HeiKyu/Rendezvous
2
0
Fork 0
Code Issues 27 Pull Requests Actions Packages Projects Releases Wiki Activity

Containerize and document secure Linux deployment #17

New Issue
Open
opened 2026-07-15 10:04:27 +02:00 by Kyuubi · 2 comments
Kyuubi commented 2026-07-15 10:04:27 +02:00
Owner
Copy Link
Copy Source

Parent: #1
Depends on: #16

Outcome

Ship a reproducible single-active Linux deployment that exposes HTTP and UDP correctly and fails closed when misconfigured.

Scope

  • Add a multi-stage, pinned, non-root container with a minimal/read-only runtime surface and explicit HTTP/UDP ports.
  • Add local Compose and optional systemd deployment examples.
  • Document DNS, TLS termination, trusted proxies, source-IP-preserving UDP ingress, firewall rules, secret injection, resource limits, and clock requirements.
  • Validate configuration at startup; production mode rejects missing keys, unsafe defaults, or ambiguous public endpoints.
  • Implement graceful drain: reject new registrations/joins, finish or time out bounded attempts, stop listeners, and exit.
  • Document restart/re-registration, rollback, backup of only durable configuration/key material, and upgrade procedure.
  • Provide HTTP+UDP smoke checks.

Acceptance criteria

  • A clean checkout builds and runs the pinned image.
  • Container runs non-root with no required writable application directory.
  • Real smoke tests reach both HTTP and UDP through the documented topology.
  • Required production secrets/configuration fail closed with actionable errors.
  • Graceful SIGTERM drains within a configured deadline and leaves no hanging process/socket.
  • Proxy/load-balancer documentation warns when source/reply address preservation cannot be guaranteed.
  • No ephemeral listing/endpoint state is misrepresented as durable.
Parent: #1 Depends on: #16 ## Outcome Ship a reproducible single-active Linux deployment that exposes HTTP and UDP correctly and fails closed when misconfigured. ## Scope - Add a multi-stage, pinned, non-root container with a minimal/read-only runtime surface and explicit HTTP/UDP ports. - Add local Compose and optional systemd deployment examples. - Document DNS, TLS termination, trusted proxies, source-IP-preserving UDP ingress, firewall rules, secret injection, resource limits, and clock requirements. - Validate configuration at startup; production mode rejects missing keys, unsafe defaults, or ambiguous public endpoints. - Implement graceful drain: reject new registrations/joins, finish or time out bounded attempts, stop listeners, and exit. - Document restart/re-registration, rollback, backup of only durable configuration/key material, and upgrade procedure. - Provide HTTP+UDP smoke checks. ## Acceptance criteria - A clean checkout builds and runs the pinned image. - Container runs non-root with no required writable application directory. - Real smoke tests reach both HTTP and UDP through the documented topology. - Required production secrets/configuration fail closed with actionable errors. - Graceful SIGTERM drains within a configured deadline and leaves no hanging process/socket. - Proxy/load-balancer documentation warns when source/reply address preservation cannot be guaranteed. - No ephemeral listing/endpoint state is misrepresented as durable.
Kyuubi commented 2026-07-16 13:23:35 +02:00
Author
Owner
Copy Link
Copy Source

Starting #17 on codex/issue-17-secure-linux-deployment, stacked on verified #16 commit be732de. I’ll deliver the pinned non-root/read-only container, fail-closed production configuration, graceful SIGTERM drain, Compose/systemd examples, source-preserving HTTP+UDP deployment guidance, and real HTTP+UDP smoke gates before committing and pushing.

Starting #17 on `codex/issue-17-secure-linux-deployment`, stacked on verified #16 commit `be732de`. I’ll deliver the pinned non-root/read-only container, fail-closed production configuration, graceful SIGTERM drain, Compose/systemd examples, source-preserving HTTP+UDP deployment guidance, and real HTTP+UDP smoke gates before committing and pushing.
Kyuubi added reference codex/issue-17-secure-linux-deployment 2026-07-16 13:23:35 +02:00
Kyuubi self-assigned this 2026-07-16 13:23:36 +02:00
Kyuubi commented 2026-07-16 15:03:32 +02:00
Author
Owner
Copy Link
Copy Source

Implemented and pushed on codex/issue-17-secure-linux-deployment in commit 08729ae.

Delivered:

  • digest-pinned multi-stage .NET 10 chiseled image, UID/GID 1654, explicit TCP 8080 + UDP 9050
  • read-only/non-root Compose and hardened systemd deployment shapes
  • external file-backed signing secrets with bounded reads and symlink rejection
  • fail-closed Production validation for topology, trusted proxy, AllowedHosts, single-active state, ports, deadlines, and globally routable advertised endpoints
  • bounded graceful drain that rejects new work, preserves listeners for existing attempts, expires due attempts without full-state sweeps, then clears ephemeral state
  • parameterized authenticated HTTP+UDP deployment smoke, complete Linux operations/recovery/upgrade/rollback guidance, and a required real-container CI gate

Verification:

  • adversarial multi-lens branch audit: no remaining findings after fixes and re-review
  • Debug: 282/282 tests passed
  • Release: 282/282 tests passed
  • Release build and formatting verification passed
  • Docker image rebuilt cleanly with pinned frontend/base digests
  • live Compose smoke passed authenticated HTTP + UDP mediation/direct traffic as 1654:1654 with read-only root and read-only config/key mounts
  • SIGTERM drain completed in ~2 seconds; container exited 0 with PID 0 and released TCP 8080 + UDP 9050
  • Compose config, shell syntax, systemd unit, generated API drift, and diff hygiene checks passed

The issue remains open while the dependency-ordered roadmap branch stack continues; it can be reconciled when the stack lands.

Implemented and pushed on `codex/issue-17-secure-linux-deployment` in commit `08729ae`. Delivered: - digest-pinned multi-stage .NET 10 chiseled image, UID/GID 1654, explicit TCP 8080 + UDP 9050 - read-only/non-root Compose and hardened systemd deployment shapes - external file-backed signing secrets with bounded reads and symlink rejection - fail-closed Production validation for topology, trusted proxy, AllowedHosts, single-active state, ports, deadlines, and globally routable advertised endpoints - bounded graceful drain that rejects new work, preserves listeners for existing attempts, expires due attempts without full-state sweeps, then clears ephemeral state - parameterized authenticated HTTP+UDP deployment smoke, complete Linux operations/recovery/upgrade/rollback guidance, and a required real-container CI gate Verification: - adversarial multi-lens branch audit: no remaining findings after fixes and re-review - Debug: 282/282 tests passed - Release: 282/282 tests passed - Release build and formatting verification passed - Docker image rebuilt cleanly with pinned frontend/base digests - live Compose smoke passed authenticated HTTP + UDP mediation/direct traffic as `1654:1654` with read-only root and read-only config/key mounts - SIGTERM drain completed in ~2 seconds; container exited 0 with PID 0 and released TCP 8080 + UDP 9050 - Compose config, shell syntax, systemd unit, generated API drift, and diff hygiene checks passed The issue remains open while the dependency-ordered roadmap branch stack continues; it can be reconciled when the stack lands.
Sign in to join this conversation.
codex/issue-17-secure-linux-deployment
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Kyuubi schmidt.florian (Florian Schmidt)
No Assignees Kyuubi
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: HeiKyu/Rendezvous#17
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?