docs: add a security policy with the container's threat model - #12
Merged
Conversation
Private vulnerability reporting is now enabled on the repo, so the policy points at GitHub's advisory flow rather than an email address. The substance is the scope section. It separates the host boundary — the one that is meant to hold, and where a finding is a real vulnerability — from the boundaries inside the container, which are weaker on purpose. The four deliberate ones are named explicitly so they are not rediscovered as surprises and reported as bugs: ai-jail's restrictions are advisory within the container (a `--rw-map /config/.docker` grant reaches the whole container's filesystem through the nested daemon), code-server runs with an empty PASSWORD, SYS_ADMIN plus the unconfined seccomp/systempaths exist so bwrap can create user namespaces, and nested containers get no cgroup limits of their own. Each points back at docs/OVERVIEW.md, which stays the authoritative account. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
SECURITY.md. Private vulnerability reporting is now enabled on the repo, so the policy points at GitHub's advisory flow rather than an email address.The substance is the scope section. It separates the host boundary — the one that is meant to hold, and where a finding is a real vulnerability — from the boundaries inside the container, which are weaker on purpose.
In scope: escaping to the host, the nested rootless daemon reaching the host's daemon, code-server's port escaping loopback, credentials baked into the image, and supply-chain problems in the stack fragments.
Out of scope, named explicitly so they are not rediscovered as surprises and reported as bugs:
ai-jail's restrictions are advisory within the container — a--rw-map /config/.dockergrant reaches the whole container's filesystem through the nested daemon.PASSWORD=, so any local user reaching the published loopback port gets a shell.--cap-add=SYS_ADMINplus the unconfined seccomp/systempaths exist sobwrapcan create user namespaces.Each points back at
docs/OVERVIEW.md, which stays the authoritative account — this file summarises its conclusions, it does not restate them.Docs-only, so release-please will not propose a release from it.
🤖 Generated with Claude Code