vrr/openwebui-open-terminal
2
0
Fork 0
mirror of https://github.com/open-webui/open-terminal.git synced 2026-07-09 16:09:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
159 commits 1 branch 48 tags 467 KiB
Commit graph

5 commits

Author SHA1 Message Date
Timothy Jaeryang Baek
2da589100c fix: port detection broken since v0.11.2 (#85, #63) 
setcap cap_setgid+ep on the system Python binary made all Python
processes non-dumpable, blocking /proc/[pid]/fd/ access needed by
_pid_from_inode() to resolve socket inodes to PIDs.

Fix: copy the Python binary to python3-ot and setcap only the copy.
The open-terminal server uses python3-ot (has CAP_SETGID for
multi-user os.setgroups()), while user-spawned python3 stays
capability-free and dumpable.

Slim/Alpine: removed setcap entirely (multi-user mode requires sudo,
which only the full image has). Kept libcap packages installed.

README: corrected Image Variants table — multi-user mode is
full-image only.
 2026-03-19 17:42:17 -05:00
Timothy Jaeryang Baek
0f2e4ea178 security: add upgrade hooks for security patching 
- Alpine: apk upgrade active (Alpine patches ship fast)
- Slim/default: apt-get upgrade commented out with guidance
 2026-03-13 16:43:58 -05:00
Timothy Jaeryang Baek
ae89d2ed11 security: pin base images to python:3.12.13, remove apt/apk upgrade 
Per Docker best practices, security patching should come from rebuilding
with updated base image tags, not from apt-get upgrade inside the
Dockerfile. Pinning to a specific patch version ensures reproducible
builds. Bump the version and rebuild to pick up new patches.
 2026-03-13 16:35:51 -05:00
Timothy Jaeryang Baek
3d08ed6372 fix: harden slim/alpine images — cleanup, zlib CVE fix, README.md in builder 
- Copy README.md into builder stage (needed for metadata generation)
- Add pip/pycache/test dir cleanup (~20 MB savings)
- Alpine: apk upgrade to fix zlib CVE-2026-22184 (CRITICAL)
- Trivy results: Alpine 0 HIGH/CRITICAL, Slim 5 HIGH (all unfixed Debian base)
 2026-03-13 15:56:40 -05:00
Timothy Jaeryang Baek
980292b134 feat: add slim and alpine Docker image variants 
- Dockerfile.slim: multi-stage Debian slim (~200 MB)
- Dockerfile.alpine: multi-stage Alpine (~100 MB)
- entrypoint-slim.sh: hardened shared entrypoint (no sudo, no runtime installs)
- CI: build matrix expanded to 3 variants × 2 platforms
- README: image variants table with example commands
 2026-03-13 15:50:14 -05:00