5 Commits

Include renames

Author	SHA1	Message	Date
jochen	13b7562c47	Keep secrets off command lines the runtime records (hq issue 282) ... mosquitto passed the broker's admin password to mosquitto_ctrl as -P on every docker exec, and the container runtime keeps every exec's command line in its event stream, where docker_events returned it. The admin credentials now reach mosquitto_ctrl as a 0600 options file fed on stdin, client passwords at its own prompt, and an argv carrying a secret is refused before it runs. The admin secret says it is taken at start: the bootstrap re-runs when the mesh replaces it and re-keys the broker online from the value it last applied, so it can be rotated. docker_events redacts what an exec's command line carried, and docker_secrets_in_events names such secrets by name. keycloak's repair hands kcadm its passwords through KC_CLI_PASSWORD; minio gives mc its root alias through MC_HOST_mesh.	2026-10-07 01:37:21 +02:00
jochen	bbb67e41a0	docker: find and hide secrets a container printed into its log (hq issue 268) ... letta printed two passwords into its log for weeks and nothing noticed, and docker_logs handed them to whoever asked. docker_secrets_in_logs compares each container's recent lines with the secret-named values of its environment, the passwords in its URIs, and any URI carrying a password, and names what it found by container, module and variable - never the value. docker_logs redacts the same values before answering.	2026-10-06 02:13:42 +02:00
jochen	964a4fdfbc	docker: trust the mesh's registry from the runtime's own module (hq issue 190) ... The controller's private network writes insecure-registries into daemon.json, a file this module owns. The runtime's module states it instead, through ${seat:mesh-artifact-store:reach} (hq ADR 0222), so the controller can stop generating its registry-trust resources.	2026-10-05 22:17:16 +02:00
jochen	f20c4b749b	The runtime's file is written by the runtime's module, not by what decides how a machine resolves (issue 190) ... resolv-conf would have taken over dnsmasq's write into daemon.json — the same defect issue 190 names. docker, on every machine, now writes live-restore and reloads its own service. Log rotation is left as each machine has it.	2026-10-05 20:42:58 +02:00
jochen	0d72c3f29a	docker: the container runtime as a module, with its tools in Go ... Claims node-container-runtime (ADR 0207). Owns the packages, the socket and a weekly prune of dangling images and unused build cache. Serves 18 tools over every container, marking the mesh's. daemon.json, docker.service and the docker group are left to a proposed change: dnsmasq and zsh declare them today, and the controller refuses a second declaration (README).	2026-10-04 12:43:51 +02:00