mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
06d9ef5904
* fix(docker): build compose plugin from ./cmd, not ./cmd/compose The compose-builder stage in Dockerfile was building ./cmd/compose, which in docker/compose v5.1.2 is `package compose` (cobra command definitions), not the CLI plugin entry point. `go build -o file pkg` against a non-main package writes a Go archive; COPY and chmod accept it, but the kernel cannot exec an ar-format file, so the Docker CLI plugin manager rejected the binary and surfaced only as `docker: unknown command: docker compose` in the v0.64.0 release smoke gate. The plugin's actual main package is at ./cmd (cmd/main.go calls plugin.Run from the cli-plugins framework), per the upstream Makefile in v5.1.2. Also fix the version ldflag to target the v5 module path: in v5 the module moved from github.com/docker/compose/v2 to .../v5, so the previous -X .../v2/internal.Version= silently no-op'd and `docker compose version` would have reported an empty string even after the build target fix. Add -trimpath and -s -w to match the upstream Makefile's release flags. Add an inline ELF-magic sanity check inside the compose-builder stage so this exact failure mode (non-main package emitting an archive) fails the build at the producer instead of surfacing 200 lines later. Hex match via `od -tx1` works on both busybox and GNU coreutils; the named-character form (`od -c`) renders fields differently across the two. Add a binary smoke step to the docker-validate PR job that mirrors the release-time gate, so a regression in either the CLI or compose source build is caught at PR review time rather than at tag-push time. * fix(vex): match Trivy purl format for bundled docker/docker version The compose plugin build target fix exposes a real consequence: now that compose-builder produces a true ELF binary (rather than a Go archive), Trivy can read the embedded Go module metadata and correctly reports the bundled docker/docker dependency as `v28.5.2+incompatible`. The existing VEX subcomponent ID omitted the `+incompatible` Go-module suffix, so Trivy's purl matcher rejected the suppression and CVE-2026-34040 surfaced in the docker-validate scan against the rebuilt image. Update the @id to the literal version Trivy emits and bump the document version per OpenVEX spec. The justification (compose acts as a CLI client, never as a daemon, so the authz-hook path is unreachable) is unchanged and continues to apply to v28.5.2+incompatible identically. * docs(security): explain why CVE-2026-34040 cannot be upgraded out A direct in-build upgrade attempt (`go get github.com/docker/docker@<sha of docker-v29.3.1>`) fails with: invalid version: go.mod has post-v1 module path "github.com/moby/moby/v2" at revision f78c987a moby/moby migrated its Go module path to `github.com/moby/moby/v2` on the docker-29.x branch. The legacy `github.com/docker/docker` import path is therefore frozen at v28.5.2+incompatible from Go's perspective; the proxy.golang.org listing for that module path confirms no v29.x version is resolvable. compose v5.1.2 (and v5.1.3, the latest tag at the time of writing) both still import the legacy path, so the bundled docker/docker library cannot be moved past v28.5.2+incompatible until upstream compose migrates its imports. Document the constraint in two places so a future maintainer (or future me) does not re-attempt the same `go get` and arrive at the same dead end: - Dockerfile compose-builder stage: comment block above the build step. - security/vex/sencho.openvex.json: expand the CVE-2026-34040 statement's impact_statement to spell out the upstream module-split blocker. The not_affected status (compose runs as a CLI client, never executes the daemon authz hook code path) is the principled triage and remains the correct OpenVEX call, not a deferred upgrade. No build or runtime behaviour changes. Pure documentation enrichment. * fix(security): mirror CVE-2026-34040 VEX statement in .trivyignore Trivy reports `Some vulnerabilities have been ignored/suppressed` but still fails the docker-validate scan on CVE-2026-34040, because the OpenVEX statement's product identifier `pkg:oci/sencho` cannot match the build-local image tag `sencho:pr-test`. Trivy does not generate an OCI purl for images that lack a registry digest (aquasecurity/trivy issue 9399), so VEX product matching is a no-op at PR and release scan time. The dual-layer pattern documented in .trivyignore's header was designed for exactly this case: VEX is the canonical, attested, published triage record, and .trivyignore mirrors entries that scan-time matching cannot resolve, with a comment pointing to the corresponding VEX justification. The CVE-2026-34040 OpenVEX statement is unchanged (status=not_affected, justification=vulnerable_code_not_in_execute_path). The .trivyignore entry is a build-time scan filter only, with a referencing comment so auditors land on the VEX file as the source of truth. CVE-2026-39883 already follows this pattern and continues to.
Sencho
A self-hosted Docker Compose management dashboard. Manage your stacks, containers, images, volumes, and networks through a modern web UI.
Features
- Stack Management - Create, edit, start, stop, and remove Docker Compose stacks with a built-in Monaco code editor
- Multi-Node Support - Manage remote Sencho instances through a transparent HTTP/WebSocket proxy (Distributed API model)
- App Store - One-click deployment from LinuxServer.io templates with editable ports, volumes, and environment variables
- Resource Hub - Browse and manage images, volumes, and networks with managed/external/unused classification
- Live Logs - Aggregated real-time log streaming across all containers with search and filtering
- Dashboard - Container stats, CPU/RAM metrics, health checks, and image update notifications
- Alerts - Configurable threshold alerts for CPU, RAM, and disk usage
- Terminal - In-browser host console and container exec via WebSocket
Quick Start
services:
sencho:
image: saelix/sencho:latest
container_name: sencho
restart: unless-stopped
ports:
- "1852:1852"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./data:/app/data
# 1:1 Compose Path Rule: host path MUST match container path
- /opt/docker:/opt/docker
environment:
- COMPOSE_DIR=/opt/docker
- DATA_DIR=/app/data
docker compose up -d
Then open http://your-server:1852 and create your admin account.
See the full documentation for configuration details, multi-node setup, and more.
Development
# Backend (Express + TypeScript)
cd backend && npm install && npm run dev
# Frontend (React + Vite)
cd frontend && npm install && npm run dev
The frontend dev server proxies /api requests to the backend on port 1852.
Contributing
See CONTRIBUTING.md for development setup and PR guidelines.
Security
See SECURITY.md for vulnerability reporting. Do not open public issues for security vulnerabilities.
License
Sencho is licensed under the Business Source License 1.1. You may use, modify, and redistribute the code freely, including for production use. The only restriction is offering Sencho as a competing hosted or managed service. On 2030-03-25, the license automatically converts to Apache 2.0.