Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

docs/02-security/DOCKER_BROKER_SECURITY.md

@@ -0,0 +1,43 @@
+# Docker Read Broker Security
+
+## Purpose
+
+The broker contains the unavoidable Docker socket trust boundary and prevents MCP-facing services from receiving raw Engine API access.
+
+## v1 API allowlist
+
+- list registered containers with bounded fields;
+- inspect one registered container;
+- read health/status;
+- read bounded recent logs;
+- list registered networks needed for topology display;
+- return host Docker version and non-sensitive capacity summary.
+
+## Explicitly absent
+
+- create/start/stop/restart/remove;
+- exec;
+- image build/pull/push/remove;
+- volume content access;
+- secret/config access;
+- arbitrary Docker API path;
+- arbitrary filters that reveal unrelated containers;
+- host filesystem mounts.
+
+## Registration
+
+The Hub passes a signed or mutually authenticated request containing a stable project/environment registration. The broker maps that registration to container IDs or immutable labels discovered during reconciliation. A client-supplied container name is never trusted alone.
+
+## Hardening
+
+- internal connector network only;
+- mTLS or short-lived internal service token;
+- no published host port;
+- read-only root filesystem and no package manager;
+- minimal dependencies;
+- bounded log bytes and time range;
+- reject containers not registered to the project;
+- structured Docker SDK calls, never shell commands;
+- dedicated security tests against write methods.
+
+Mounting the socket read-only does not make Docker access read-only by itself. The broker's application-level API is the controlling boundary.