GovOPlaN/govoplan
1
0
Fork 0
Code Issues 10 Pull Requests Actions 3 Packages Projects Releases Wiki Activity

fix(audit): bridge Docker from Flatpak sandboxes

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-22 04:48:10 +02:00
parent 8906704dc0
commit d53db2da06
2 changed files with 40 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
docs/SECURITY_AUDIT.md
View File

@@ -33,6 +33,14 @@ cd /mnt/DATA/git/govoplan
tools/checks/security-audit/run.sh --mode full --scope govoplan
```
When invoked from a Flatpak development environment without a sandbox-local
Docker CLI, the wrapper automatically uses `flatpak-spawn --host docker`. The
host account must still be allowed to open the Docker daemon socket. For a
conventional rootful installation this commonly means membership in the
`docker` group followed by a complete logout/login; that membership is
root-equivalent, so rootless Docker is preferable where the deployment policy
requires a smaller privilege boundary.
Reports are written to `audit-reports/`, which is intentionally ignored by git.
Each run records tool versions, report checksums, and start/end repository
revision plus worktree fingerprints. A repository change during scanning makes