agent-radar
7be535059e
Dependency audit / audit (push) Canceled after 0s
CI / plan (push) Canceled after 0s
Gitoxide helper admission / macos-latest (push) Canceled after 0s
Gitoxide helper admission / ubuntu-latest (push) Canceled after 0s
Gitoxide helper admission / windows-latest (push) Canceled after 0s
Runtime Host peer admission / quality (push) Canceled after 0s
Windows recovery / windows_recovery (push) Canceled after 0s
CI / heavy (push) Canceled after 0s
CI / test (push) Canceled after 0s
58 lines
2.0 KiB
YAML
58 lines
2.0 KiB
YAML
# Licensed to the Apache Software Foundation (ASF) under one
|
|
# or more contributor license agreements. See the NOTICE file
|
|
# distributed with this work for additional information
|
|
# regarding copyright ownership. The ASF licenses this file
|
|
# to you under the Apache License, Version 2.0 (the
|
|
# "License"); you may not use this file except in compliance
|
|
# with the License. You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing,
|
|
# software distributed under the License is distributed on an
|
|
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
# KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
services:
|
|
harbor-docker-egress-control-sidecar:
|
|
volumes:
|
|
- type: bind
|
|
source: ${MAKA_EVAL_NETWORK_POLICY_PATH}
|
|
target: /usr/local/bin/network-policy
|
|
read_only: true
|
|
- maka-eval-egress-ca:/opt/maka-egress:ro
|
|
|
|
main:
|
|
depends_on:
|
|
maka-eval-mitmproxy:
|
|
condition: service_healthy
|
|
# An AF_PACKET socket writes below the IP output hooks the policy installs,
|
|
# so no nftables rule can constrain it. NET_RAW is what gates that socket.
|
|
# A task's own compose can add the capability back, which this cannot
|
|
# prevent — the relay refuses to start the subject when that happens.
|
|
cap_drop:
|
|
- NET_RAW
|
|
volumes:
|
|
- maka-eval-egress-ca:/opt/maka-egress:ro
|
|
|
|
maka-eval-mitmproxy:
|
|
image: maka-eval-egress-proxy:12.2.3
|
|
networks:
|
|
- default
|
|
volumes:
|
|
- maka-eval-egress-ca:/opt/maka-egress
|
|
healthcheck:
|
|
test:
|
|
- CMD
|
|
- python
|
|
- -c
|
|
- "import pathlib,socket; assert pathlib.Path('/opt/maka-egress/mitmproxy-ca-cert.pem').is_file(); assert pathlib.Path('/opt/maka-egress/proxy-ipv4').is_file(); socket.create_connection(('127.0.0.1',8080),2).close()"
|
|
interval: 1s
|
|
timeout: 3s
|
|
retries: 30
|
|
|
|
volumes:
|
|
maka-eval-egress-ca:
|