Report privately through GitHub's security advisory form, or by email to ivansuselo@gmail.com.

Please include the version (rootd --version), your platform (Termux or Linux, plus architecture), what you did, and what happened. A proof of concept helps but is not required.

This is a personal project, not a funded one, so I cannot promise a response time. I will acknowledge reports as soon as I see them and will credit you in the release notes unless you prefer otherwise.

Rootless containers are a convenience boundary, not a security boundary.

rootd-fs uses PRoot or udocker to give you a container-like filesystem without root. PRoot works by intercepting system calls with ptrace and rewriting path arguments. It emulates uid 0; it does not grant kernel privilege and it does not confine a hostile process. A program running inside a box that actively wants to escape can generally do so, and it runs with exactly the permissions of your user account.

Practical consequences:

• Do not run untrusted code in a box and expect it to be contained. If you need real isolation, use a VM with its own kernel.
• Rootless containers share the host network namespace. A service that binds :8080 inside a box is reachable at localhost:8080 on the host. Port "mappings" shown by rootd svc are advisory labels only.
• Non-isolated boxes bind host paths such as /storage and your Termux home. Use --isolated to omit them.

Reports that amount to "a process inside a box could affect the host" are, unfortunately, expected behaviour rather than vulnerabilities. What is in scope is listed below.

• Extraction escapes. A crafted image layer or backup archive that writes outside the target directory, via .., absolute paths, symlinks, or hard links. This is actively tested; if you find a gap, it is a real bug.
• Digest or integrity bypass. Anything that lets a layer whose SHA-256 does not match be accepted and unpacked.
• TLS handling. Certificate verification being skipped when --insecure was not passed.
• Credential leakage. Registry tokens, SSH keys, or DOCKER_HOST credentials written to logs, world-readable files, or process arguments visible to other users.
• Shell hook lockout. The autostart block trapping a user in a broken shell with no escape. It is designed to fail open — interactive-only, recursion-guarded, ROOTD_NO_AUTO=1 bypass, and fall-through when the box is unavailable.
• Unexpected destruction. rootd rm, rootd purge or rootd restore --force deleting something outside the paths they name.

• Escaping a rootless container to the host (see the threat model).
• Vulnerabilities in proot, udocker, tailscaled, the Docker CLI, or in downloaded container images — report those upstream.
• Anything requiring an attacker who already has your device unlocked and a shell as your user.

Only the latest release receives fixes. The project is pre-1.0 and moves quickly; please upgrade before reporting.

Release artifacts ship with SHA256SUMS:

sha256sum -c SHA256SUMS