ITWorx Pulse release export
bd774932d5
Public source validation / validate (push) Failing after 3m8s
18 lines
630 B
Markdown
18 lines
630 B
Markdown
# ADR 0005 — No unrestricted Docker socket in API/web
|
|
|
|
**Status:** Accepted baseline
|
|
|
|
## Decision
|
|
|
|
The web and API containers never mount the unrestricted Docker socket. Docker/Unraid facts come from the official Unraid API, existing exporters, Portainer read-only endpoints, or a separate constrained agent/socket proxy.
|
|
|
|
## Rationale
|
|
|
|
Docker daemon access is effectively host control. Read-only filesystem mount flags do not create a read-only Docker API.
|
|
|
|
## Consequences
|
|
|
|
- Collector capability endpoints are allowlisted.
|
|
- Agent runtime is separated and audited.
|
|
- Architecture tests inspect compose mounts and API routes.
|