75 lines
4.7 KiB
Markdown
75 lines
4.7 KiB
Markdown
# Criticality and Risk Analysis of werkdock
|
|
|
|
The section "Required Checks" of [agentic-workflow.md](agentic-workflow.md) requires this document.
|
|
Only the human sets or changes the criticality.
|
|
|
|
## Criticality
|
|
|
|
**high**, set by the human on 2026-10-20.
|
|
|
|
- werkdock is the isolation boundary for code that nobody reviewed yet:
|
|
Werkator runs the CI builds of every branch and werkrevisor's reviews in werkdock sandboxes on mih09.
|
|
- It hands credentials into the sandbox: the environment of a build, e.g. the Gitea token of `ai-reviewer`
|
|
and the OpenRouter key of the build `ai-review`, and the registry credentials of `~/.docker/config.json` to `crane`.
|
|
- It is not reachable from the internet.
|
|
|
|
The default threshold of this criticality is CVSS 4; govulncheck has none, see the deviations below.
|
|
|
|
## What werkdock Handles
|
|
|
|
- **Image store** below `$WERKDOCK_HOME`: rootfs trees from archives, from `docker save` or OCI layouts, and from registries.
|
|
- **Instances** below `instances/`: the configuration of each run with its environment, its logs, `run/` and its volumes.
|
|
The environment and the logs can hold the secrets of a build.
|
|
- **API socket** of `werkdock system service`: a unix socket with mode 0600.
|
|
- **Registry access** through the `crane` binary, with the credentials of `~/.docker/config.json`.
|
|
|
|
werkdock itself sends nothing to other hosts; `crane` talks to the registries that an image reference names.
|
|
|
|
## Who Reaches It
|
|
|
|
- On mih09, the accounts `mih09-werkator` (CI and reviews) and `mih09-werkdock` (probes);
|
|
on the workstation, the user.
|
|
- Each process of the account that runs werkdock reaches its store and its API socket.
|
|
The socket of a CI build lets the build start further sandboxes, e.g. for Testcontainers.
|
|
- A process in the sandbox sees the rootfs, the binds of the caller, tmpfs areas and its instance directory.
|
|
By contract it shares the network, the uid, `/proc` and `/dev` with the host (README, RFC 0002).
|
|
|
|
## What a Breach Would Cost
|
|
|
|
A process that leaves the sandbox acts as the account on mih09 that runs it, `mih09-werkator` for the CI:
|
|
|
|
- it reads the Gitea tokens of `mi` and `ai-reviewer`, the OpenRouter and TypeSafe keys,
|
|
and the deploy key of werkregie;
|
|
- it can change the worktrees, artifacts and build results of every repository that Werkator builds,
|
|
and so what Werkator reports and deploys.
|
|
|
|
## Risks
|
|
|
|
| Risk | Measure |
|
|
|------|---------|
|
|
| a vulnerability of the Go standard library or a dependency in the binary | govulncheck: a branch's own in each PR, main in full each night; `go.mod` names the toolchain |
|
|
| a dependency under a license the user cannot accept | go-licenses against `tools/allowed-licenses.txt` in each build |
|
|
| an archive or layer entry that writes outside the image | paths resolved inside the rootfs as in a chroot (`internal/rootpath`) |
|
|
| a symlink in an image that points a mount or a quirk file at the host | the same resolution for each in-image path |
|
|
| a docker flag that werkdock ignores, so that a caller assumes isolation that is not there | unsupported flags and API endpoints fail with the reason |
|
|
| a secret of the sandbox's environment in an argv, which every `ps` and every log of a command line shows | bwrap reads the environment from fd 4 (`--args`), never from its command line; a caller passes a secret as a bare `-e KEY` |
|
|
| another account reads the environment or the logs of an instance below `instances/` | instance directories 0700, their files and logs 0600 |
|
|
| a library loader variable of the sandbox, e.g. `LD_PRELOAD`, applied to bwrap on the host | the sandbox's environment never becomes bwrap's own, and bwrap starts with an empty environment, so no variable a caller passes reaches a host program |
|
|
| another process of the same account drives the API socket | socket mode 0600; only the account itself reaches it |
|
|
| a new third-party Go dependency | standard library only; a dependency needs an RFC (RFC 0001) |
|
|
|
|
Open risks:
|
|
|
|
- The sandbox shares the network of the host by contract.
|
|
A build reaches every service that listens on mih09, also on 127.0.0.1, e.g. Werkator's web port.
|
|
- The rollout to mih09 is manual (AGENTS.md); until it is done, mih09 runs the previous binary and its Go.
|
|
On 2026-10-20 that binary came from go1.22.2, with known vulnerabilities of the standard library.
|
|
|
|
## Deviations from the Defaults of the Required Checks
|
|
|
|
- **Vulnerabilities:** govulncheck instead of a CVSS threshold.
|
|
The Go vulnerability database has no CVSS scores;
|
|
govulncheck reports only vulnerabilities whose symbols the code calls, and each of those fails the build.
|
|
This is stricter than any threshold for what the code calls, and blind to what it does not call.
|
|
- **Licenses:** werkdock itself is left out of the check; it has no license file.
|