vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-04-30 20:40:09 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Enhance container detection for temperature SSH safeguards (refs #601)

Browse source
This commit is contained in:
rcourtman 2025-11-04 22:30:35 +00:00
parent adda6eea38
commit 10862db4e4
5 changed files with 80 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/TEMPERATURE_MONITORING_SECURITY.md
View file

@ -193,15 +193,17 @@ from="192.168.0.0/24,10.0.0.0/8"
**In containers**, direct SSH is blocked:
```go
if isRunningInContainer() && !devModeAllowSSH {
if system.InContainer() && !devModeAllowSSH {
log.Error().Msg("SECURITY BLOCK: SSH temperature collection disabled in containers")
return &Temperature{Available: false}, nil
}
```
**Container Detection Methods**:
1. Check for `/.dockerenv` file
2. Check `/proc/1/cgroup` for "docker", "lxc", "containerd"
1. `PULSE_FORCE_CONTAINER=1` override for explicit opt-in
2. Presence of `/.dockerenv` or `/run/.containerenv`
3. `container=` hints from environment variables
4. `/proc/1/environ` and `/proc/1/cgroup` markers (`docker`, `lxc`, `containerd`, `kubepods`, etc.)
**Bypass**: Only possible with explicit environment variable (see [Development Mode](#development-mode))