mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
fdb476a84a
* ci: hard-fail PR and release scans on unacknowledged HIGH/CRITICAL CVEs Make Trivy a real gate instead of an advisory signal: - PR CI (docker-validate) no longer uses `continue-on-error: true` on the Trivy step, so any HIGH/CRITICAL finding not in `.trivyignore` fails the PR. - The release pipeline (docker-publish.yml) now builds an amd64-only scan image into the local daemon before the multi-arch push-build, re-runs Trivy against that exact artifact, and only proceeds to the push if the scan passes. This closes the gap where a CVE landed between PR merge and release-time rebuild. - New `.trivyignore` at repo root is the single source of truth for acknowledged CVEs across both workflows; it starts empty so the first CI run surfaces the full list, which we then populate with justifications. * ci: populate .trivyignore with initial HIGH/CRITICAL acknowledgements First CI run on the hard-fail Trivy policy surfaced 7 unacknowledged findings. Each has been reviewed and justified inline: - 6 CVEs in the statically-linked Go modules inside docker-compose v5.1.1 (github.com/docker/docker, buildkit, otel/sdk x2, grpc). These are transitively bundled and cannot be bumped without an upstream Compose rebuild. The grpc CVE is already explicitly acknowledged in the Dockerfile rationale block at Dockerfile:108-111. - 1 CVE in picomatch 4.0.3 bundled inside the npm CLI that ships with node:22-alpine. npm is only invoked at build time against our own package.json, so the ReDoS vector is not reachable. Every entry has a revisit trigger (next Compose release or next Alpine node bump).
Sencho
A self-hosted Docker Compose management dashboard. Manage your stacks, containers, images, volumes, and networks through a modern web UI.
Features
- Stack Management - Create, edit, start, stop, and remove Docker Compose stacks with a built-in Monaco code editor
- Multi-Node Support - Manage remote Sencho instances through a transparent HTTP/WebSocket proxy (Distributed API model)
- App Store - One-click deployment from LinuxServer.io templates with editable ports, volumes, and environment variables
- Resource Hub - Browse and manage images, volumes, and networks with managed/external/unused classification
- Live Logs - Aggregated real-time log streaming across all containers with search and filtering
- Dashboard - Container stats, CPU/RAM metrics, health checks, and image update notifications
- Alerts - Configurable threshold alerts for CPU, RAM, and disk usage
- Terminal - In-browser host console and container exec via WebSocket
Quick Start
services:
sencho:
image: saelix/sencho:latest
container_name: sencho
restart: unless-stopped
ports:
- "3000:3000"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./data:/app/data
# 1:1 Compose Path Rule: host path MUST match container path
- /opt/docker:/opt/docker
environment:
- COMPOSE_DIR=/opt/docker
- DATA_DIR=/app/data
docker compose up -d
Then open http://your-server:3000 and create your admin account.
See the full documentation for configuration details, multi-node setup, and more.
Development
# Backend (Express + TypeScript)
cd backend && npm install && npm run dev
# Frontend (React + Vite)
cd frontend && npm install && npm run dev
The frontend dev server proxies /api requests to the backend on port 3000.
Contributing
See CONTRIBUTING.md for development setup and PR guidelines.
Security
See SECURITY.md for vulnerability reporting. Do not open public issues for security vulnerabilities.
License
Sencho is licensed under the Business Source License 1.1. You may use, modify, and redistribute the code freely, including for production use. The only restriction is offering Sencho as a competing hosted or managed service. On 2030-03-25, the license automatically converts to Apache 2.0.