Enhance nginx configuration and container security features#33
Merged
Conversation
Replace raw `$http_host` with canonical `$host` for routing and add `X-Forwarded-Host` and `X-Forwarded-Proto` headers to preserve the original client request through the proxy chain.
- Correct "Server stopped" to "Server already stopped" in stop path - Use `_get_client_ip` helper instead of raw `request.client.host` - Remove unnecessary f-string on regex replacement label - Suppress stderr in chmod with portable redirection - Whitelist private subnets for Traefik forwarded headers
The hardened container uses tmpfs paths, so removing this limit allows Theia file uploads and other workspace uploads to be gated solely by application-level limits
xfs_quota requires the underlying block device node inside the container. Add XFS_QUOTA_DEVICE_PATH to compose.yml and document the required setup in .env.example and PRODUCTION-DEPLOYMENT.md.
start.sh now sets LD_PRELOAD itself after creating passwd/group files, so the spawner only needs to pass NSS_WRAPPER_PASSWD and NSS_WRAPPER_GROUP.
Centralize Docker volume/container name construction in `make_docker_volume_name`, replacing ad-hoc sanitization in the server API and spawner. Add validation in `VolumeService.create_volume` with proper error handling for invalid and duplicate names. Update cleanup logic in `create_server` to track multiple auto-created volumes and clean them all up on failure.
switch to user UUID Replace the `username` parameter with `user_identifier` (UUID) so that colliding sanitized usernames produce distinct Docker resource names. Update all callers to pass `str(current_user.id)` instead of `current_user.username`, and adjust container-name generation in the spawner to use the new helper.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.