@docker-doctor/cli 0.5.2 → 0.5.3

package/dist/cli.cjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const require_src = require('./src-D3jzc3GX.cjs');
+const require_src = require('./src-D4rVJg36.cjs');
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_src.__toESM(node_fs_promises, 1);
 let node_path = require("node:path");

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as runDockerfileRules, c as createComposeLocator, d as discoverProject, f as version, i as runComposeRules, l as parseCompose, n as calculateScore, o as allRules, r as loadConfig, s as findRule, t as toJsonReport, u as parseDockerfile } from "./src-BOGzkp17.mjs";
+import { a as runDockerfileRules, c as createComposeLocator, d as discoverProject, f as version, i as runComposeRules, l as parseCompose, n as calculateScore, o as allRules, r as loadConfig, s as findRule, t as toJsonReport, u as parseDockerfile } from "./src-CklEIXTX.mjs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import os from "node:os";

package/dist/index.cjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_src = require('./src-D3jzc3GX.cjs');
+const require_src = require('./src-D4rVJg36.cjs');
 
 //#region ../core/src/config/define-config.ts
 const defineConfig = (config) => config;

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as runDockerfileRules, d as discoverProject, f as version$1, i as runComposeRules, l as parseCompose, n as calculateScore, o as allRules, r as loadConfig, s as findRule, t as toJsonReport, u as parseDockerfile } from "./src-BOGzkp17.mjs";
+import { a as runDockerfileRules, d as discoverProject, f as version$1, i as runComposeRules, l as parseCompose, n as calculateScore, o as allRules, r as loadConfig, s as findRule, t as toJsonReport, u as parseDockerfile } from "./src-CklEIXTX.mjs";
 
 //#region ../core/src/config/define-config.ts
 const defineConfig = (config) => config;

package/dist/{src-BOGzkp17.mjs → src-CklEIXTX.mjs}

@@ -4,7 +4,7 @@ import path from "node:path";
 import { LineCounter, isAlias, isMap, isScalar, isSeq, parse, parseDocument } from "yaml";
 
 //#region package.json
-var version = "0.5.2";
+var version = "0.5.3";
 
 //#endregion
 //#region ../core/src/project-info/ignore.ts
@@ -833,6 +833,125 @@ const pinModelVersion = {
 };
 const composeModelRules = [undefinedModelReference, pinModelVersion];
 
