mirror of
https://github.com/Gloridust/WechatOnCloud.git
synced 2026-09-20 11:33:32 +08:00
a032d17d71
Adds docker-compose.secure.yml and doc/安全加固.md as fully opt-in security hardening for any WOC deployment. The raw docker.sock mount in the panel is root-equivalent: a compromised panel process can create privileged containers, mount the host filesystem, or stop/delete arbitrary containers. This PR interposes a filtered proxy (tecnativo/docker-socket-proxy) between the panel and the daemon so that only the API endpoints the panel actually calls are reachable. Changes: - docker-compose.secure.yml: compose overlay that adds the proxy service, wires the panel to it via DOCKER_HOST, and shadows /var/run/docker.sock with /dev/null to block direct socket access at the filesystem level. Allowed: CONTAINERS, EXEC (required for app install / file ops / xdotool), IMAGES, VOLUMES, POST, INFO. Everything else is explicitly denied. - doc/安全加固.md: explains the threat model, how the proxy mitigates it, residual gaps (endpoint-level filtering cannot inspect request bodies), usage instructions, and image digest pinning as a complementary practice. Default docker-compose.yml is not modified. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>