harden docker agent serve api: warn on non-loopback, fix runtime race, block SSRF

[dgageot]

Hardens the docker agent serve api command and the URL-based agent loading
path. This addresses three of the issues surfaced by a security review of
serve api (warn-on-public-bind, runtime race, SSRF/HTTPS); the rest of the
review (auth/authz, CSRF, rate limiting, etc.) remains open.

Commits

	Commit	Summary
1	49e91c8fd warn when serve api binds to a non-loopback address	The default --listen is already 127.0.0.1:8080. When the operator is explicit about exposing the API (e.g. --listen 0.0.0.0:...), print a WARNING: block and slog.Warn so the lack of authentication is not silent.
2	de2e8671e fix race in SessionManager.runtimeForSession	runtimeForSession used to do its own Load+Store on sm.runtimeSessions, then RunSession did a second Store with a cancel func. Between the two stores, the map briefly held a half-initialised activeRuntimes (no cancel) observable by Steer/FollowUp (which do not hold sm.mux). runtimeForSession is now a pure constructor; the caller is the single source of truth for the map mutation.
3	69412c042 reject non-public addresses and require https for url agent sources	Two layered defences in urlSource.Read: pre-flight validateAgentURL rejects non-https schemes, and an ssrfDialControl hook on net.Dialer rejects any dial whose resolved IP is loopback / RFC1918 / link-local / multicast / unspecified. Running at dial time also defeats DNS rebinding. Closes the SSRF vector against AWS/GCP/Azure metadata (169.254.169.254) and internal services.
4	53aff9a9f block https-to-http redirects when fetching url agent sources	ssrfSafeHTTPClient was missing CheckRedirect. An https origin under attacker control could 302 to http://... and silently downgrade. Adds a named ssrfCheckRedirect (testable) that rejects non-https redirect targets and bounds the chain at 10 hops.
5	9ceae882e move newURLSourceForTest into the _test.go file	The test-only constructor that disables the SSRF/HTTPS checks no longer ships in release binaries.
6	e36e54ba1 fix lint issues in url agent source	gocritic/paramTypeCombine, gocritic/importShadow (local url shadowed net/url), and gci/gofmt comment alignment.

Tests

New tests added:

• TestURLSource_Read_RejectsHTTP — http:// URLs rejected.
• TestURLSource_Read_RejectsLocalAddresses — loopback (v4 + v6), RFC1918, 169.254.169.254, 0.0.0.0 all rejected at dial time.
• TestIsPublicIP — table-driven classifier coverage.
• TestSSRFCheckRedirect — http/file/javascript/ftp redirect targets rejected; 10-hop limit enforced.
• TestURLSource_Read_RejectsHTTPRedirect — end-to-end: httptest.NewTLSServer 302→http:// is refused.

Existing httptest-based tests migrated to the test-only newURLSourceForTest constructor.

Validation

• mise lint — clean (golangci-lint, custom ./lint, go mod tidy).
• mise test — green (go test ./...).
• go test -race ./pkg/config/... ./pkg/server/... ./cmd/root/... — green.
• Smoke-tested serve api manually:
  • --listen 127.0.0.1:8080 (default) — no warning.
  • --listen 0.0.0.0:18080 — explicit, prints the WARNING block and serves.

Out of scope

The original review identified ~15 issues. This PR addresses 3 of them (#11 non-loopback binding, #13 race, #3 SSRF). Still open and worth follow-up PRs:

• No authentication / authorization (critical)
• Arbitrary working directory (critical)
• Arbitrary agent code execution / sandboxing (critical)
• No CSRF / CORS protection
• No rate limiting / body-size limits
• No TLS support
• Sensitive data in logs (header propagation)
• Missing security headers
• Audit logging

[docker-agent]

Assessment: 🔴 CRITICAL

This PR makes meaningful progress on the SSRF hardening work. However, two gaps in the new security code were found:

**1. [HIGH] Proxy bypass in ** — routes requests through any configured proxy, which bypasses the hook (dial control only fires for this process's direct TCP connections, not for connections the proxy makes on behalf of this process). If is set to a legitimate corp proxy, an attacker-controlled URL can reach through that proxy.

**2. [MEDIUM] CGNAT range not blocked in ** — Go's covers RFC 1918 + RFC 4193 but not RFC 6598 (100.64.0.0/10 Shared Address Space). In cloud/ISP environments, CGNAT addresses can reach internal-only services.

Everything else looks well-implemented: the DNS-rebinding protection is correct, properly blocks https→http downgrade, the session manager race fix is sound, and the non-loopback warning is straightforward.

[docker-agent]

[HIGH] SSRF bypass: http.ProxyFromEnvironment defeats dial-level protection

ssrfSafeHTTPClient sets Proxy: http.ProxyFromEnvironment, which means if HTTP_PROXY or HTTPS_PROXY is configured in the environment, all requests are routed through that proxy. The ssrfDialControl hook only fires for TCP dials made by this process — once a legitimate external proxy is connected, the proxy makes its own outbound connection to the target, entirely bypassing the dial-control SSRF protection.

Attack scenario: an operator's environment has HTTPS_PROXY=https://corp-proxy.example.com; an attacker-controlled agent YAML specifies url: https://169.254.169.254/latest/meta-data/.... The dial to corp-proxy.example.com passes (public IP), and the proxy faithfully fetches the metadata endpoint.

Fix: disable proxy support for this SSRF-sensitive client by setting Proxy: nil (or simply omitting Proxy — the zero value for the field disables proxying):

Transport: &http.Transport{
    // Proxy: nil  ← no proxy; ssrfDialControl only works for direct dials
    DialContext: dialer.DialContext,
    ...
}

[docker-agent]

[MEDIUM] isPublicIP does not block 100.64.0.0/10 (RFC 6598 Shared Address Space / CGNAT)

Go's net.IP.IsPrivate() (Go 1.17+) covers only RFC 1918 (10/8, 172.16/12, 192.168/16) and RFC 4193 (fc00::/7). It does not include the RFC 6598 Carrier-Grade NAT range 100.64.0.0/10. In cloud and ISP environments, addresses in this range are often used for internal-only services (e.g., hypervisor APIs, internal load-balancer health endpoints) that are unreachable from the public internet but reachable from within the hosting environment.

An agent URL pointing to 100.64.x.x would pass isPublicIP, allowing the SSRF protection to be bypassed in those environments.

Fix: add an explicit check for the CGNAT range:

var cgnatRange = func() *net.IPNet {
    _, n, _ := net.ParseCIDR("100.64.0.0/10")
    return n
}()

func isPublicIP(ip net.IP) bool {
    return !ip.IsLoopback() &&
        !ip.IsPrivate() &&
        !cgnatRange.Contains(ip) &&  // RFC 6598
        !ip.IsLinkLocalUnicast() &&
        !ip.IsLinkLocalMulticast() &&
        !ip.IsMulticast() &&
        !ip.IsUnspecified()
}