202 lines
10 KiB
HTML
202 lines
10 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
|
|
<title>Security · PearDock Docs</title>
|
|
<meta name="description" content="PearDock threat model, trust boundaries, controls, residual risks, hardening checklist." />
|
|
<meta name="keywords" content="PearDock security, threat model, ACL, hardening" />
|
|
<meta name="author" content="HoneyPeer, LLC" />
|
|
<meta name="robots" content="index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1" />
|
|
<meta name="googlebot" content="index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1" />
|
|
<meta name="theme-color" content="#2dd4bf" />
|
|
<meta name="color-scheme" content="dark light" />
|
|
<meta name="application-name" content="PearDock" />
|
|
<meta name="apple-mobile-web-app-title" content="PearDock" />
|
|
<meta name="apple-mobile-web-app-capable" content="yes" />
|
|
<meta name="mobile-web-app-capable" content="yes" />
|
|
<meta name="msapplication-TileColor" content="#2dd4bf" />
|
|
<meta name="msapplication-config" content="/assets/favicons/browserconfig.xml" />
|
|
<meta name="format-detection" content="telephone=no" />
|
|
<link rel="canonical" href="https://peardock.boats/docs/security" />
|
|
<link rel="alternate" hreflang="en" href="https://peardock.boats/docs/security" />
|
|
<link rel="alternate" hreflang="x-default" href="https://peardock.boats/docs/security" />
|
|
|
|
<!-- Open Graph -->
|
|
<meta property="og:type" content="article" />
|
|
<meta property="og:site_name" content="PearDock" />
|
|
<meta property="og:locale" content="en_US" />
|
|
<meta property="og:url" content="https://peardock.boats/docs/security" />
|
|
<meta property="og:title" content="Security · PearDock Docs" />
|
|
<meta property="og:description" content="PearDock threat model, trust boundaries, controls, residual risks, hardening checklist." />
|
|
<meta property="og:image" content="https://peardock.boats/assets/brand/og-image.png" />
|
|
<meta property="og:image:secure_url" content="https://peardock.boats/assets/brand/og-image.png" />
|
|
<meta property="og:image:type" content="image/png" />
|
|
<meta property="og:image:width" content="1200" />
|
|
<meta property="og:image:height" content="630" />
|
|
<meta property="og:image:alt" content="PearDock: decentralized Docker management on HyperDHT" />
|
|
|
|
<!-- Twitter / X -->
|
|
<meta name="twitter:card" content="summary_large_image" />
|
|
<meta name="twitter:title" content="Security · PearDock Docs" />
|
|
<meta name="twitter:description" content="PearDock threat model, trust boundaries, controls, residual risks, hardening checklist." />
|
|
<meta name="twitter:image" content="https://peardock.boats/assets/brand/twitter-card.png" />
|
|
<meta name="twitter:image:alt" content="PearDock: decentralized Docker management" />
|
|
|
|
<!-- Icons & PWA -->
|
|
<link rel="icon" href="/assets/favicons/favicon.ico" sizes="any" />
|
|
<link rel="icon" type="image/png" sizes="32x32" href="/assets/favicons/favicon-32x32.png" />
|
|
<link rel="icon" type="image/png" sizes="16x16" href="/assets/favicons/favicon-16x16.png" />
|
|
<link rel="icon" type="image/png" sizes="48x48" href="/assets/favicons/favicon-48x48.png" />
|
|
<link rel="apple-touch-icon" sizes="180x180" href="/assets/favicons/apple-touch-icon.png" />
|
|
<link rel="manifest" href="/assets/favicons/site.webmanifest" />
|
|
<link rel="mask-icon" href="/assets/logo/peardock-wordmark.svg" color="#2dd4bf" />
|
|
|
|
<!-- Article -->
|
|
<meta property="article:section" content="Documentation" />
|
|
<meta property="article:author" content="HoneyPeer, LLC" />
|
|
<meta property="article:publisher" content="HoneyPeer, LLC" />
|
|
|
|
<script type="application/ld+json">
|
|
{
|
|
"@context": "https://schema.org",
|
|
"@type": [
|
|
"WebPage",
|
|
"TechArticle"
|
|
],
|
|
"name": "Security \u00b7 PearDock Docs",
|
|
"description": "PearDock threat model, trust boundaries, controls, residual risks, hardening checklist.",
|
|
"url": "https://peardock.boats/docs/security",
|
|
"isPartOf": {
|
|
"@type": "WebSite",
|
|
"name": "PearDock",
|
|
"url": "https://peardock.boats"
|
|
},
|
|
"publisher": {
|
|
"@type": "Organization",
|
|
"name": "HoneyPeer, LLC",
|
|
"url": "https://peardock.boats"
|
|
},
|
|
"inLanguage": "en-US",
|
|
"primaryImageOfPage": {
|
|
"@type": "ImageObject",
|
|
"url": "https://peardock.boats/assets/brand/og-image.png",
|
|
"width": 1200,
|
|
"height": 630
|
|
},
|
|
"headline": "Security \u00b7 PearDock Docs"
|
|
}
|
|
</script>
|
|
|
|
<link rel="preconnect" href="https://fonts.googleapis.com" />
|
|
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
|
|
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet" />
|
|
<link rel="stylesheet" href="/src/styles/global.css" />
|
|
<link rel="stylesheet" href="/src/styles/docs.css" />
|
|
</head>
|
|
<body>
|
|
<div class="bg-mesh" aria-hidden="true"></div>
|
|
<div data-nav data-prefix="../"></div>
|
|
|
|
<div class="docs-layout">
|
|
<aside class="docs-sidebar" data-docs-nav data-prefix="../"></aside>
|
|
<button type="button" class="docs-sidebar-toggle" aria-label="Docs menu">☰</button>
|
|
|
|
<article class="docs-main">
|
|
<h1>Security & threat model</h1>
|
|
<p class="docs-lead">
|
|
Audience: operators deploying PearDock in multi-operator or semi-trusted environments.
