Fail safely when the configured TLS bind path is missing #3
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
M0 inspection found that Compose renders successfully when
FOUNDRY_TLS_DIRnames a nonexistent path (including a relative path), although the documented prerequisite is an existing absolute TLS directory. Docker Compose bind mounts default to creating missing host directories, potentially leaving confusing host state before SR fails to load certificates.Reproduce with isolated placeholder values using
docker compose --env-file /dev/null -p foundry-m0-inspection -f compose.yaml configand a nonexistent relativeFOUNDRY_TLS_DIR. Implement the smallest safe Foundry-owned validation or bind configuration so a missing TLS source is not silently created, with reproducible tests. Do not claim that configuration rendering validates certificate trust, authenticated startup or M1 integration.Actual Docker Desktop/WSL2 finding: adding Compose
bind.create_host_path: falsealone did not prevent host-path creation in an isolated one-off test. WithFOUNDRY_ROUTER_IMAGE=alpine:latest, hostrouter.example.com, a unique initially nonexistent/tmp/kilo/...TLS directory, anddocker compose --env-file /dev/null -p <unique-project> -f compose.yaml run --no-deps --rm -T --entrypoint /bin/true router, the container returned 0 and the missing host directory existed afterward. Test project network/volume and the empty test directory were removed. The proposed Compose-only change was discarded; do not assume its documented semantics work on this target host.An exact SR source image built from
209f7d39f3ecebbd1b98b11d7c44c63192fe50a4rejected a non-loopback bind without TLS and the Foundry service with an empty TLS directory exited 2 with certificate/key/trust verification failure; no listener or authenticated access was established. Image build resolved a mutable base and dependencies, so it is not a fully pinned release build. A safe preflight must account for Compose's interpolation semantics and avoid exposing environment secrets, then be tested on the actual host; do not report the failed guard as a fix.Resolved for Foundry's supported
make upstartup path by merged PR #4, merge commitc8fd679e02e870e0545a082edd10c864d6a1d4ba; reviewed head780b71330a9540aadf0e72f80dffd7da18438837. Nine isolated tests passed on Docker Desktop 4.97.0 / Compose v5.6.1 / WSL2, including no created project resources on rejected starts. Directdocker compose upbypasses the Makefile preflight and remains capable of creating a missing source; the previously testedcreate_host_path: falsedid not prevent that on this host. Host file checks do not establish TLS trust, container read access or authenticated startup. The independent GLM-5.3 review is a COMMENT, not human approval.