gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-26 02:06:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(resources): protect Sencho's own image, network, volumes from deletion (#1149)

Browse Source 
* feat(resources): protect Sencho's own image, network, volumes from deletion

Adds SelfIdentityService that reads HOSTNAME at startup and inspects the
running Sencho container via Dockerode to record its image ID, attached
networks, named volumes, and container ID. The classification API marks
these with isSencho:true, destructive delete routes return 423 Locked when
the target matches self, the orphan-containers API filters the Sencho
container out so it cannot be selected and purged from the Unmanaged tab,
and the managed-prune path adds an explicit self filter for
defense-in-depth on top of Docker's in-use semantics.

The Resources view renders a Sencho pill alongside the managed badge on
matching rows and disables the trash control with a hover tooltip.

When Sencho runs outside Docker (dev mode), inspect returns 404, the
service stays empty, and every isOwn* returns false so today's behaviour
is preserved.

* fix(resources): handle sha256-prefixed image IDs and custom hostnames

Addresses independent-review findings on PR #1149:

- Strip sha256: prefix in POST /api/system/images/delete before validating
  the ID, matching the inspect route's handling. Without this, /system/images
  responses round-trip through the UI as sha256:<hex> and got 400 Invalid
  image ID format before rejectIfSelf could run.
- Add /proc/self/cgroup fallback to SelfIdentityService so custom
  --hostname, Compose hostname:, or --uts=host setups still self-identify.
  HOSTNAME inspect runs first; on 404 the service parses the cgroup file
  for a 64-hex container ID (cgroupv1 docker, cgroupv2 docker, podman
  libpod formats all covered) and retries inspect with that ID.
- Restrict prefix matching in isOwnNetwork / matchesId to hex-shaped
  candidates (12 to 64 hex chars), so a non-Sencho network whose name
  happens to start with a hex prefix of Sencho's network ID is no longer
  flagged as self.
- Trim the resources.mdx Note to customer-visible behaviour without
  enumerating every tab.
- New tests: prefixed-image-ID 200 path, three cgroup file format
  parses (v1, v2, podman) plus the no-match and missing-file cases,
  HOSTNAME-404-then-cgroup-success fallback path, name-collision
  regression for the hex-only prefix rule, and an empty-cache
  no-regression check. Test hygiene: mockReset on the inspect stub and
  restoreAllMocks in afterEach so spies do not leak across tests.

* chore(security): VEX not_affected for CVE-2026-46680 (containerd in docker-compose)

Trivy now flags CVE-2026-46680 HIGH on
usr/local/lib/docker/cli-plugins/docker-compose, which statically embeds
github.com/containerd/containerd/v2 v2.2.3 (compose v5.1.3's resolved
module graph).

The CVE is a runtime-executor flaw: containerd's runc invocation can be
tricked into running a Kubernetes pod marked runAsNonRoot as root via
crafted user ID handling. The vulnerable code path is reached only by
containerd-shim executing a container with a populated OCI runtime spec
on the daemon side. docker-compose vendors the containerd Go module
purely as a client (gRPC stubs, API types, shared utilities); it never
executes containers and never enforces runAsNonRoot. Sencho's compose
usage (up / down / ps against user-authored files) cannot construct a
Kubernetes pod security context. The vulnerable path is unreachable.

