0 Fork 0

mirror of https://github.com/Dvorinka/Containr.git synced 2026-10-28 07:41:27 +00:00

Files

T

Tomas DvorakandDevin 9f3b196032 Overhaul: real metrics, Git integration UI, open-source hygiene, root cleanup

Backend:
- GET /services/:id/metrics with real Docker container stats
- DELETE /git/providers/:id and GET repo branches endpoint

Frontend:
- Service detail shows real telemetry or honest empty states
- Live status distinguishes idle/polling/reconnecting
- Git providers section in Settings; repo+branch pickers in Add Service
- Real logo, compact Projects header, canvas fitView fix
- index.css deduplicated (1725 -> 1384 lines)
- Fixed smoke tests, lint errors, ToastProvider/context unification

Repo hygiene:
- Added LICENSE (MIT), CONTRIBUTING.md, SECURITY.md; rewrote README
- Untracked .env.prod and data/letsencrypt secrets; fixed .gitignore
- Removed legacy root src/internal/cmd and stale configs/docs/artifacts
- Moved guides and design references under docs/

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-09-15 18:59:40 +02:00

1.5 KiB

Raw Permalink Blame History

Security Policy

Reporting a Vulnerability

Please do not open a public issue for security vulnerabilities.

Report privately via GitHub's private vulnerability reporting (Security tab → Report a vulnerability), or contact the maintainer directly.

Include:

A description of the vulnerability and its impact
Steps to reproduce
Affected version/commit if known

You will receive an acknowledgement as soon as possible. Please allow reasonable time for a fix before any public disclosure.

Scope

Containr is a self-hosted platform that runs Docker containers, stores credentials, and terminates user traffic. In scope:

Authentication and session handling (Better Auth sidecar, JWT, agent tokens)
Secrets storage (Git provider tokens, environment variables)
API authorization and per-user resource scoping
Webhook signature validation
CORS and trusted-origin configuration
Deployment engine command/path handling

Secrets

Never commit .env, .env.prod, or any file containing credentials.
Git provider access tokens are stored server-side only and are never returned by the API.
Rotate any secret that has ever been committed to git history.

Self-Hosting Notes

Set strong JWT_SECRET, BETTER_AUTH_SECRET, and BETTER_AUTH_INTERNAL_TOKEN values in production.
Set COOKIE_SECURE=true when serving over HTTPS.
Restrict CORS_ALLOWED_ORIGINS to your actual frontend origin.
Keep Traefik's dashboard disabled or behind auth in production (TRAEFIK_API_INSECURE=false).