[P9] Audit pipeline volume mounts after privilege model change #100

New Issue

kert · 2026-03-22T14:38:14Z

kert commented

2026-03-22 14:38:14 +00:00

Context

After resolving #99 (adding WOODPECKER_PLUGINS_PRIVILEGED), audit whether the current volumes: bind mounts on buildx/trivy steps are still needed or redundant.

Currently every buildx and trivy step mounts the Docker socket:

volumes:
  - /run/user/1000/docker.sock:/var/run/docker.sock

With the privileged plugin model, the plugin container may already get Docker socket access through the agent. If so, these explicit mounts are redundant and should be removed to reduce the attack surface.

Steps

After #99 lands, test a buildx step without the explicit volume mount
If it works, remove redundant volumes: from all 15 buildx and 7 trivy steps
If volume mounts are still required, document why in a comment at the top of deploy.yml

## Context After resolving #99 (adding `WOODPECKER_PLUGINS_PRIVILEGED`), audit whether the current `volumes:` bind mounts on buildx/trivy steps are still needed or redundant. Currently every buildx and trivy step mounts the Docker socket: ```yaml volumes: - /run/user/1000/docker.sock:/var/run/docker.sock ``` With the privileged plugin model, the plugin container may already get Docker socket access through the agent. If so, these explicit mounts are redundant and should be removed to reduce the attack surface. ## Steps - [ ] After #99 lands, test a buildx step **without** the explicit volume mount - [ ] If it works, remove redundant `volumes:` from all 15 buildx and 7 trivy steps - [ ] If volume mounts are still required, document why in a comment at the top of deploy.yml

kert added this to the P9: CI/CD Unification milestone 2026-03-22 14:38:14 +00:00

kert added the ci label 2026-03-22 14:38:14 +00:00

kert closed this issue

2026-03-23 17:56:49 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#100