fix: full /run/user mounted RW into containers

[dmzoneill]

Exposes D-Bus, systemd, PulseAudio, all host sockets. Mount only specific sockets.

[github-actions]

Based on the repository structure, I can see this is a minimal Python script repository. However, the issue you're describing about /run/user being mounted RW into containers suggests there should be container configuration files (like Dockerfile, docker-compose.yml, or Kubernetes manifests) that aren't currently present in the working directory.

Issue Analysis

The security concern is valid: mounting the entire /run/user directory into containers exposes:

• D-Bus sockets - Inter-process communication
• systemd user session - Service management
• PulseAudio sockets - Audio system access
• All other user-level runtime sockets

Recommended Fix

Instead of mounting the entire /run/user directory, mount only the specific sockets needed:

# Instead of:
volumes:
  - /run/user:/run/user:rw

# Use specific socket mounts:
volumes:
  - /run/user/1000/pulse/native:/run/user/1000/pulse/native:ro  # PulseAudio (if needed)
  - /run/user/1000/bus:/run/user/1000/bus:ro  # D-Bus (if needed)

Key improvements:

1. Mount only necessary sockets, not the entire /run/user tree
2. Use read-only (:ro) unless write access is explicitly required
3. Specify exact UID (e.g., 1000) rather than relying on host user detection

Next Steps

To implement this fix, I need to locate the container configuration files. Could you provide information about:

1. Where are the Docker/container configuration files located?
2. Is this configuration in a different repository or branch?
3. What specific sockets does your application actually need?

[dmzoneill]

Re-audit confirmed: /run/user/$(id -u) still mounted full RW in aliases. Should mount only specific sockets: securetty-ssh-agent.sock, securetty-open.sock, pipewire-0, pulse.