Jens/ITWorx_MCP_Hub-Public
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

Browse Source
This commit is contained in:
Public Source Publisher committed 2026-10-01 01:36:21 +02:00
commit cb5be898ea
663 files changed
+82674
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/02-security/DOCKER_BROKER_RUNTIME.md
+7
View File
@@ -0,0 +1,7 @@
# Docker read broker runtime
`docker-read-broker` is the only service with `/var/run/docker.sock`. Its public compose surface has no host port and the broker is attached only to the internal broker network. The root filesystem is read-only, capabilities are dropped, and the registration file and service token are mounted read-only.
The broker accepts only authenticated `GET` requests for host status, bounded storage, registered container list/inspect/health/logs, and bounded network metadata. Mutation, exec, image, volume, secret/config, arbitrary filters, and arbitrary Engine API paths are absent or denied. A stable registered ID is resolved to an immutable container ID and verified against compose project/service labels before inspection. Caller project and environment are taken from a short-lived HMAC service token, never from a free-form container request.
The deterministic fake backend and acceptance tests cover registration isolation, label spoofing, mutation/raw-route denial, secret/control-character log redaction, bounded logs, token expiry, and socket-unavailable degradation. No live Docker socket or Unraid host was modified for WP-100.