific effectiveness depends on the accuracy of the selected profile and the evidence available to Codex.
+  evaluationCaseIds:
+  - docker-self-hosting-audit.static-structure