mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-stt: say plainly that the network is not restricted and the decoder can read the unit's credentials

Browse source
This commit is contained in:
damocles 2026-11-12 10:49:50 +01:00 • committed by mara
commit 2d6ac0b7e7
1 changed files with 17 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/2-handbook/swarm/services.md
View file

@ -435,8 +435,11 @@ how many requests it holds at once are settings next to it.
The audio comes from rooms with outside people, so the service runs as its own
unprivileged user under a tight systemd sandbox, with a memory ceiling and
a CPU quota, and the container reaches the queue, the store and authelia
and nothing else. The file's first bytes must look like an audio container
a CPU quota. Its network isn't restricted: the decoder runs in the same
network namespace as the service and can read its credentials, so a decoder
exploit could read them and send them anywhere the container can reach. Closing
that's for the strict-egress work on service containers, or for running the
decode with no network and no credentials. The file's first bytes must look like an audio container
before anything decodes it. Its leaf and its queue client work as the router's
do. The design, the settings and the reasons are in
[`stt.md`](../../4-implementation/swarm/stt.md).