Repository navigation
Conversation
…E.md and two pages CLAUDE.md still said two containers, a worker that must have Docker socket access and must be privileged. Since v1.71.0 the worker reaches Docker only through cashpilot-socket-proxy, and since v1.73.0 owner isolation limits it to what it created. faq.md and how-it-works.md said the same. The socket-proxy docs test now covers CLAUDE.md and these phrasings.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 32 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
…owner labels Owner isolation limits the worker to resources carrying its owner label, not only what it created, and images are not scoped. The Unraid templates and the TrueNAS app still mount the raw socket in the worker; say so where CLAUDE.md, the FAQ and how-it-works describe the proxy.
|
CodeRabbit hit its review limit here, so it reviewed the same head on the mirror geiresx#30. Two findings, both fixed in 'docs: scope the socket-proxy claims to the shipped compose files and owner labels'. Owner isolation is now described by the owner label, not by 'what it created', and images are noted as unscoped. CLAUDE.md, the FAQ and how-it-works now say the Unraid templates and the TrueNAS app still mount the raw socket in the worker. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #638 +/- ##
=======================================
Coverage 93.97% 93.97%
=======================================
Files 74 74
Lines 15678 15678
=======================================
Hits 14733 14733
Misses 945 945 🚀 New features to boost your workflow:
|
Problem
CLAUDE.md, the file every agent reads before changing this repo, still describes the worker from before v1.71.0: "Two containers ...cashpilot-worker(port 8081, Docker agent requiring socket access)", "Must have Docker socket access", "Workers must be privileged." and "Worker requires Docker socket access (/var/run/docker.sock)". Since v1.71.0 (#583) the worker has no Docker socket. It reaches Docker throughcashpilot-socket-proxy's filtered socket, and since v1.73.0 (#621) owner isolation limits it to the containers, volumes and networks it created. An agent going by the old text would wire new code to a socket the worker no longer has.Pointing the existing docs check at these phrasings found the same claim on two published pages:
docs/faq.md("Only the worker container requires Docker socket access") anddocs/how-it-works.md("Workers must be privileged").Fix
CLAUDE.md: three long-running containers (UI, worker, socket proxy). The worker reaches Docker throughDOCKER_HOST=unix:///run/cashpilot-docker/docker.sock, owner isolation applies since v1.73.0, and only the proxy and the one-shotcashpilot-migratemount/var/run/docker.sock.docs/faq.mdanddocs/how-it-works.md: the same, one sentence each.tests/test_docs_say_the_socket_proxy_holds_the_socket.pynow scansCLAUDE.mdtoo and knows the three old phrasings. On main it fails forCLAUDE.md,faq.mdandhow-it-works.md. Here it passes (36 tests).