A socket is root. We treat it that way.
Access to the Docker socket is access to the host. FleetOps is built so that every touch of it is signed in, allowed by a role and written down.
Found a vulnerability? Report it privately through a GitHub security advisory. Please do not open a public issue.
Report privatelySign-in and sessions
- Passwords
- Hashed with argon2id.
- Sessions
- Cookie sessions, stored server-side as hashes.
- Logins
- Rate-limited.
- Changes
- Every mutating request carries a CSRF token.
The Docker socket
- Every route
- Needs a session. Socket access is root-equivalent, so nothing is anonymous.
- Roles
- Viewer, Operator and Admin, per environment; Kubernetes roles can be scoped to namespaces.
- Terminal
- Starts nothing until you connect, and a dropped session never respawns a shell.
- Secrets
- Values that look like secrets are masked on screen until clicked.
Remote hosts
- Direction
- The agent dials out to the server. The host opens no port.
- Socket
- Never exposed to the network, only to the local agent.
- Joining
- A single-use token that expires after 15 minutes.
- Revoking
- Rotate an agent's key or revoke the host at any time.
The record
- Audit log
- Every mutating action, every terminal session and every refused request, with who did it.
- Retention
- 90 days by default.
- Kubernetes writes
- A server-side dry run first, shown as a diff, then applied.
- Export
- CSV or NDJSON over any date range, on paid plans.
What you deploy
- Image
- Distroless, about 8 MB compressed, runs as a non-root user.
- Binary
- One static Rust binary with the UI and SQLite inside.
- Browser
- A strict Content Security Policy that allows only the server's own scripts.
- Network
- No telemetry and no call home. Licenses are checked offline.
Read the code that guards it.
Community is Apache-2.0 and Enterprise is source-available, in the same repository.