+//#endregion
+//#region ../core/src/rules/compose-mounts.ts
+/**
+* Shared parsing for Compose `volumes:` entries, used by every rule that
+* reasons about bind mounts. A Compose volume entry is either the short
+* `[SOURCE:]TARGET[:MODE]` string or the long-syntax object; both collapse
+* to a `VolumeMount`.
+*/
+const INTERPOLATION_WITH_DEFAULT = /\$\{[^}:?-]+:?-(?<fallback>[^}]*)\}/gu;
+const INTERPOLATION_WITHOUT_DEFAULT = /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*/gu;
+const HOME_INTERPOLATION = /\$\{HOME\}|\$HOME(?![A-Za-z0-9_])/gu;
+const resolveInterpolationDefaults = (value) => value.replace(HOME_INTERPOLATION, "~").replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
+const PATH_SHAPED = /^(?:[/.~]|[A-Za-z]:)/u;
+const splitShortSyntax = (spec) => {
+	const parts = [];
+	let depth = 0;
+	let current = "";
+	for (const char of spec) {
+		if (char === "{") depth += 1;
+		else if (char === "}") depth = Math.max(0, depth - 1);
+		if (char === ":" && depth === 0) {
+			parts.push(current);
+			current = "";
+			continue;
+		}
+		current += char;
+	}
+	parts.push(current);
+	return parts;
+};
+const DRIVE_LETTER = /^[A-Za-z]$/u;
+const joinDriveLetter = (parts) => {
+	const [first, second, ...rest] = parts;
+	if (first !== void 0 && second !== void 0 && DRIVE_LETTER.test(first) && /^[\\/]/u.test(second)) return [`${first}:${second}`, ...rest];
+	return parts;
+};
+const shortSyntaxReadOnly = (mode) => mode !== void 0 && mode.split(",").includes("ro");
+const volumeMount = (volume) => {
+	if (typeof volume === "string") {
+		const [source, target, mode] = joinDriveLetter(splitShortSyntax(volume));
+		if (target === void 0) return;
+		return {
+			readOnly: shortSyntaxReadOnly(mode),
+			source,
+			target,
+			type: void 0
+		};
+	}
+	if (volume && typeof volume === "object") {
+		const { read_only: readOnly, source, target, type } = volume;
+		return {
+			readOnly: readOnly === true,
+			source: typeof source === "string" ? source : void 0,
+			target: typeof target === "string" ? target : void 0,
+			type: typeof type === "string" ? type : void 0
+		};
+	}
+};
+/**
+* The host path a bind mount reads from, with interpolation defaults
+* applied and Windows separators folded to `/`. Undefined when the entry is
+* not a bind mount (named volume, tmpfs, anonymous volume) or when the
+* source is an interpolation with no default, which names no host path.
+*/
+const bindMountSource = (mount) => {
+	if (mount.type !== void 0 && mount.type !== "bind") return;
+	if (!mount.source) return;
+	const resolved = resolveInterpolationDefaults(mount.source).replaceAll("\\", "/");
+	if (resolved === "" || !PATH_SHAPED.test(resolved)) return;
+	return resolved;
+};
+const isDockerSocketPath = (hostPath) => hostPath.endsWith("/docker.sock") || hostPath.endsWith("/pipe/docker_engine");
+const DOCKER_SOCKET_TARGET = "/var/run/docker.sock";
+/**
+* Whether the entry bind-mounts the Docker socket, under any of its host
+* spellings. A bare `${VAR}` source names no host path, but a socket target
+* still tells the story.
+*/
+const mountsDockerSocket = (mount) => {
+	const source = bindMountSource(mount);
+	if (source !== void 0) return isDockerSocketPath(source);
+	if (mount.type !== void 0 && mount.type !== "bind") return false;
+	if (!mount.source) return false;
+	return resolveInterpolationDefaults(mount.source) === "" && resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
+};
+const WINDOWS_DRIVE_ROOT = /^[A-Za-z]:\/?$/u;
+const WINDOWS_DRIVE_PREFIX = /^[A-Za-z]:/u;
+const SYSTEM_DIRECTORIES = [
+	"/etc",
+	"/root",
+	"/home",
+	"/Users",
+	"/proc",
+	"/sys",
+	"/boot",
+	"/run",
+	"/var/run"
+];
+const startsWithDirectory = (hostPath, directory) => hostPath === directory || hostPath.startsWith(`${directory}/`);
+/**
+* Classifies where on the host a bind-mount source points. `project` is a
+* relative path that stays inside the Compose project directory; everything
+* else reaches outside it.
+*/
+const classifyHostPath = (hostPath) => {
+	const collapsed = path.posix.normalize(hostPath);
+	const normalized = collapsed.length > 1 ? collapsed.replace(/\/+$/u, "") : collapsed;
+	if (normalized === "~") return "home";
+	if (normalized.startsWith("~/")) return normalized.startsWith("~/.") ? "home-dotfile" : "host";
+	if (normalized === "." || normalized.startsWith("./")) return "project";
+	if (normalized === ".." || normalized.startsWith("../")) return "parent";
+	if (WINDOWS_DRIVE_ROOT.test(normalized)) return "root";
+	if (WINDOWS_DRIVE_PREFIX.test(normalized)) return "host";
+	if (normalized === "/") return "root";
+	if (!normalized.startsWith("/")) return "project";
+	for (const directory of SYSTEM_DIRECTORIES) if (startsWithDirectory(normalized, directory)) return "system";
+	return "host";
+};
+
 //#endregion
 //#region ../core/src/rules/secret-keywords.ts
 const SECRET_KEY_PATTERNS = [
@@ -867,55 +986,6 @@ const noPrivilegedService = {
 	key: "docker-doctor/no-privileged-service",
 	message: "Do not run services in privileged mode"
 };
-const DOCKER_SOCKET_TARGET = "/var/run/docker.sock";
-const INTERPOLATION_WITH_DEFAULT = /\$\{[^}:?-]+:?-(?<fallback>[^}]*)\}/gu;
-const INTERPOLATION_WITHOUT_DEFAULT = /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*/gu;
-const resolveInterpolationDefaults = (value) => value.replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
-const PATH_SHAPED = /^(?:[/.~]|[A-Za-z]:)/u;
-const isDockerSocketPath = (rawPath) => {
-	const normalized = rawPath.replaceAll("\\", "/");
-	return PATH_SHAPED.test(normalized) && (normalized.endsWith("/docker.sock") || normalized.endsWith("/pipe/docker_engine"));
-};
-const splitShortSyntax = (spec) => {
-	const parts = [];
-	let depth = 0;
