mARTin-B78/tts-voice-creator-clone-and-design-2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: harden web container runtime

Browse Source
This commit is contained in:
mARTin-B78 2026-09-04 07:45:31 +02:00
parent c78d1683b6
commit d19e52fe28
3 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGELOG.md
View File

@ -23,6 +23,9 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) · versioned wi
- **Security Regression Coverage.** Added a Python test gate for character metadata validation, private-download URL - **Security Regression Coverage.** Added a Python test gate for character metadata validation, private-download URL
rejection and oversized JSON request rejection. rejection and oversized JSON request rejection.
- **Navigation Reliability.** Rehearser phase requests now survive the feature-module initialization boundary. - **Navigation Reliability.** Rehearser phase requests now survive the feature-module initialization boundary.
- **Container Hardening.** The web container now uses a read-only root filesystem,
drops all Linux capabilities, and enables `no-new-privileges`; application data remains writable only through
the declared mounts.
### Fixed ### Fixed
- **SSRF and Credential-Leak Paths.** User-supplied downloads are validated against private-network access settings, - **SSRF and Credential-Leak Paths.** User-supplied downloads are validated against private-network access settings,

6
TODO.md
View File

@ -33,9 +33,9 @@ the first block before investing in architecture or polish.
malformed records at API boundaries. malformed records at API boundaries.
- [x] **L — Add database migrations and prompt/generation history.** Preserve old record - [x] **L — Add database migrations and prompt/generation history.** Preserve old record
shapes and allow bad regenerations to be reverted. shapes and allow bad regenerations to be reverted.
- [ ] **L — Harden container and Docker access.** Run as non-root with dropped - [ ] **L — Harden container and Docker access.** The app now runs non-root with
capabilities/read-only filesystems where practical, and isolate Docker socket access dropped capabilities, no-new-privileges and a read-only root filesystem; isolate
behind a minimal privileged service. the remaining Docker socket access behind a minimal privileged service.
### P1 — next, highest user impact ### P1 — next, highest user impact

10
docker-compose.yml
View File

@ -7,6 +7,16 @@ services:
container_name: tts-voice-creator-clone-and-design-2 container_name: tts-voice-creator-clone-and-design-2
restart: unless-stopped restart: unless-stopped
# The application writes only to the explicitly mounted data paths below.
# Keep the image filesystem immutable even if an endpoint is compromised.
read_only: true
cap_drop:
- ALL
security_opt:
- no-new-privileges:true
tmpfs:
- /tmp:size=1g,mode=1777
# Keep a runaway OCR/import/generation request from consuming all host RAM. # Keep a runaway OCR/import/generation request from consuming all host RAM.
# Override these per machine when large PDF jobs need more headroom: # Override these per machine when large PDF jobs need more headroom:
# APP_MEM_LIMIT=12g APP_MEM_RESERVATION=2g docker compose up -d # APP_MEM_LIMIT=12g APP_MEM_RESERVATION=2g docker compose up -d