Repository navigation
feat(docker): add memory, read-only, no-new-privileges and user to Container - #2185
Draft
rickyeescobar wants to merge 3 commits into
Draft
rickyeescobar wants to merge 3 commits into
rickyeescobar wants to merge 3 commits into
Conversation
A PKCS#10 certificate signing request built locally from an `ec`, `rsa` or `ed25519` PEM private key, usually one minted by `KeyPair`, for certificate resources such as `Cloudflare.OriginCaCertificate`. ECDSA and RSA signatures are randomized, so the CSR is kept in state and rebuilt only when the key fingerprint, the common name or the set of DNS names changes. The DER encoder moves from `ACME/Der.ts` to `Util/Der.ts` so `ACME.Pki` and `CertRequest` share it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
`Command.Exec` gains an optional `destroyCommand` that runs on delete with the `cwd`, `env`, `shell` and `timeout` of the last deploy, for a final backup or a deregistration call. A non-zero exit fails the destroy and keeps the state row. An edit to `destroyCommand` alone is saved without re-running `command`: a noop never persists props and `delete` reads the command from state. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…ntainer `Docker.Container` gains `memory`, `memorySwap`, `readOnly`, `noNewPrivileges` and `user`, forwarded as `docker container create` options. They are create-time props, so a change replaces the container. Unset props add no key to the container's config hash, so existing containers are not recreated on upgrade. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Docker.Containercan now limit memory and harden the runtime.memoryandmemorySwaptake Docker's byte-suffix format and map to--memoryand--memory-swap.readOnlymaps to--read-only,noNewPrivilegesto--security-opt no-new-privileges,userto--user.Stacked on #2182 and #2183.
🤖 Generated with Claude Code