🐛 fix(examples): repair crash-looping compose examples + preset-docs drift#125
Merged
Merged
Conversation
…figs with canonical presets
Both examples/compose/{github-actions-runner,gitlab-runner}/sockguard.yaml were
stale hand-copies of the canonical app/configs/*.yaml presets — they were
missing insecure_allow_body_blind_writes/insecure_allow_read_exfiltration,
which the canonical presets carry. sockguard serve --config <example> failed
startup validation, so docker compose up crash-looped for both stacks.
Add the two missing acknowledgment flags to each example, matching the
canonical policy exactly (rules/request_body/response were already in sync).
…esets PR#122 added app/configs/portwing-with-compose.yaml and drydock-with-compose.yaml (17 tool presets total), but README.md's "Bundled presets (15)" heading/list and docs/content/docs/presets.mdx never caught up. Bump the README count and add both presets to its list; add a matching ## section for each to presets.mdx, following the sibling entries' format.
commit dac2f31 actually touched 8 examples/compose/*/docker-compose.yml files plus the root compose (multi-host correctly has none — it dials a remote Docker daemon over tcp:// + TLS and never mounts the socket).
…ith-compose header The header comment cited request_body.network_create / request_body.volume_create, neither of which exists. The real mapstructure keys are request_body.network and request_body.volume (see app/internal/config/config.go).
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Post-review cleanup from the tri-repo correctness/completeness sweep. Four findings, all in shipped example configs and preset docs — no change to the canonical presets or filter behavior.
Critical: two compose example bundles crash-loop on startup
examples/compose/github-actions-runner/sockguard.yamlandexamples/compose/gitlab-runner/sockguard.yamlwere stale hand-copies missing the two acknowledgment flags their canonical presets carry (insecure_allow_body_blind_writes,insecure_allow_read_exfiltration, added in 5883d16 and never propagated). Bothsockguard serve/docker compose upfail validation on startup. Synced both flags from the canonical presets with a "keep in sync" comment. Reproduced the crash before, confirmed both start after.Major: no drift guard for three of the example copies (the root cause)
Only the drydock and portwing example copies had sync tests; github-actions-runner, gitlab-runner, and tri-tool's third portwing hand-copy had none — which is why the drift above shipped. Replaced the two single-purpose sync tests with one table-driven
compose_example_sync_test.gocovering all five example/canonical pairs, so any future copy that diverges fails CI.Major: two presets undiscoverable in the docs
PR #122 added
portwing-with-compose.yaml+drydock-with-compose.yaml(17 presets total) butREADME.mdstill said "Bundled presets (15)" and neither appeared in the list or inpresets.mdx. Bumped the count and documented both.Minor doc fixes
CHANGELOG.md: "all nine examples/compose/*" group_add claim corrected to eight (multi-host correctly has none).app/configs/portwing-with-compose.yamlheader: cited nonexistent config keysrequest_body.network_create/volume_create; corrected to the realrequest_body.network/request_body.volume.Config package tests + build green. No canonical preset touched.