mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
284b0873dd
Addresses three CodeRabbit findings on PR #1265. 1. LAM hardening invisible to the probe (thread 4413764929): the runtime check probes PHP with `php -r`, the CLI SAPI. web-app-lam mounted the hardening ini only into /etc/php/8.4/apache2/conf.d, which the Debian CLI does not scan, so the probe read unhardened CLI settings and the check failed for LAM. The php_hardening entry now also mounts the ini into /etc/php/8.4/cli/conf.d. No other role mounts it into a Debian per-SAPI directory; the rest use the shared scan dir of the official image or of Alpine. The TODO entry now names the remaining gap: the probe reads only the CLI copy. 2. Explanatory comment above HEALTH_RUNTIME_FLOORS (thread 4413764949): removed. The README already states the end-of-life rule and now also defines a floor as the lowest patched release of each line. 3. `apk --no-cache add` missed (thread 4415018662): PACKAGE_INSTALL_PATTERN required `add` right after `apk`, so `RUN apk --no-cache add php7` passed as an image without PHP. The apk branch now accepts options before `add`, like the apt branch. New tests cover the option form and guard that `apk` in a path or a comment is no package install. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
36 lines
2.7 KiB
Markdown
36 lines
2.7 KiB
Markdown
# Container Runtime Health Check
|
|
|
|
## Description
|
|
|
|
This role checks the language runtime inside every running Docker container. It reads the PHP version of each container that ships a `php` binary and the effective PHP hardening of each service that mounts the shared hardening ini from [`sys-svc-compose-php`](../sys-svc-compose-php/README.md).
|
|
|
|
## Overview
|
|
|
|
The role installs a check script with a `systemd` service and timer. The check fails, and the failure notifier from [`sys-ctl-alm-compose`](../sys-ctl-alm-compose/README.md) alerts, when a container runs PHP below the security floor of its release line or on an end-of-life line, or when a service that declares `php_hardening` in its `meta/volumes.yml` still reports `expose_php` or `session.upload_progress.enabled` as on. The floors, the lowest patched release of each `major.minor` line, live in `HEALTH_RUNTIME_FLOORS` in [main.yml](./vars/main.yml).
|
|
|
|
## Cosmos
|
|
|
|
The diagram places Container Runtime Health Check in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).
|
|
|
|
```mermaid
|
|
flowchart LR
|
|
subgraph role [sys-ctl-hlth-runtime 💻]
|
|
svc_runtime["runtime"]
|
|
end
|
|
```
|
|
|
|
Solid `1:1` edges are fixed relationships; dashed `0..1` edges are conditional (enabled only in matching deployments); red `0..0` edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in `meta/main.yml`.
|
|
|
|
## Features
|
|
|
|
- **Runtime floor:** Fails for every running container whose PHP is below the floor of its `major.minor` line, or on a line older than every listed floor (end of life). A line newer than every floor passes.
|
|
- **Hardening verification:** Runs `php` inside every service that mounts `php_hardening` and fails while `expose_php` or `session.upload_progress.enabled` is on, which catches a wrong scan dir, a later ini that overrides the hardening, and an image change.
|
|
- **Sidecar report:** Lists other PHP containers of a hardened stack, such as cron or worker sidecars, as info without failing.
|
|
- **Registry report:** `make security-runtimes` lists the PHP runtime of every pinned image from registry metadata, without pulling, against the same floors.
|
|
|
|
## Credits
|
|
|
|
Implemented by **[Kevin Veen-Birkenbach](https://www.veen.world)**.
|
|
Part of the [Infinito.Nexus Project](https://s.infinito.nexus/code) and maintained by [Kevin Veen-Birkenbach](https://www.veen.world).
|
|
Licensed under the [Infinito.Nexus Community License (Non-Commercial)](https://s.infinito.nexus/license).
|