Conversation
…entrypoint script for rootless Docker environments
The Docker socket's :ro bind-mount flag prevents the socket file from being deleted/renamed but does not restrict Docker API access. Any process with socket access retains root-equivalent control over the Docker daemon. This was a misleading omission in the documentation. Updated three docs to correct this: - Explain the :ro limitation honestly and frame socket mounting as an optional feature users can skip if they don't need auto-discovery - Recommend a socket proxy as the production hardening pattern, scoped to only the container listing endpoints Charon actually requires - Provide a ready-to-use compose example using linuxserver/socket-proxy with CONTAINERS=1 and POST=0 so write operations are denied - Add a short security callout in the getting-started guide pointing users toward the proxy setup Closes #920
…4 to version 4.28.1
…y management Co-authored-by: Copilot <copilot@github.com>
fix: update ownership handling for data volume and subdirectories in entrypoint script for rootless Docker environments
Automated checksum update for GeoLite2-Country.mmdb database. Old: 62049119bd084e19fff4689bebe258f18a5f27a386e6d26ba5180941b613fc2b New: c880cbc7e6b1a9b1a96d530c34996480d6d809d2c89a6bd73a5072e4fffbc01c Auto-generated by: .github/workflows/update-geolite2.yml
… to staged changes
- Add nosemgrep inline suppression on os.Open call in logs_handler.go;
path is already validated by LogService.GetLogPath via filepath.Base
equality check and prefix validation
- Scope semgrep pre-commit scan to staged files via {staged_files} in
lefthook, with full-scan fallback when no file args are provided
- Scope golangci-lint pre-commit scan to new-from-rev HEAD so only
issues introduced by the current change are reported, preventing
pre-existing issues in unrelated files from blocking commits
- renovate.json: align dependency grouping configuration
chore(docker): update GeoLite2-Country.mmdb checksum
Propagate changes from development into feature/beta-release
…pdates chore(deps): update non-major-updates (development)
Contributor
Author
✅ Supply Chain Verification Results✅ PASSED 📦 SBOM Summary
🔍 Vulnerability Scan
📎 Artifacts
Generated by Supply Chain Verification workflow • View Details |
Contributor
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🚀 Weekly Nightly to Main Promotion
Date: 2026-04-27
Trigger: Scheduled weekly promotion
Commits: 17 commits to promote
Changes: 33 files changed, 222 insertions(+), 88 deletions(-)
Commits Being Promoted
Pre-Merge Checklist
Merge Instructions
This PR promotes changes from
nightlytomain. Once all checks pass:This PR was automatically created by the Weekly Nightly Promotion workflow.