Repository navigation
ci: confine dependencies with gomodjail (static mode) - #7411
AkihiroSuda wants to merge 1 commit into
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
8073db1 to
fd1475f
Compare
cf43e2d to
7241fa6
Compare
Mark all the modules in vendor.mod as confined by default with gomodjail, and run `gomodjail analyze` (static mode) in CI to verify that confined modules cannot reach privileged capabilities such as file, network, exec, syscall, etc. Modules that already need such capabilities are annotated as "gomodjail:unconfined". Newly added dependencies are confined by default, so an update that newly gains a privileged capability fails the check and gets more review. https://github.com/AkihiroSuda/gomodjail Assisted-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
7241fa6 to
3cb1601
Compare
| github.com/containerd/log v0.2.0 // gomodjail:unconfined | ||
| github.com/containerd/platforms v1.0.0-rc.5 // gomodjail:unconfined |
There was a problem hiding this comment.
Are there ways to configure this other than through go.mod ? Also considering that (parts of?) a separate config could be more easily shared / maintained centrally.
There was a problem hiding this comment.
Are there ways to configure this other than through go.mod ?
gomodjail analyze has --policy flag, but the UX doesn't scale for dozens of deps
--policy stringToString e.g., example.com/module=confined (overrides go.mod) (default [])
Maybe we should consider having a separate file like go.mod.policy.yaml? (or toml? hcl?)
| // gomodjail:unconfined | ||
| github.com/docker/go-events v0.1.0 // indirect |
There was a problem hiding this comment.
.. and for the indirects; this feels brittle; a comment can (and will?) be left behind, now describing the wrong dependency
There was a problem hiding this comment.
The comment could be also written as // indirect // gomodjail:unconfined but IIRC dependabot didn't work well with it.
This docker/cli repo doesn't use dependabot though.
Summary
Mark all the modules in vendor.mod as confined by default with gomodjail, and run
gomodjail analyze(static mode) in CI to verify that confined modules cannot reach privileged capabilities such as file, network, exec, syscall, etc.Modules that already need such capabilities are annotated as "gomodjail:unconfined".
Newly added dependencies are confined by default, so an update that newly gains a privileged capability fails the check and gets more review.
https://github.com/AkihiroSuda/gomodjail
See:
Release notes (optional)
A picture of a cute animal (not mandatory but encouraged)
Created with: Claude Code