srvgov-cli 0.3.0 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +29 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -28,6 +28,7 @@ srvgov ports -o json
|
|
|
28
28
|
srvgov logs --unit sshd --since "1 hour ago" --lines 50 -o json
|
|
29
29
|
srvgov svc status sshd -o json
|
|
30
30
|
srvgov file stat /etc/hosts -o json
|
|
31
|
+
srvgov docker list -o json
|
|
31
32
|
srvgov exec --dry-run "uptime" -o json
|
|
32
33
|
srvgov exec "uptime" -o json
|
|
33
34
|
srvgov audit query --limit 20 -o json
|
|
@@ -144,6 +145,34 @@ file content; audit stores only the redacted path, byte count, and SHA-256.
|
|
|
144
145
|
Writes are direct and non-atomic; temporary-file plus rename is not implemented
|
|
145
146
|
in this release. `file` never uses SFTP and never adds `sudo`.
|
|
146
147
|
|
|
148
|
+
## Docker Governance
|
|
149
|
+
|
|
150
|
+
Docker reads provide stable, redacted structures:
|
|
151
|
+
|
|
152
|
+
```bash
|
|
153
|
+
srvgov docker list -o json
|
|
154
|
+
srvgov docker inspect api -o json
|
|
155
|
+
srvgov docker logs api --tail 100 -o json
|
|
156
|
+
```
|
|
157
|
+
|
|
158
|
+
`docker list`, `inspect`, and `logs` are audited R0 operations. Inspect uses a
|
|
159
|
+
remote fixed-field projection and excludes container environment variables and
|
|
160
|
+
the full inspect document. Logs default to 100 lines and accept `--tail`
|
|
161
|
+
between 1 and 10000.
|
|
162
|
+
|
|
163
|
+
Lifecycle changes are R2 and require human authorization:
|
|
164
|
+
|
|
165
|
+
```bash
|
|
166
|
+
srvgov docker restart api \
|
|
167
|
+
--reason "restart after reviewed deployment" --ticket OPS-123 --yes -o json
|
|
168
|
+
```
|
|
169
|
+
|
|
170
|
+
The fixed whitelist contains only `ps`/`list`, `inspect`, `logs`, `start`,
|
|
171
|
+
`stop`, `restart`, and `rm`, one container at a time. It never exposes Docker
|
|
172
|
+
run, create, exec, build, copy, compose, or prune. Protected contexts raise
|
|
173
|
+
lifecycle changes to R3 and require human-supplied `--allow-destructive`.
|
|
174
|
+
Container identifiers are shell-quoted.
|
|
175
|
+
|
|
147
176
|
## Governed Execution
|
|
148
177
|
|
|
149
178
|
Preview without connecting or executing:
|