Security

Docker socket risk

The service mounts /var/run/docker.sock read-write. Docker socket access is effectively host-root access to the host. A compromised AI tool, dependency, shell command, or untrusted repository can ask Docker to start privileged containers, mount host paths, or modify other workloads.

Running the default workload as dev, omitting Compose privileged, and granting no unrelated capabilities reduce accidental container-local damage. They do not sandbox Docker socket access.

Deploy only on a trusted single-user host and review repositories before opening them in AI tools.

Secrets

The public image contains no user credentials. Authentication is manual and persists in the selected /config generation. Sensitive state includes:

• Claude and Codex authentication files
• SSH private keys and Git credential configuration
• OMC/OMX user configuration
• cc-switch provider keys, OAuth material, and related files

Never commit secrets, add them to Compose, pass them as Docker build arguments, or include raw configuration in an issue.

Operational controls

• Prefer immutable version tags or digests for production-like deployments
• Back up all six volumes before image, configuration, or identity migration
• Keep the service stopped during migration, rollback, restore, and identity changes
• Protect access to the Docker host and volume store

Recovery interface

Normal work must use scripts/shell or scripts/exec, which force the dev identity and resolve the active generation. docker compose exec ai-dev sh inherits root and exists only for recovery.