mirror of
https://github.com/outbackdingo/optimclaw.git
synced 2026-08-25 14:53:34 +00:00
c26f116a98
* fix(deploy): harden production container and bootstrap security - Replace --network=host with explicit port mapping (-p 3000:3000) to restore Docker network isolation. The prior config gave the container full access to the host network namespace including the Cloud SQL Auth Proxy on localhost:5432. (CWE-668) - Support pinned image versions via IRONCLAW_VERSION env var instead of always pulling :latest. Mutable tags allow uncontrolled deployments if the registry is compromised or a broken image is pushed. Falls back to :latest when unset for backwards compatibility. (CWE-829) - Add SHA256 checksum verification after downloading the Cloud SQL Auth Proxy binary. The prior script executed an unverified binary downloaded over the network with direct access to the production database. (CWE-494) Co-Authored-By: Claude Opus 4.6 <[email protected]> * chore(ci): rerun regression gate [skip-regression-check] --------- Co-authored-by: Rafael Martinez <[email protected]> Co-authored-by: Claude Opus 4.6 <[email protected]>
25 lines
827 B
Desktop File
25 lines
827 B
Desktop File
[Unit]
|
|
Description=IronClaw AI Assistant
|
|
After=cloud-sql-proxy.service docker.service
|
|
Requires=cloud-sql-proxy.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
EnvironmentFile=/opt/ironclaw/.env
|
|
# Pin to a specific version tag or digest instead of :latest to prevent
|
|
# uncontrolled deployments. Update IRONCLAW_VERSION in /opt/ironclaw/.env
|
|
# or replace the tag below when deploying a new release.
|
|
ExecStartPre=/bin/bash -c 'docker pull us-central1-docker.pkg.dev/ironclaw-prod/ironclaw/agent:${IRONCLAW_VERSION:-latest}'
|
|
ExecStart=/bin/bash -c 'docker run --rm \
|
|
--name ironclaw \
|
|
--env-file /opt/ironclaw/.env \
|
|
-p 3000:3000 \
|
|
us-central1-docker.pkg.dev/ironclaw-prod/ironclaw/agent:${IRONCLAW_VERSION:-latest} \
|
|
--no-onboard'
|
|
ExecStop=/usr/bin/docker stop ironclaw
|
|
Restart=always
|
|
RestartSec=10
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|