werkdock/docs/risk-analysis.md

Criticality and Risk Analysis of werkdock

The section "Required Checks" of agentic-workflow.md requires this document. Only the human sets or changes the criticality.

Criticality

high, set by the human on 2026-10-20.

• werkdock is the isolation boundary for code that nobody reviewed yet: Werkator runs the CI builds of every branch and werkrevisor's reviews in werkdock sandboxes on mih09.
• It hands credentials into the sandbox: the environment of a build, e.g. the Gitea token of ai-reviewer and the OpenRouter key of the build ai-review, and the registry credentials of ~/.docker/config.json to crane.
• It is not reachable from the internet.

The default threshold of this criticality is CVSS 4; govulncheck has none, see the deviations below.

What werkdock Handles

• Image store below $WERKDOCK_HOME: rootfs trees from archives, from docker save or OCI layouts, and from registries.
• Instances below instances/: the configuration of each run with its environment, its logs, run/ and its volumes. The environment and the logs can hold the secrets of a build.
• API socket of werkdock system service: a unix socket with mode 0600.
• Registry access through the crane binary, with the credentials of ~/.docker/config.json.

werkdock itself sends nothing to other hosts; crane talks to the registries that an image reference names.

Who Reaches It

• On mih09, the accounts mih09-werkator (CI and reviews) and mih09-werkdock (probes); on the workstation, the user.
• Each process of the account that runs werkdock reaches its store and its API socket. The socket of a CI build lets the build start further sandboxes, e.g. for Testcontainers.
• A process in the sandbox sees the rootfs, the binds of the caller, tmpfs areas and its instance directory. By contract it shares the network, the uid, /proc and /dev with the host (README, RFC 0002).

What a Breach Would Cost

A process that leaves the sandbox acts as the account on mih09 that runs it, mih09-werkator for the CI:

• it reads the Gitea tokens of mi and ai-reviewer, the OpenRouter and TypeSafe keys, and the deploy key of werkregie;
• it can change the worktrees, artifacts and build results of every repository that Werkator builds, and so what Werkator reports and deploys.

Risks

Risk	Measure
a vulnerability of the Go standard library or a dependency in the binary	govulncheck: a branch's own in each PR, main in full each night; go.mod names the toolchain
a dependency under a license the user cannot accept	go-licenses against tools/allowed-licenses.txt in each build
an archive or layer entry that writes outside the image	paths resolved inside the rootfs as in a chroot (internal/rootpath)
a symlink in an image that points a mount or a quirk file at the host	the same resolution for each in-image path
a docker flag that werkdock ignores, so that a caller assumes isolation that is not there	unsupported flags and API endpoints fail with the reason
a secret of the sandbox's environment in an argv, which every ps and every log of a command line shows	bwrap reads the environment from fd 4 (--args), never from its command line; a caller passes a secret as a bare -e KEY
another account reads the environment or the logs of an instance below instances/	instance directories 0700, their files and logs 0600
a library loader variable of the sandbox, e.g. LD_PRELOAD, applied to bwrap on the host	the sandbox's environment never becomes bwrap's own, and bwrap starts with an empty environment, so no variable a caller passes reaches a host program
another process of the same account drives the API socket	socket mode 0600; only the account itself reaches it
a new third-party Go dependency	standard library only; a dependency needs an RFC (RFC 0001)

Open risks:

• The sandbox shares the network of the host by contract. A build reaches every service that listens on mih09, also on 127.0.0.1, e.g. Werkator's web port.
• The rollout to mih09 is manual (AGENTS.md); until it is done, mih09 runs the previous binary and its Go. On 2026-10-20 that binary came from go1.22.2, with known vulnerabilities of the standard library.

Deviations from the Defaults of the Required Checks

• Vulnerabilities: govulncheck instead of a CVSS threshold. The Go vulnerability database has no CVSS scores; govulncheck reports only vulnerabilities whose symbols the code calls, and each of those fails the build. This is stricter than any threshold for what the code calls, and blind to what it does not call.
• Licenses: werkdock itself is left out of the check; it has no license file.