security: REST listener binds all interfaces without TLS; default to loopback or warn, and decide the TLS source separately

Open
  • Is something wrong?
#3,522 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
45/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
go
Domain
security

Research direction

The plain-HTTP listener is the http.ListenAndServe(addr, httpMux) call at internal/gateway/gateway.go:1066; start there and check how addr is built and whether the bind host is available at that point. The task is a startup warning for a non-loopback bind with no declared terminator, plus the explicit setting that declares one, which the issue leaves unnamed. Done means the warning shows for the default non-loopback bind, stays silent for loopback or a declared terminator, has a test, and is documented with a changelog note.

Written by the indexing model from the issue text.

Description

model:opus needs-verification phase-2-optimize runtime:claude security size:M

Problem

return http.ListenAndServe(addr, httpMux) (internal/gateway/gateway.go:1066) serves REST on :<port> (all interfaces) with no TLS. --mtls covers only the external gRPC listener. TLS for REST relies on an external terminator, which not every install has; the sentinel-to-backend hops in the /certs issue hit this same port.

Proposal (per Q2, non-breaking first)

Warn at startup when the REST listener is non-loopback and not behind a declared terminator, and add an explicit setting that declares one. Whether the daemon should terminate TLS itself (cert source, flag, install flow) is a separate design question and is not part of this issue; open it as its own issue if wanted.

Acceptance

  • The warning appears for a non-loopback bind with no declared terminator and not for loopback or a declared terminator; tested.
  • Documented, with the changelog note.

Verify on dev: start the daemon with the default bind and confirm the warning; declare a terminator and confirm it is silent.

Part of #3513. Split from #3340 after a re-verification against main at v0.128.0 (the scan behind the original issue was never reproduced). Decisions Q1 and Q2 on #3513 applies.

Dominant language
Go
Stars
296
Forks
38
Avg merge
6h 57m
Merged PRs (30d)
637

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from FootprintAI/Containarium

All issues in FootprintAI/Containarium

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.