Report suspected vulnerabilities in this repository's components privately to
security@decionis.ai. Please do not open public issues for security reports.
Do not include production API keys, customer payloads, private policy documents, or unredacted dossier contents in reports or public issues.
This repository is the Docker integration surface for Decionis: the
containerized MCP evaluator image, the Docker Desktop extension, and the Go
daemon, CLI, authority proxy, and Dev Container helper as they land. Reports
about the Decionis hosted control plane or the @decionis/mcp package itself
are welcome at the same address; they are triaged together with the upstream
decionis/decionis repository.
The operational rules this repository is built and released under live in
rules/security.rules.md.
The load-bearing ones:
- No component here mints authority. Policy evaluation happens only in the
containerized
@decionis/mcpevaluator or the hosted control plane. - Fail closed: an unreachable evaluator, timeout, or unverifiable response is treated as a blocking outcome. A timeout is never an approval.
- Verification-only cryptography: dossiers and Presence proofs are verified against published JWKS; signing material never exists in this repository.
- Images: digest-pinned bases, non-root, multi-stage builds, SBOM and provenance attestations on release, and a vulnerability-scan gate.
- Secrets: the local evaluator requires none by design; connected-mode org API keys live only in the daemon/backend — never in images, the extension UI, logs, or this repository.
- Account passwords: the Advanced connect path forwards an account email and password to the control plane for exactly one request, to be exchanged for a scoped key. The password is never written to the store, never logged, never returned to the UI, and is cleared from component state as soon as the request completes. The extension reads no Docker credential store and no Docker Hub secret — Docker Desktop exposes no identity to extensions, and the workspace is named by the control plane instead.
Per rules/security.rules.md Rule 4.1, every privilege the extension
requests is enumerated and justified here, and this list is re-reviewed on
any change to extension/metadata.json or extension/compose.yaml.
| Privilege | Requested | Justification |
|---|---|---|
Backend VM service (vm.composefile) |
Yes | The Go daemon (decionis-daemon) holds the org API key, calls the published hosted API, and verifies dossiers. Credentials must live in the backend, never the UI (Rules 2.2–2.3). |
Extension socket (vm.exposes.socket) |
Yes | The only channel between the UI and the daemon. Every request over it is schema-validated with a 100 KB bound (Rule 4.4). |
Private named volume (decionis-data:/data) |
Yes | Connection settings and the org API key at rest, 0600 inside the backend's private volume (Rule 2.5). No host paths are mounted. |
| Root user inside the extension VM container | Yes (today) | Required to bind /run/guest-services/backend.sock. Revisit for a non-root bind once verified against current Docker Desktop. |
Published host port 127.0.0.1:53719 |
Yes | The one-click connect redirect (RFC 8252): the browser's enrollment redirect lands on the host's loopback and reaches the daemon's listener, which serves only /enroll — state-bound (constant-time compare), single-use, 10-minute expiry. The token it carries is consumed by the exchange immediately, so the copy left in browser history is dead. Bound to the host's loopback interface only. |
| Docker Engine socket | No | The extension does not mount or use the Engine socket (Rule 4.2). |
| Host binaries | No | None are shipped. |
| Host filesystem mounts | No | None. |
| Outbound network | Daemon only | HTTPS to the connected org's Decionis control plane and the dossier JWKS URL; certificate verification always on (Rule 2.6). Plus one anonymous, credential-free GET of the extension's own public Docker Hub tags listing for the update banner (cached 6 h; carries no identifiers; fail-open — an unreachable listing claims nothing). |