1.1 KiB
Docker read broker runtime
docker-read-broker is the only service with /var/run/docker.sock. Its public compose surface has no host port and the broker is attached only to the internal broker network. The root filesystem is read-only, capabilities are dropped, and the registration file and service token are mounted read-only.
The broker accepts only authenticated GET requests for host status, bounded storage, registered container list/inspect/health/logs, and bounded network metadata. Mutation, exec, image, volume, secret/config, arbitrary filters, and arbitrary Engine API paths are absent or denied. A stable registered ID is resolved to an immutable container ID and verified against compose project/service labels before inspection. Caller project and environment are taken from a short-lived HMAC service token, never from a free-form container request.
The deterministic fake backend and acceptance tests cover registration isolation, label spoofing, mutation/raw-route denial, secret/control-character log redaction, bounded logs, token expiry, and socket-unavailable degradation. No live Docker socket or Unraid host was modified for WP-100.