ITWorx Pulse release export
bd774932d5
Public source validation / validate (push) Failing after 3m8s
630 B
630 B
ADR 0005 — No unrestricted Docker socket in API/web
Status: Accepted baseline
Decision
The web and API containers never mount the unrestricted Docker socket. Docker/Unraid facts come from the official Unraid API, existing exporters, Portainer read-only endpoints, or a separate constrained agent/socket proxy.
Rationale
Docker daemon access is effectively host control. Read-only filesystem mount flags do not create a read-only Docker API.
Consequences
- Collector capability endpoints are allowlisted.
- Agent runtime is separated and audited.
- Architecture tests inspect compose mounts and API routes.