gortium/infra
1
1
Fork 0
Code Issues 13 Pull Requests 24 Actions Packages Projects 1 Releases Wiki Activity

fix: restrict docker commands for ai-worker (wrapper blacklist — exec, cp, commit, etc. blocked) #65

Open
Hermes wants to merge 1 commits from feat/restrict-docker-blacklist into master
pull from: feat/restrict-docker-blacklist
merge into: gortium:master
Conversation 0 Commits 1 Files Changed 3 +201 -84
Hermes commented 2026-05-21 00:42:46 +00:00
Collaborator
Copy Link

Security Fix: Block dangerous docker commands for ai-worker

Problem

The ai-worker user is in the docker group, giving unrestricted access to ALL Docker commands. An agent was able to generate a Gitea admin token via docker exec -u git gitea gitea admin user generate-access-token -u gortium.

This PR

Keeps ai-worker in the docker group (so docker ps, docker compose, docker build, docker run, etc. still work), but wraps the docker binary with a script that blocks dangerous subcommands.

BLOCKED commands

exec, cp, commit, diff, export, import, load, save, attach, push, tag

ALLOWED commands

ps, images, inspect, logs, start, stop, restart, rm, rmi, pull, build, run, compose, system, network ls, volume ls

How it works

A wrapper script intercepts docker calls, parses the subcommand, and rejects blocked ones. The wrapper is installed both as a system package and in ai-worker's personal profile so it takes precedence over the real Docker binary.

Fixes

Closes the security incident where the agent created a Gitea admin token via docker exec.

## Security Fix: Block dangerous docker commands for ai-worker ### Problem The `ai-worker` user is in the `docker` group, giving unrestricted access to ALL Docker commands. An agent was able to generate a Gitea admin token via `docker exec -u git gitea gitea admin user generate-access-token -u gortium`. ### This PR Keeps ai-worker in the `docker` group (so `docker ps`, `docker compose`, `docker build`, `docker run`, etc. still work), but wraps the `docker` binary with a script that **blocks dangerous subcommands**. ### BLOCKED commands `exec`, `cp`, `commit`, `diff`, `export`, `import`, `load`, `save`, `attach`, `push`, `tag` ### ALLOWED commands `ps`, `images`, `inspect`, `logs`, `start`, `stop`, `restart`, `rm`, `rmi`, `pull`, `build`, `run`, `compose`, `system`, `network ls`, `volume ls` ### How it works A wrapper script intercepts `docker` calls, parses the subcommand, and rejects blocked ones. The wrapper is installed both as a system package and in ai-worker's personal profile so it takes precedence over the real Docker binary. ### Fixes Closes the security incident where the agent created a Gitea admin token via docker exec.
Hermes added 1 commit 2026-05-21 00:42:47 +00:00
fix: restrict docker commands for ai-worker (wrapper blacklist) 993b9c559c 
SECURITY CHANGE: Keep ai-worker in docker group but block dangerous
docker subcommands via a wrapper script.

Approach:
- docker group membership preserved (ps, start, stop, compose still work)
- Docker binary wrapped with a script that blocks dangerous subcommands
- BLOCKED: exec, cp, commit, diff, export, import, load, save, attach, push, tag
- ALLOWED: ps, images, inspect, logs, start, stop, restart, rm, rmi,
  pull, build, run, compose, system, network ls, volume ls

The wrapper is installed in both system packages and ai-worker's
personal profile to ensure it takes precedence over the real docker.
This is effective for the LLM agent threat model — the agent uses CLI
commands and blocked subcommands simply return an error.

Files modified:
- users/ai-worker.nix — restored docker group, kept sudo audit rules
- modules/nixos/security/ai-worker-restricted.nix — added docker wrapper
  script with blacklist logic and NixOS module integration
- modules/nixos/security/README-ai-worker.md — documentation update
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feat/restrict-docker-blacklist:feat/restrict-docker-blacklist
git checkout feat/restrict-docker-blacklist
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
Kind/Bug
Something is not working
Kind/Documentation
Documentation changes
Kind/Enhancement
Improve existing functionality
Kind/Feature
New functionality
Kind/Security
This is security issue
Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Low
4
The priority is low
Priority
Medium
3
The priority is medium
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Abandoned
3
Somebody has started to work on this but abandoned work
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Hermes gortium
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: gortium/infra#65
No description provided.
Delete Branch "feat/restrict-docker-blacklist"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?