Adds a not_affected entry to security/vex/sencho.openvex.json with
justification vulnerable_code_not_in_execute_path, bumps version 5 to 6,
and updates last_updated to 2026-05-22 per Directive 23.
This commit is contained in:
Anso
2026-05-21 23:10:13 -04:00
committed by GitHub
parent e57799d4df
commit b740dd1078
9 changed files with 849 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/DockerController.ts
+37 -6
View File
@@ -8,6 +8,7 @@ import * as yaml from 'yaml';
import { NodeRegistry } from './NodeRegistry';
import { CacheService } from './CacheService';
import SelfIdentityService from './SelfIdentityService';
import { isPathWithinBase } from '../utils/validation';
import { isDebugEnabled } from '../utils/debug';
import { sanitizeForLog } from '../utils/safeLog';
@@ -42,6 +43,7 @@ export interface ClassifiedImage {
Containers: number;
managedBy: string | null;
managedStatus: 'managed' | 'unmanaged' | 'unused';
isSencho: boolean;
}
export interface PortInUseInfo {
@@ -57,6 +59,7 @@ export interface ClassifiedVolume {
CreatedAt: string | null;
managedBy: string | null;
managedStatus: 'managed' | 'unmanaged';
isSencho: boolean;
}
export interface ClassifiedNetwork {
@@ -66,6 +69,7 @@ export interface ClassifiedNetwork {
Scope: string;
managedBy: string | null;
managedStatus: 'managed' | 'unmanaged' | 'system';
isSencho: boolean;
}
export interface TopologyContainer {
@@ -188,6 +192,12 @@ class DockerController {
};
}
// Sencho's own image, networks, and named volumes are always in use by the
// running container, so Docker's server-side prune APIs (pruneContainers,
// pruneImages, pruneNetworks, pruneVolumes) skip them by definition. No
// extra self-guard is needed at this layer; the `managed` scope path goes
// through `pruneManagedOnly`, which adds an explicit self filter for
// defense-in-depth.
public async pruneSystem(target: 'containers' | 'images' | 'networks' | 'volumes', labelFilter?: string) {
let spaceReclaimed = 0;
if (target === 'containers') {
@@ -268,6 +278,8 @@ class DockerController {
if (stack) imageToStack.set(c.ImageID, stack);
}
const selfIdentity = SelfIdentityService.getInstance();
const images: ClassifiedImage[] = this.validateApiData<any[]>(rawImages).map((img: any) => {
const stack = imageToStack.get(img.Id) ?? null;
const managedStatus: ClassifiedImage['managedStatus'] =
@@ -280,6 +292,7 @@ class DockerController {
Containers: img.Containers ?? 0,
managedBy: stack,
managedStatus,
isSencho: selfIdentity.isOwnImage(img.Id),
};
});
@@ -294,12 +307,13 @@ class DockerController {
CreatedAt: vol.CreatedAt ?? null,
managedBy: stack,
managedStatus,
isSencho: selfIdentity.isOwnVolume(vol.Name),
};
});
const networks: ClassifiedNetwork[] = this.validateApiData<any[]>(rawNetworks).map((net: any) => {
if (DockerController.SYSTEM_NETWORKS.has(net.Name)) {
return { Id: net.Id, Name: net.Name, Driver: net.Driver, Scope: net.Scope, managedBy: null, managedStatus: 'system' as const };
return { Id: net.Id, Name: net.Name, Driver: net.Driver, Scope: net.Scope, managedBy: null, managedStatus: 'system' as const, isSencho: false };
}
const stack = DockerController.resolveProjectLabel(net.Labels?.['com.docker.compose.project'], knownSet, projectToStack);
const managedStatus: ClassifiedNetwork['managedStatus'] = stack ? 'managed' : 'unmanaged';
@@ -310,6 +324,7 @@ class DockerController {
Scope: net.Scope,
managedBy: stack,
managedStatus,
isSencho: selfIdentity.isOwnNetwork(net.Id) || selfIdentity.isOwnNetwork(net.Name),
};
});
@@ -326,6 +341,7 @@ class DockerController {
): Promise<{ success: boolean; reclaimedBytes: number }> {
const knownSet = new Set(knownStackNames);
const projectToStack = await DockerController.resolveProjectNameMap(knownStackNames);
const selfIdentity = SelfIdentityService.getInstance();
let reclaimedBytes = 0;
if (target === 'volumes') {
@@ -333,7 +349,8 @@ class DockerController {
const rawVolumes: any[] = (this.validateApiData<any>(rawVolumeData)).Volumes || [];
const prunable = rawVolumes.filter((v: any) => {
return !!DockerController.resolveProjectLabel(v.Labels?.['com.docker.compose.project'], knownSet, projectToStack)
&& (v.UsageData?.RefCount ?? 1) === 0;
&& (v.UsageData?.RefCount ?? 1) === 0
&& !selfIdentity.isOwnVolume(v.Name);
});
// Removals are independent and Docker handles concurrent volume
// deletes; parallelize so wall time matches the slowest single
@@ -349,7 +366,9 @@ class DockerController {
} else if (target === 'networks') {
const rawNetworks = await this.docker.listNetworks();
const prunable = (rawNetworks as any[]).filter((n: any) => {
return !!DockerController.resolveProjectLabel(n.Labels?.['com.docker.compose.project'], knownSet, projectToStack);
return !!DockerController.resolveProjectLabel(n.Labels?.['com.docker.compose.project'], knownSet, projectToStack)
&& !selfIdentity.isOwnNetwork(n.Id)
&& !selfIdentity.isOwnNetwork(n.Name);
});
await Promise.all(prunable.map(async (net) => {
try {
@@ -371,7 +390,9 @@ class DockerController {
}
const rawImages = await this.docker.listImages({ all: false });
const prunable = (rawImages as any[]).filter((img: any) =>
img.Containers === 0 && !unmanagedImageIds.has(img.Id)
img.Containers === 0
&& !unmanagedImageIds.has(img.Id)
&& !selfIdentity.isOwnImage(img.Id)
);
await Promise.all(prunable.map(async (img) => {
try {
@@ -398,6 +419,7 @@ class DockerController {
): Promise<{ reclaimableBytes: number }> {
const knownSet = new Set(knownStackNames);
const projectToStack = await DockerController.resolveProjectNameMap(knownStackNames);
const selfIdentity = SelfIdentityService.getInstance();
let reclaimableBytes = 0;
if (target === 'volumes') {
@@ -405,7 +427,8 @@ class DockerController {
const rawVolumes: any[] = (this.validateApiData<any>(rawVolumeData)).Volumes || [];
const prunable = rawVolumes.filter((v: any) => {
return !!DockerController.resolveProjectLabel(v.Labels?.['com.docker.compose.project'], knownSet, projectToStack)
&& (v.UsageData?.RefCount ?? 1) === 0;
&& (v.UsageData?.RefCount ?? 1) === 0
&& !selfIdentity.isOwnVolume(v.Name);
});
for (const vol of prunable) reclaimableBytes += vol.UsageData?.Size ?? 0;
} else if (target === 'networks') {
@@ -424,7 +447,9 @@ class DockerController {
}
const rawImages = await this.docker.listImages({ all: false });
const prunable = (rawImages as any[]).filter((img: any) =>
img.Containers === 0 && !unmanagedImageIds.has(img.Id),
img.Containers === 0
&& !unmanagedImageIds.has(img.Id)
&& !selfIdentity.isOwnImage(img.Id),
);
for (const img of prunable) reclaimableBytes += img.Size ?? 0;
}
@@ -1173,11 +1198,17 @@ class DockerController {
// 2. Filter and categorize orphans
const orphans: Record<string, any[]> = {};
const selfIdentity = SelfIdentityService.getInstance();
allContainers.forEach((container) => {
// Look for the docker compose project label
const projectName = container.Labels?.['com.docker.compose.project'];
// Sencho's own container is not a stack on this node, so when it carries
// a compose-project label (compose-deployed installations) it would
// otherwise surface here as a stray under that project name.
if (selfIdentity.isOwnContainer(container.Id)) return;
// If it has a project label, but the project is NOT in our known list...
if (projectName && !knownStackNames.includes(projectName)) {
if (!orphans[projectName]) {