|
|
Scope: HyperDHT P2P control plane + local Docker Engine socket.
|
|
</p>
|
|
|
|
<h2>1. Assets</h2>
|
|
<div class="table-wrap">
|
|
<table>
|
|
<thead>
|
|
<tr><th>Asset</th><th>Sensitivity</th></tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr><td><code>SERVER_SEED</code></td><td>Critical: identity and vault key derivation</td></tr>
|
|
<tr><td>Docker socket access</td><td>Critical: full host container control</td></tr>
|
|
<tr><td>Registry passwords (vault)</td><td>High: encrypted at rest</td></tr>
|
|
<tr><td>Peer invite tokens</td><td>Medium: short-lived capabilities</td></tr>
|
|
<tr><td>Audit log</td><td>Medium: forensic integrity</td></tr>
|
|
<tr><td>Container data / env secrets</td><td>High: via inspect, logs, exec</td></tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
<h2>2. Trust boundaries</h2>
|
|
<pre><code>[Client] --Noise/HyperDHT--> [peardock server] --unix socket--> [dockerd]
|
|
|
|
|
+-- peardock-vault.json (AES-GCM)
|
|
+-- peardock-peers.json
|
|
+-- peardock-audit.log</code></pre>
|
|
<ul>
|
|
<li><strong>Anyone with the server public key</strong> can attempt a DHT connection.</li>
|
|
<li><strong>Default role is admin</strong> unless default role / admin keys / peer policy tighten it.</li>
|
|
<li>Swarm / plugins are off unless feature flags enable them.</li>
|
|
<li>Holesail tunnels are on by default. Each <code>hs://</code> URL is a port capability.</li>
|
|
<li>Host FS browse is default-deny unless browse roots / open mode are set.</li>
|
|
</ul>
|
|
|
|
<h2>3. Adversaries</h2>
|
|
<ol>
|
|
<li><strong>Remote peer with public key only:</strong> should not get Docker control if allowlist and non-admin default are set.</li>
|
|
<li><strong>Stolen invite token:</strong> limited by TTL and max uses. Rotate after use.</li>
|
|
<li><strong>Compromised client:</strong> can use any role the peer holds until revoke.</li>
|
|
<li><strong>Local host attacker with filesystem:</strong> can steal seed and vault if file perms are wrong.</li>
|
|
<li><strong>Malicious container:</strong> out of scope for PearDock. Engine isolation applies.</li>
|
|
</ol>
|
|
|
|
<h2>4. Controls (implemented)</h2>
|
|
<div class="table-wrap">
|
|
<table>
|
|
<thead>
|
|
<tr><th>Control</th><th>Mechanism</th></tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr><td>Transport E2E</td><td>HyperDHT Noise</td></tr>
|
|
<tr><td>Capability ACL</td><td>viewer / operator / admin + MethodRoles</td></tr>
|
|
<tr><td>Peer policy</td><td>Invite, register, revoke, optional allowlist</td></tr>
|
|
<tr><td>Audit</td><td>Append-only log for privileged methods</td></tr>
|
|
<tr><td>Rate limit</td><td>Per-peer limiter on RPC</td></tr>
|
|
<tr><td>Registry secrets</td><td>AES-256-GCM vault</td></tr>
|
|
<tr><td>Browse FS</td><td>Root allowlist / default deny</td></tr>
|
|
<tr><td>Tunnel targets</td><td>Loopback / allowlisted hosts only</td></tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
<h2>5. Residual risks</h2>
|
|
<ul>
|
|
<li><strong>Default admin</strong> is intentional for single-operator setup. Change it for multi-tenant fleets.</li>
|
|
<li>Binary image/export streams are size-capped but still large; DoS via memory if many concurrent transfers.</li>
|
|
<li>JSON-over-RPC relies on handler validation (not full hyperschema end-to-end).</li>
|
|
<li>Swarm secrets/configs once enabled are highly privileged.</li>
|
|
</ul>
|
|
|
|
<h2>6. Operator hardening checklist</h2>
|
|
<ul>
|
|
<li>Generate unique <code>SERVER_SEED</code>; back up offline; never commit <code>.env</code></li>
|
|
<li>Set <code>PEARDOCK_DEFAULT_ROLE=viewer</code> or <code>operator</code></li>
|
|
<li>Set <code>PEARDOCK_ADMIN_KEYS=<your client public key hex></code></li>
|
|
<li>Enable <code>PEARDOCK_PEER_ALLOWLIST=1</code> after registering operators</li>
|
|
<li>Set <code>PEARDOCK_BROWSE_ROOTS</code> only if host path pickers are needed</li>
|
|
<li>Enable <code>PEARDOCK_AUDIT=1</code></li>
|
|
<li>Treat <code>hs://</code> tunnel URLs as secrets; set <code>ENABLE_HOLESAIL=0</code> if unused</li>
|
|
<li>Restrict filesystem permissions on vault, peers, and seed files</li>
|
|
</ul>
|
|
|
|
<div class="docs-pager">
|
|
<a href="/docs/holesail"><span>Previous</span><strong>← Holesail</strong></a>
|
|
<a class="next" href="/docs/api"><span>Next</span><strong>RPC & API →</strong></a>
|
|
</div>
|
|
</article>
|
|
</div>
|
|
|
|
<div data-footer data-prefix="../"></div>
|
|
<script type="module" src="/src/js/site.js"></script>
|
|
</body>
|
|
</html>
|