0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 02:54:26 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 5.5 284b0873dd fix(sys-ctl-hlth-runtime): harden LAM CLI, catch apk options, drop vars comment

Addresses three CodeRabbit findings on PR #1265.

1. LAM hardening invisible to the probe (thread 4413764929): the runtime
   check probes PHP with `php -r`, the CLI SAPI. web-app-lam mounted the
   hardening ini only into /etc/php/8.4/apache2/conf.d, which the Debian
   CLI does not scan, so the probe read unhardened CLI settings and the
   check failed for LAM. The php_hardening entry now also mounts the ini
   into /etc/php/8.4/cli/conf.d. No other role mounts it into a Debian
   per-SAPI directory; the rest use the shared scan dir of the official
   image or of Alpine. The TODO entry now names the remaining gap: the
   probe reads only the CLI copy.

2. Explanatory comment above HEALTH_RUNTIME_FLOORS (thread 4413764949):
   removed. The README already states the end-of-life rule and now also
   defines a floor as the lowest patched release of each line.

3. `apk --no-cache add` missed (thread 4415018662): PACKAGE_INSTALL_PATTERN
   required `add` right after `apk`, so `RUN apk --no-cache add php7`
   passed as an image without PHP. The apk branch now accepts options
   before `add`, like the apt branch. New tests cover the option form and
   guard that `apk` in a path or a comment is no package install.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-30 08:57:21 +01:00

2.7 KiB

Raw Permalink Blame History

Container Runtime Health Check

Description

This role checks the language runtime inside every running Docker container. It reads the PHP version of each container that ships a php binary and the effective PHP hardening of each service that mounts the shared hardening ini from sys-svc-compose-php.

Overview

The role installs a check script with a systemd service and timer. The check fails, and the failure notifier from sys-ctl-alm-compose alerts, when a container runs PHP below the security floor of its release line or on an end-of-life line, or when a service that declares php_hardening in its meta/volumes.yml still reports expose_php or session.upload_progress.enabled as on. The floors, the lowest patched release of each major.minor line, live in HEALTH_RUNTIME_FLOORS in main.yml.

Cosmos

The diagram places Container Runtime Health Check in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).

flowchart LR
    subgraph role [sys-ctl-hlth-runtime 💻]
        svc_runtime["runtime"]
    end

Solid 1:1 edges are fixed relationships; dashed 0..1 edges are conditional (enabled only in matching deployments); red 0..0 edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in meta/main.yml.

Features

Runtime floor: Fails for every running container whose PHP is below the floor of its major.minor line, or on a line older than every listed floor (end of life). A line newer than every floor passes.
Hardening verification: Runs php inside every service that mounts php_hardening and fails while expose_php or session.upload_progress.enabled is on, which catches a wrong scan dir, a later ini that overrides the hardening, and an image change.
Sidecar report: Lists other PHP containers of a hardened stack, such as cron or worker sidecars, as info without failing.
Registry report: make security-runtimes lists the PHP runtime of every pinned image from registry metadata, without pulling, against the same floors.

Credits

Implemented by Kevin Veen-Birkenbach. Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).

2.7 KiB Raw Permalink Blame History