[PR #107] [CLOSED] Security hardening: OPSEC, container escape fix, SDK removal #160

New Issue

2026-06-06T22:09:28-04:00

yindo commented

2026-06-06 22:09:28 -04:00

📋 Pull Request Information

Original PR: https://github.com/vxcontrol/pentagi/pull/107
Author: @IZonGroup
Created: 2/20/2026
Status: ❌ Closed

Base: master ← Head: security-hardening

📝 Commits (1)

8e8c121 Security hardening: strip closed-source SDK, fix container escape, harden OPSEC

📊 Changes

15 files changed (+94 additions, -60 deletions)

View changed files

📝 backend/cmd/installer/checker/checker.go (+3 -3)
📝 backend/cmd/installer/hardening/hardening.go (+6 -13)
📝 backend/cmd/installer/processor/update.go (+4 -3)
📝 backend/cmd/installer/wizard/models/server_settings_form.go (+2 -9)
📝 backend/go.mod (+2 -2)
📝 backend/migrations/sql/20241026_115120_initial_state.sql (+3 -1)
📝 backend/pkg/config/config.go (+6 -16)
📝 backend/pkg/docker/client.go (+37 -3)
📝 backend/pkg/observability/lfclient.go (+1 -1)
📝 backend/pkg/server/router.go (+3 -1)
📝 backend/pkg/server/services/auth.go (+2 -1)
📝 backend/pkg/system/host_id.go (+1 -1)
📝 backend/pkg/tools/browser.go (+1 -1)
📝 backend/pkg/tools/searxng.go (+1 -1)
📝 docker-compose.yml (+22 -4)

📄 Description

Summary

Removed closed-source vxcontrol/cloud SDK — license validation and machine fingerprinting stripped from config, installer hardening, and wizard
Blocked Docker socket forwarding to worker containers — eliminates the critical container escape chain (user prompt → LLM → shell → Docker socket → host root)
Added Docker image allowlist — LLM can no longer pull arbitrary images from any registry
Replaced all vxcontrol Docker images with official alternatives (pgvector/pgvector, kalilinux/kali-rolling, browserless/chrome)
Stripped OPSEC fingerprints — PentAGI/1.0 user-agent replaced with generic Chrome UA across all HTTP clients
Disabled update server phone-home — all connections to update.pentagi.com removed
Fixed TLS verification — InsecureSkipVerify set to false on Langfuse and scraper clients
Hardened defaults — CORS restricted to localhost, Docker ports bound to 127.0.0.1, SameSite cookie attribute added
Required auth for API docs — Swagger and GraphQL Playground now behind authentication
Stronger default admin password — bcrypt cost factor raised to 12, random 16-char password
Container resource limits added to docker-compose for all services
Regenerated host_id salt unique to this fork

Files Changed (15)

File	Change
`config.go`	Remove SDK import, harden CORS/IP defaults, official Kali image
`client.go`	Block socket forwarding, add image allowlist
`hardening.go`	Replace SDK calls with local UUID generation
`server_settings_form.go`	Remove SDK license validation
`update.go`	Disable phone-home URLs
`checker.go`	Strip installer UA, disable update server
`router.go`	Auth-gate Swagger + GraphQL Playground
`auth.go`	Add SameSite=Lax, force Secure cookie
`lfclient.go`	Fix TLS verification
`browser.go`	Fix TLS verification
`searxng.go`	Generic user-agent
`host_id.go`	New salt
`go.mod`	Remove vxcontrol/cloud
`docker-compose.yml`	Official images, resource limits
`initial_state.sql`	Strong default admin password

Test plan

Build from source using the Dockerfile to verify compilation succeeds without vxcontrol/cloud SDK
Deploy with docker-compose and confirm all services start
Verify worker containers do NOT receive Docker socket mount
Test that pulling an image not in the allowlist is rejected
Confirm Swagger/Playground require login
Verify no outbound connections to update.pentagi.com or vxcontrol domains

