vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-10-19 10:33:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 13

Harden provider-hosted MSP isolation

Browse source 
Broker provider control-plane Docker access through a socket proxy, remove broad host mounts, align audit and rate-limit proxy trust, harden tenant runtime containers, restrict workspace report logo paths, and update provider deploy guardrails.
This commit is contained in:
rcourtman 2026-06-02 21:04:21 +01:00
parent 68e3a015c0
commit c7e50d5602
27 changed files with 725 additions and 209 deletions
Download patch file Download diff file Expand all files Collapse all files

7
deploy/provider-msp/.env.example
View file

@ -7,6 +7,7 @@ CF_DNS_API_TOKEN=
# Image pins; use immutable digest refs in production
TRAEFIK_IMAGE=traefik@sha256:<pin>
DOCKER_SOCKET_PROXY_IMAGE=tecnativa/docker-socket-proxy@sha256:<pin>
CONTROL_PLANE_IMAGE=ghcr.io/rcourtman/pulse-control-plane@sha256:<pin>
CP_PULSE_IMAGE=ghcr.io/rcourtman/pulse@sha256:<pin>
@ -15,9 +16,11 @@ CP_ENV=production
CP_ADMIN_KEY=
PULSE_PROVIDER_MSP_DATA_DIR=/data
PULSE_PROVIDER_MSP_DOCKER_NETWORK=pulse-provider-msp
PULSE_PROVIDER_MSP_DOCKER_SUBNET=172.30.0.0/24
PULSE_PROVIDER_MSP_DOCKER_SOCKET=/var/run/docker.sock
PULSE_PROVIDER_MSP_HOST_ROOT=/
PULSE_PROVIDER_MSP_DOCKER_DATA_DIR=/var/lib/docker
PULSE_PROVIDER_MSP_ROOT_SPACECHECK_DIR=/var/lib/pulse-provider-msp/spacecheck/root
PULSE_PROVIDER_MSP_DOCKER_SPACECHECK_DIR=/var/lib/docker/.pulse-provider-msp-spacecheck
CP_TRUSTED_PROXY_CIDRS=172.30.0.0/24
CP_PROVIDER_MSP_LICENSE_FILE=./provider-msp-license.jwt
CP_TRIAL_ACTIVATION_PRIVATE_KEY=
CP_TENANT_MEMORY_LIMIT=536870912