# Docker Read Broker Security

## Purpose

The broker contains the unavoidable Docker socket trust boundary and prevents MCP-facing services from receiving raw Engine API access.

## v1 API allowlist

- list registered containers with bounded fields;
- inspect one registered container;
- read health/status;
- read bounded recent logs;
- list registered networks needed for topology display;
- return host Docker version and non-sensitive capacity summary.

## Explicitly absent

- create/start/stop/restart/remove;
- exec;
- image build/pull/push/remove;
- volume content access;
- secret/config access;
- arbitrary Docker API path;
- arbitrary filters that reveal unrelated containers;
- host filesystem mounts.

## Registration

The Hub passes a signed or mutually authenticated request containing a stable project/environment registration. The broker maps that registration to container IDs or immutable labels discovered during reconciliation. A client-supplied container name is never trusted alone.

## Hardening

- internal connector network only;
- mTLS or short-lived internal service token;
- no published host port;
- read-only root filesystem and no package manager;
- minimal dependencies;
- bounded log bytes and time range;
- reject containers not registered to the project;
- structured Docker SDK calls, never shell commands;
- dedicated security tests against write methods.

Mounting the socket read-only does not make Docker access read-only by itself. The broker's application-level API is the controlling boundary.