6 Commits

Include renames

Author	SHA1	Message	Date
jochen	465707d41d	docker: remove images no container or declaration uses, keeping the previous of each line (hq ADR 0251) ... Images pulled by digest are not dangling, so the weekly prune never takes an old version and every machine keeps every image it ever ran. docker_prune_images takes them, keeps what the declaration names (asked of the controller; no answer, nothing removed) and the one before, and is a dry run unless asked with a why.	2026-10-08 11:56:43 +02:00
jochen	13b7562c47	Keep secrets off command lines the runtime records (hq issue 282) ... mosquitto passed the broker's admin password to mosquitto_ctrl as -P on every docker exec, and the container runtime keeps every exec's command line in its event stream, where docker_events returned it. The admin credentials now reach mosquitto_ctrl as a 0600 options file fed on stdin, client passwords at its own prompt, and an argv carrying a secret is refused before it runs. The admin secret says it is taken at start: the bootstrap re-runs when the mesh replaces it and re-keys the broker online from the value it last applied, so it can be rotated. docker_events redacts what an exec's command line carried, and docker_secrets_in_events names such secrets by name. keycloak's repair hands kcadm its passwords through KC_CLI_PASSWORD; minio gives mc its root alias through MC_HOST_mesh.	2026-10-07 01:37:21 +02:00
jochen	bbb67e41a0	docker: find and hide secrets a container printed into its log (hq issue 268) ... letta printed two passwords into its log for weeks and nothing noticed, and docker_logs handed them to whoever asked. docker_secrets_in_logs compares each container's recent lines with the secret-named values of its environment, the passwords in its URIs, and any URI carrying a password, and names what it found by container, module and variable - never the value. docker_logs redacts the same values before answering.	2026-10-06 02:13:42 +02:00
jochen	964a4fdfbc	docker: trust the mesh's registry from the runtime's own module (hq issue 190) ... The controller's private network writes insecure-registries into daemon.json, a file this module owns. The runtime's module states it instead, through ${seat:mesh-artifact-store:reach} (hq ADR 0222), so the controller can stop generating its registry-trust resources.	2026-10-05 22:17:16 +02:00
jochen	f20c4b749b	The runtime's file is written by the runtime's module, not by what decides how a machine resolves (issue 190) ... resolv-conf would have taken over dnsmasq's write into daemon.json — the same defect issue 190 names. docker, on every machine, now writes live-restore and reloads its own service. Log rotation is left as each machine has it.	2026-10-05 20:42:58 +02:00
jochen	0d72c3f29a	docker: the container runtime as a module, with its tools in Go ... Claims node-container-runtime (ADR 0207). Owns the packages, the socket and a weekly prune of dangling images and unused build cache. Serves 18 tools over every container, marking the mesh's. daemon.json, docker.service and the docker group are left to a proposed change: dnsmasq and zsh declare them today, and the controller refuses a second declaration (README).	2026-10-04 12:43:51 +02:00