mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-27 04:11:01 +00:00
Anso
7e4ea714c1
* feat(security): rebuild Docker CLI/Compose from source, pin base image digests Build Docker CLI v29.4.0 and Compose v5.1.2 from source against Go 1.26.2 to resolve 7 CVEs that were accepted in .trivyignore: - CVE-2026-32280/32281/32282/32283/33810: Go stdlib x509/TLS and DNS issues in the upstream static CLI binary (compiled with Go 1.26.1). All fixed by rebuilding with Go 1.26.2. - CVE-2026-33186: grpc 1.78.0 in Docker CLI. Eliminated from the SBOM by building with the patched Go toolchain and updated module graph. - CVE-2026-33671: picomatch ReDoS in npm bundled with node:22-alpine. Resolved by removing npm/npx from the runtime image entirely (npm is only needed at build time). Remaining 5 entries in .trivyignore are vendored deps inside Compose v5.1.2 (buildkit, moby/docker, otel) that cannot be patched without an upstream Compose release. These will be expressed as OpenVEX not_affected statements in the follow-up PR (feat/security-sbom-vex). Also in this commit: - Pin all Dockerfile FROM lines to @sha256: digests (node:22-alpine, tonistiigi/xx, golang:1.26-alpine) to prevent silent base image changes between scan and publish. - SHA-pin all GitHub Actions in docker-publish.yml and ci.yml that were previously referenced by mutable @vN tags. - Add a binary version smoke test to confirm docker/compose produce expected output before the multi-arch push proceeds. * fix(docker): fix cli-builder vendor mode and compose-builder cache path docker/cli v29.4.0 uses CalVer and ships vendor.mod instead of go.mod, so plain `go build` fails with "cannot find main module." Fix: copy vendor.mod -> go.mod and vendor.sum -> go.sum before building, then pass -mod=vendor so all deps come from the vendored tree with no network access. Cache mount is not needed with vendor mode and is removed. compose-builder used /root/go/pkg/mod as the cache mount target, but golang:alpine sets GOPATH=/go, so the module cache lives at /go/pkg/mod. The wrong path caused a silent cache miss on every build. Corrected.
Sencho
A self-hosted Docker Compose management dashboard. Manage your stacks, containers, images, volumes, and networks through a modern web UI.
Features
- Stack Management - Create, edit, start, stop, and remove Docker Compose stacks with a built-in Monaco code editor
- Multi-Node Support - Manage remote Sencho instances through a transparent HTTP/WebSocket proxy (Distributed API model)
- App Store - One-click deployment from LinuxServer.io templates with editable ports, volumes, and environment variables
- Resource Hub - Browse and manage images, volumes, and networks with managed/external/unused classification
- Live Logs - Aggregated real-time log streaming across all containers with search and filtering
- Dashboard - Container stats, CPU/RAM metrics, health checks, and image update notifications
- Alerts - Configurable threshold alerts for CPU, RAM, and disk usage
- Terminal - In-browser host console and container exec via WebSocket
Quick Start
services:
sencho:
image: saelix/sencho:latest
container_name: sencho
restart: unless-stopped
ports:
- "1852:1852"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./data:/app/data
# 1:1 Compose Path Rule: host path MUST match container path
- /opt/docker:/opt/docker
environment:
- COMPOSE_DIR=/opt/docker
- DATA_DIR=/app/data
docker compose up -d
Then open http://your-server:1852 and create your admin account.
See the full documentation for configuration details, multi-node setup, and more.
Development
# Backend (Express + TypeScript)
cd backend && npm install && npm run dev
# Frontend (React + Vite)
cd frontend && npm install && npm run dev
The frontend dev server proxies /api requests to the backend on port 1852.
Contributing
See CONTRIBUTING.md for development setup and PR guidelines.
Security
See SECURITY.md for vulnerability reporting. Do not open public issues for security vulnerabilities.
License
Sencho is licensed under the Business Source License 1.1. You may use, modify, and redistribute the code freely, including for production use. The only restriction is offering Sencho as a competing hosted or managed service. On 2030-03-25, the license automatically converts to Apache 2.0.