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/vxcontrol/pentagi/pull/107 **Author:** [@IZonGroup](https://github.com/IZonGroup) **Created:** 2/20/2026 **Status:** ❌ Closed **Base:** `master` ← **Head:** `security-hardening` --- ### 📝 Commits (1) - [`8e8c121`](https://github.com/vxcontrol/pentagi/commit/8e8c121818082c948a4820a06f4adc644a1e4c69) Security hardening: strip closed-source SDK, fix container escape, harden OPSEC ### 📊 Changes **15 files changed** (+94 additions, -60 deletions) <details> <summary>View changed files</summary> 📝 `backend/cmd/installer/checker/checker.go` (+3 -3) 📝 `backend/cmd/installer/hardening/hardening.go` (+6 -13) 📝 `backend/cmd/installer/processor/update.go` (+4 -3) 📝 `backend/cmd/installer/wizard/models/server_settings_form.go` (+2 -9) 📝 `backend/go.mod` (+2 -2) 📝 `backend/migrations/sql/20241026_115120_initial_state.sql` (+3 -1) 📝 `backend/pkg/config/config.go` (+6 -16) 📝 `backend/pkg/docker/client.go` (+37 -3) 📝 `backend/pkg/observability/lfclient.go` (+1 -1) 📝 `backend/pkg/server/router.go` (+3 -1) 📝 `backend/pkg/server/services/auth.go` (+2 -1) 📝 `backend/pkg/system/host_id.go` (+1 -1) 📝 `backend/pkg/tools/browser.go` (+1 -1) 📝 `backend/pkg/tools/searxng.go` (+1 -1) 📝 `docker-compose.yml` (+22 -4) </details> ### 📄 Description ## Summary - **Removed closed-source `vxcontrol/cloud` SDK** — license validation and machine fingerprinting stripped from config, installer hardening, and wizard - **Blocked Docker socket forwarding to worker containers** — eliminates the critical container escape chain (user prompt → LLM → shell → Docker socket → host root) - **Added Docker image allowlist** — LLM can no longer pull arbitrary images from any registry - **Replaced all vxcontrol Docker images** with official alternatives (pgvector/pgvector, kalilinux/kali-rolling, browserless/chrome) - **Stripped OPSEC fingerprints** — `PentAGI/1.0` user-agent replaced with generic Chrome UA across all HTTP clients - **Disabled update server phone-home** — all connections to `update.pentagi.com` removed - **Fixed TLS verification** — `InsecureSkipVerify` set to `false` on Langfuse and scraper clients - **Hardened defaults** — CORS restricted to localhost, Docker ports bound to 127.0.0.1, SameSite cookie attribute added - **Required auth for API docs** — Swagger and GraphQL Playground now behind authentication - **Stronger default admin password** — bcrypt cost factor raised to 12, random 16-char password - **Container resource limits** added to docker-compose for all services - **Regenerated host_id salt** unique to this fork ## Files Changed (15) | File | Change | |------|--------| | `config.go` | Remove SDK import, harden CORS/IP defaults, official Kali image | | `client.go` | Block socket forwarding, add image allowlist | | `hardening.go` | Replace SDK calls with local UUID generation | | `server_settings_form.go` | Remove SDK license validation | | `update.go` | Disable phone-home URLs | | `checker.go` | Strip installer UA, disable update server | | `router.go` | Auth-gate Swagger + GraphQL Playground | | `auth.go` | Add SameSite=Lax, force Secure cookie | | `lfclient.go` | Fix TLS verification | | `browser.go` | Fix TLS verification | | `searxng.go` | Generic user-agent | | `host_id.go` | New salt | | `go.mod` | Remove vxcontrol/cloud | | `docker-compose.yml` | Official images, resource limits | | `initial_state.sql` | Strong default admin password | ## Test plan - [ ] Build from source using the Dockerfile to verify compilation succeeds without vxcontrol/cloud SDK - [ ] Deploy with docker-compose and confirm all services start - [ ] Verify worker containers do NOT receive Docker socket mount - [ ] Test that pulling an image not in the allowlist is rejected - [ ] Confirm Swagger/Playground require login - [ ] Verify no outbound connections to update.pentagi.com or vxcontrol domains 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

yindo added the pull-request label 2026-06-06 22:09:28 -04:00

yindo closed this issue

2026-06-06 22:09:28 -04:00

yindo referenced this issue

2026-06-06 22:09:47 -04:00

[PR #196] [MERGED] fix(bedrock): always include toolConfig when messages contain toolUse/toolResult blocks #226

yindo referenced this issue

2026-06-06 22:09:52 -04:00

[PR #222] [MERGED] Test Coverage & Performance Improvements #245

Sign in to join this conversation.