Docker filter hardening: 21 review findings, three endpoint families, and a log-injection fix - #38

Merged

bfulton merged 32 commits into

mainfrom

fix/job-start-injection

Sep 7, 2026

Commits on Sep 6, 2026

Stop job output from injecting phantom jobs

bfulton
and
claude
committed
15d6d6c
Close two filter bypasses: upgrade tunnelling and case-folded keys

bfulton
and
claude
committed
be40a7d
Design the three docker endpoint families a real consumer needs

bfulton
and
claude
committed
37379f2
Let a job kill, stop and read logs from its own container

bfulton
and
claude
committed
4f82c49
Close the volume-driver escape and make HostConfig an allowlist

bfulton
and
claude
committed
e1762df
Keep a drifted worker constrained instead of reopening it at job start

bfulton
and
claude
committed
20398db
Filter build parameters, and stop claiming the context path is checked

bfulton
and
claude
committed
5472b52
Show docker grants on the approval screen and in the diff

bfulton
and
claude
committed
4ea1b5d
Mount what the filter checked, not what the job spelled

bfulton
and
claude
committed
1b0457f
Attach registry credentials the job is never given

bfulton
and
claude
committed
8796dcf
Refuse a request target the filter cannot read, instead of throwing

bfulton
and
claude
committed
4fd6d92
Key per-workflow policy on the workflow filename, as documented

bfulton
and
claude
committed
f011fe0
Clear a slot's job context when the slot is released

bfulton
and
claude
committed
c7c8c7e
Address a job's containers by name, and forget them when removed

bfulton
and
claude
committed
bc48a5c
Root mounts at the checkout, and reject privileged at approval

bfulton
and
claude
committed
126bc25
Model the real checkout layout in the docker e2e

bfulton
and
claude
committed
d1757a9
Let a job create the internal network it seals itself with

bfulton
and
claude
committed
fcbb3aa
Let a job inspect an image its policy already names

bfulton
and
claude
committed
659c769
Replace extract-zip with the fork that fixes its path traversal

bfulton
and
claude
committed
7ef9e41
Merge remote-tracking branch 'origin/main' into fix/job-start-injection
bfulton
committed
f3022ec
Let the real CLI create a network, and declare images by glob

bfulton
and
claude
committed
9a067c3
Drop the docker workflow's dead runner-selection job

bfulton
and
claude
committed
2c180e6
Stop a declared glob at the path separator

bfulton
and
claude
committed
11c9953
Revert "Drop the docker workflow's dead runner-selection job"
bfulton
committed
fd20504
Pin jobs to the builder the filter can actually see

bfulton
and
claude
committed
6dbbbbb
Refuse an image glob that does not say which tags it covers

bfulton
and
claude
committed
b6143d4
Refuse a body that spells one key two ways, rather than guess

bfulton
and
claude
committed
d9445f4
Stop committing Playwright's run state

bfulton
and
claude
committed
25f7eb8
Cover the network path with the real CLI, and make the check output earn its job

bfulton
and
claude
committed
b121a7c
Show the docker grants the CLI was approving unseen

bfulton
and
claude
committed
0c44fa9
Describe a policy in one place, and refuse a key nothing describes

bfulton
and
claude
committed
db34fcb

Commits on Sep 7, 2026

Let the check job announce its own finding

bfulton
and
claude
committed
aeb1b8b

Navigation Menu

Docker filter hardening: 21 review findings, three endpoint families, and a log-injection fix - #38

Docker filter hardening: 21 review findings, three endpoint families, and a log-injection fix#38
bfulton merged 32 commits into
mainfrom
fix/job-start-injection

Commits on Sep 6, 2026

Stop job output from injecting phantom jobs

Close two filter bypasses: upgrade tunnelling and case-folded keys

Design the three docker endpoint families a real consumer needs

Let a job kill, stop and read logs from its own container

Close the volume-driver escape and make HostConfig an allowlist

Keep a drifted worker constrained instead of reopening it at job start

Filter build parameters, and stop claiming the context path is checked

Show docker grants on the approval screen and in the diff

Mount what the filter checked, not what the job spelled

Attach registry credentials the job is never given

Refuse a request target the filter cannot read, instead of throwing

Key per-workflow policy on the workflow filename, as documented

Clear a slot's job context when the slot is released

Address a job's containers by name, and forget them when removed

Root mounts at the checkout, and reject privileged at approval

Model the real checkout layout in the docker e2e

Let a job create the internal network it seals itself with

Let a job inspect an image its policy already names

Replace extract-zip with the fork that fixes its path traversal

Merge remote-tracking branch 'origin/main' into fix/job-start-injection

Let the real CLI create a network, and declare images by glob

Drop the docker workflow's dead runner-selection job

Stop a declared glob at the path separator

Revert "Drop the docker workflow's dead runner-selection job"

Pin jobs to the builder the filter can actually see

Refuse an image glob that does not say which tags it covers

Refuse a body that spells one key two ways, rather than guess

Stop committing Playwright's run state

Cover the network path with the real CLI, and make the check output earn its job

Show the docker grants the CLI was approving unseen

Describe a policy in one place, and refuse a key nothing describes

Commits on Sep 7, 2026

Let the check job announce its own finding