Publish ITWorx Pulse source

2026-09-03 02:09:19 +02:00
commit bd774932d5
614 changed files with 77116 additions and 0 deletions
@@ -0,0 +1,17 @@
+# ADR 0005 — No unrestricted Docker socket in API/web
+
+**Status:** Accepted baseline
+
+## Decision
+
+The web and API containers never mount the unrestricted Docker socket. Docker/Unraid facts come from the official Unraid API, existing exporters, Portainer read-only endpoints, or a separate constrained agent/socket proxy.
+
+## Rationale
+
+Docker daemon access is effectively host control. Read-only filesystem mount flags do not create a read-only Docker API.
+
+## Consequences
+
+- Collector capability endpoints are allowlisted.
+- Agent runtime is separated and audited.
+- Architecture tests inspect compose mounts and API routes.