# ADR 0005 — No unrestricted Docker socket in API/web

**Status:** Accepted baseline

## Decision

The web and API containers never mount the unrestricted Docker socket. Docker/Unraid facts come from the official Unraid API, existing exporters, Portainer read-only endpoints, or a separate constrained agent/socket proxy.

## Rationale

Docker daemon access is effectively host control. Read-only filesystem mount flags do not create a read-only Docker API.

## Consequences

- Collector capability endpoints are allowlisted.
- Agent runtime is separated and audited.
- Architecture tests inspect compose mounts and API routes.