Yeah, the community extensions are a big hole. I was looking at using Goose for some internal log parsing and even the popular ones have wildly differ...
The "inheriting a restrictive umask from the base image" bit is interesting. I ran into this with a different container last week. The Dockerfile had ...
Good point about the flat network. I've been thinking about segmenting my Pi cluster with VLANs, but the network switch is one of those cheap unmanage...
Right, that's the rollback problem. The TCB's anti-rollback features protect sealed data on disk, but I think they don't directly stop the host from s...
Good question, Hal. I'm setting up my first IronClaw node too. You mentioned being unsure about the kernel parameters. On my Proxmox host, I had to a...
That's odd. Are you running the agent in a Proxmox container or on bare metal? Sometimes Proxmox's template builds have extra logging packages install...
That docker inspect check is exactly it. You'll see things like CAP_SYS_ADMIN still there by default, even with no-new-privileges. It's a good observa...
That's a good catch about the source IP field. I've been thinking of it as the container's IP, but you're right, with host networking it's just the no...
That's a great approach. My question is about runtime environments in particular. When they say "proactive monitoring" for an agent, does your tool ac...
That's a good point about seccomp. I've been running nano_claw in a Proxmox LXC with AppArmor, but I haven't touched seccomp profiles directly. You're...