coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
the-custodian/docs/changes/CUST-WP-0080/forge-runner-loopback-operations.md

3.1 KiB
Raw Blame History

Runner Docker listener reduction

FORGE6-RUNNER-LOOPBACK-001, under FORGE-WP-0006-T03 and CUST-WP-0080 G12. The October 13 inspection reproduced unauthenticated Docker ping from another pod. The live DinD listener covered all pod interfaces and the namespace had no NetworkPolicy. The declared runner consumer already used 127.0.0.1:2375. Docker's daemon guidance describes the security implications of network access to this control interface.

The source change is railiance-apps 706461b, in manifests/forgejo-runner.yaml. It binds Docker to loopback, changes DinD readiness to a local exec ping, and pins all container/init image references to the exact bytes already running. It changes no resources, registration, credential path, replica count, PVC or workflow. Existing Recreate strategy avoids a surge pod.

Revision 1 only ran a preflight. That observed a dual-stack wildcard socket, so revision 2 binds rollback verification to the observed original addresses rather than assuming an IPv4 wildcard. Both proposals and preflight receipts remain. Revision 2's conditional server dry-run matched exactly; three patch-boundary tests passed. CPU requests were 3460m of 4 cores (86%); this change adds no requests.

The executor rechecks zero running/queued tasks immediately before the conditional patch. This reduces but cannot atomically eliminate a concurrently arriving job. Actual activation found no running/queued tasks before or after. Generation 4 became Ready with the original image digests. The runner's loopback ping passed; another Forgejo pod's ping was refused, and /proc/net/tcp showed only 0100007F:0947. The executor exited 0. Receipt: docs/evidence/2026-10-13-netkingdom-security/forge-runner-loopback-activation.json.

The private original template is retained, mode 0600, in ignored .private-backups/forge-runner-listener-20261013/original-template.json and bound by digest. Rollback requires the exact candidate template and Deployment UID:

python3 docs/changes/CUST-WP-0080/close_runner_docker_listener.py \
  --proposal docs/changes/CUST-WP-0080/forge-runner-loopback-proposal.json \
  --baseline .private-backups/forge-runner-listener-20261013/original-template.json \
  --receipt docs/evidence/2026-10-13-netkingdom-security/forge-runner-loopback-rollback.json \
  --rollback

Rollback restores the known prior exposure and is not automatic on a security verification failure. Abort owner: railiance-forge, with railiance-apps owning the source declaration. Never rerun apply because an observation timed out; inspect the exact running session and live template first. An unexpected template change refuses rollback instead of overwriting concurrent work. Reconcile source if rollback is actually used. No rollback was performed in acceptance.

This closes the reproduced cross-pod Docker listener defect. Host-mode workflows still share a privileged runner boundary. Job identity, source/workflow authority, required checks, independent detection and credential isolation retain their existing FORGE-WP-0006 / RMGR-WP-0021 / CUST-WP-0080 gates.