52 lines
3.1 KiB
Markdown
52 lines
3.1 KiB
Markdown
# Runner Docker listener reduction
|
|
|
|
FORGE6-RUNNER-LOOPBACK-001, under FORGE-WP-0006-T03 and CUST-WP-0080 G12.
|
|
The October 13 inspection reproduced unauthenticated Docker ping from another
|
|
pod. The live DinD listener covered all pod interfaces and the namespace had no
|
|
NetworkPolicy. The declared runner consumer already used `127.0.0.1:2375`.
|
|
[Docker's daemon guidance](https://docs.docker.com/engine/daemon/remote-access/)
|
|
describes the security implications of network access to this control interface.
|
|
|
|
The source change is railiance-apps `706461b`, in
|
|
`manifests/forgejo-runner.yaml`. It binds Docker to loopback, changes DinD readiness
|
|
to a local exec ping, and pins all container/init image references to the exact
|
|
bytes already running. It changes no resources, registration, credential path,
|
|
replica count, PVC or workflow. Existing `Recreate` strategy avoids a surge pod.
|
|
|
|
Revision 1 only ran a preflight. That observed a dual-stack wildcard socket, so
|
|
revision 2 binds rollback verification to the observed original addresses rather
|
|
than assuming an IPv4 wildcard. Both proposals and preflight receipts remain.
|
|
Revision 2's conditional server dry-run matched exactly; three patch-boundary
|
|
tests passed. CPU requests were 3460m of 4 cores (86%); this change adds no requests.
|
|
|
|
The executor rechecks zero running/queued tasks immediately before the conditional
|
|
patch. This reduces but cannot atomically eliminate a concurrently arriving job.
|
|
Actual activation found no running/queued tasks before or after. Generation 4
|
|
became Ready with the original image digests. The runner's loopback ping passed;
|
|
another Forgejo pod's ping was refused, and `/proc/net/tcp` showed only
|
|
`0100007F:0947`. The executor exited 0. Receipt:
|
|
`docs/evidence/2026-10-13-netkingdom-security/forge-runner-loopback-activation.json`.
|
|
|
|
The private original template is retained, mode 0600, in ignored
|
|
`.private-backups/forge-runner-listener-20261013/original-template.json` and bound
|
|
by digest. Rollback requires the exact candidate template and Deployment UID:
|
|
|
|
```sh
|
|
python3 docs/changes/CUST-WP-0080/close_runner_docker_listener.py \
|
|
--proposal docs/changes/CUST-WP-0080/forge-runner-loopback-proposal.json \
|
|
--baseline .private-backups/forge-runner-listener-20261013/original-template.json \
|
|
--receipt docs/evidence/2026-10-13-netkingdom-security/forge-runner-loopback-rollback.json \
|
|
--rollback
|
|
```
|
|
|
|
Rollback restores the known prior exposure and is not automatic on a security
|
|
verification failure. Abort owner: railiance-forge, with railiance-apps owning
|
|
the source declaration. Never rerun apply because an observation timed out;
|
|
inspect the exact running session and live template first. An unexpected template
|
|
change refuses rollback instead of overwriting concurrent work. Reconcile source
|
|
if rollback is actually used. No rollback was performed in acceptance.
|
|
|
|
This closes the reproduced cross-pod Docker listener defect. Host-mode workflows
|
|
still share a privileged runner boundary. Job identity, source/workflow authority,
|
|
required checks, independent detection and credential isolation retain their
|
|
existing FORGE-WP-0006 / RMGR-WP-0021 / CUST-WP-0080 gates.
|