-	let current = "";
-	for (const char of spec) {
-		if (char === "{") depth += 1;
-		else if (char === "}") depth = Math.max(0, depth - 1);
-		if (char === ":" && depth === 0) {
-			parts.push(current);
-			current = "";
-			continue;
-		}
-		current += char;
-	}
-	parts.push(current);
-	return parts;
-};
-const volumeMount = (volume) => {
-	if (typeof volume === "string") {
-		const [source, target] = splitShortSyntax(volume);
-		return target === void 0 ? void 0 : {
-			source,
-			target
-		};
-	}
-	if (volume && typeof volume === "object") {
-		const { source, target } = volume;
-		return {
-			source: typeof source === "string" ? source : void 0,
-			target: typeof target === "string" ? target : void 0
-		};
-	}
-};
-const mountsDockerSocket = (volume) => {
-	const mount = volumeMount(volume);
-	if (!mount?.source) return false;
-	const resolvedSource = resolveInterpolationDefaults(mount.source);
-	if (resolvedSource !== "") return isDockerSocketPath(resolvedSource);
-	return resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
-};
 const noDockerSocketMount = {
 	category: "Compose",
 	check(composeContent, file, context) {
@@ -923,12 +993,15 @@ const noDockerSocketMount = {
 		for (const [name, config] of composeServices(composeContent)) {
 			const { volumes } = config;
 			if (!Array.isArray(volumes)) continue;
-			for (const [index, volume] of volumes.entries()) if (mountsDockerSocket(volume)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts the Docker socket. Anything running in this container can control the Docker daemon: start privileged containers, read every volume, and escape to the host.`, this.help, context?.locate?.([
-				"services",
-				name,
-				"volumes",
-				index
-			])));
+			for (const [index, volume] of volumes.entries()) {
+				const mount = volumeMount(volume);
+				if (mount && mountsDockerSocket(mount)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts the Docker socket. Anything running in this container can control the Docker daemon: start privileged containers, read every volume, and escape to the host.`, this.help, context?.locate?.([
+					"services",
+					name,
+					"volumes",
+					index
+				])));
+			}
 		}
 		return diagnostics;
 	},
@@ -937,6 +1010,69 @@ const noDockerSocketMount = {
 	key: "docker-doctor/no-docker-socket-mount",
 	message: "Do not bind-mount the Docker socket into services"
 };
+const BROAD_SCOPE_REASONS = {
+	home: "the whole home directory",
+	"home-dotfile": "a hidden directory under the home directory, where credentials and tool configuration live",
+	parent: "a directory above the Compose project",
+	root: "the host's root filesystem",
+	system: "a host system directory"
+};
+const noBroadBindMount = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) {
+			const { volumes } = config;
+			if (!Array.isArray(volumes)) continue;
+			for (const [index, volume] of volumes.entries()) {
+				const mount = volumeMount(volume);
+				if (!mount || mountsDockerSocket(mount)) continue;
+				const source = bindMountSource(mount);
+				if (source === void 0) continue;
+				const reason = BROAD_SCOPE_REASONS[classifyHostPath(source)];
+				if (reason === void 0) continue;
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts '${source}', ${reason}. Everything under it is readable by the container, and a writable mount is the foothold for VM-escape bugs like CVE-2026-77179.`, this.help, context?.locate?.([
+					"services",
+					name,
+					"volumes",
+					index
+				])));
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Mount the narrowest directory the service actually reads (`./data`, not `~` or `/`), and add `:ro` unless the service must write to it. Host paths the service only needs at build time belong in the image instead.",
+	key: "docker-doctor/no-broad-bind-mount",
+	message: "Do not bind-mount broad host directories into services"
+};
+const preferReadOnlyBindMount = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) {
+			const { volumes } = config;
+			if (!Array.isArray(volumes)) continue;
+			for (const [index, volume] of volumes.entries()) {
+				const mount = volumeMount(volume);
+				if (!mount || mount.readOnly || mountsDockerSocket(mount)) continue;
+				const source = bindMountSource(mount);
+				if (source === void 0 || classifyHostPath(source) === "project") continue;
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts host path '${source}' read-write. A writable host mount lets the container change files outside the project, and is the foothold for VM-escape bugs like CVE-2026-77179.`, this.help, context?.locate?.([
+					"services",
+					name,
+					"volumes",
+					index
+				])));
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "info",
+	help: "Append `:ro` to the short syntax, or set `read_only: true` in the long syntax, unless the service must write to the host path.",
+	key: "docker-doctor/prefer-read-only-bind-mount",
+	message: "Bind mounts outside the project should be read-only"
+};
 const noPlaintextSecrets = {
 	category: "Compose",
 	check(composeContent, file, context) {
@@ -978,6 +1114,8 @@ const noPlaintextSecrets = {
 const composeSecurityRules = [
 	noPrivilegedService,
 	noDockerSocketMount,
+	noBroadBindMount,
+	preferReadOnlyBindMount,
 	noPlaintextSecrets
 ];
 
@@ -1575,4 +1713,4 @@ const toJsonReport = (diagnostics, score, label, project) => ({
 
 //#endregion
 export { runDockerfileRules as a, createComposeLocator as c, discoverProject as d, version as f, runComposeRules as i, parseCompose as l, calculateScore as n, allRules as o, loadConfig as r, findRule as s, toJsonReport as t, parseDockerfile as u };
-//# sourceMappingURL=src-BOGzkp17.mjs.map
+//# sourceMappingURL=src-CklEIXTX.mjs.map