062dcae Merge pull request #177 from bnema/security-hardening-audit-fixes · gordon

A .dockerignore +11 -0

@@ -0,0 +1,11 @@
	1	+	.git
	2	+	.worktrees
	3	+	.gitignore
	4	+	.gitleaks.toml
	5	+	Dockerfile
	6	+	*.log
	7	+	/tmp
	8	+	coverage.out
	9	+	dist
	10	+	build
	11	+	node_modules

M .github/actions/setup-gordon/action.yml +58 -9


@@ -26,6 +26,8 @@ runs:
26		- name: Install Gordon	26		- name: Install Gordon
27		id: install	27		id: install
28		shell: bash	28		shell: bash
			29	+	env:
			30	+	GORDON_VERSION_INPUT: ${{ inputs.version }}
29		run: \|	31		run: \|
30		set -euo pipefail	32		set -euo pipefail
31			33

@@ -43,7 +45,11 @@ runs:
43		*) echo "Unsupported architecture: ${RUNNER_ARCH}" >&2; exit 1 ;;	45		*) echo "Unsupported architecture: ${RUNNER_ARCH}" >&2; exit 1 ;;
44		esac	46		esac
45			47
46	-	version="${{ inputs.version }}"	48	+	version="${GORDON_VERSION_INPUT}"
			49	+	if ! [[ "${version}" =~ ^(latest\|v?[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.-]+)?)$ ]]; then
			50	+	echo "Invalid Gordon version: ${version}" >&2
			51	+	exit 1
			52	+	fi
47			53
48		# Resolve 'latest' to an actual tag via redirect URL	54		# Resolve 'latest' to an actual tag via redirect URL
49		if [ "${version}" = "latest" ]; then	55		if [ "${version}" = "latest" ]; then

@@ -53,24 +59,67 @@ runs:
53		echo "Failed to resolve latest Gordon version" >&2	59		echo "Failed to resolve latest Gordon version" >&2
54		exit 1	60		exit 1
55		fi	61		fi
			62	+	if ! [[ "${version}" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.-]+)?$ ]]; then
			63	+	echo "Resolved invalid Gordon version: ${version}" >&2
			64	+	exit 1
			65	+	fi
56		fi	66		fi
57			67
58		archive="gordon_${os}_${arch}.tar.gz"	68		archive="gordon_${os}_${arch}.tar.gz"
59	-	url="https://github.com/bnema/gordon/releases/download/${version}/${archive}"	69	+	base_url="https://github.com/bnema/gordon/releases/download/${version}"
60	-	dest="/tmp/${archive}"	70	+	url="${base_url}/${archive}"
			71	+	checksums_url="${base_url}/checksums.txt"
			72	+	work_dir="$(mktemp -d)"
			73	+	dest="${work_dir}/${archive}"
			74	+	checksums="${work_dir}/checksums.txt"
			75	+	extract_dir="${work_dir}/extract"
61		install_path="/usr/local/bin/gordon"	76		install_path="/usr/local/bin/gordon"
			77	+	trap 'rm -rf "${work_dir}"' EXIT
62			78
63		echo "Installing Gordon ${version} (${os}/${arch}) from ${url}"	79		echo "Installing Gordon ${version} (${os}/${arch}) from ${url}"
64			80
65	-	# Download the release archive	81	+	# Download the release archive and checksums
			82	+	curl -fsSL -o "${checksums}" "${checksums_url}"
66		curl -fsSL -o "${dest}" "${url}"	83		curl -fsSL -o "${dest}" "${url}"
67			84
68	-	# Extract just the gordon binary and clean up	85	+	# Verify checksum before extraction
69	-	tar -xzf "${dest}" -C /usr/local/bin/ gordon	86	+	archive_escaped="$(printf '%s\n' "${archive}" \| sed 's/[.[\\*^$()+?{\|]/\\\\&/g')"
70	-	rm -f "${dest}"	87	+	checksum_lines="$(grep -E "^[0-9a-fA-F]{64}[[:space:]]+\\*?${archive_escaped}$" "${checksums}" \|\| true)"
			88	+	if [ "$(printf '%s\n' "${checksum_lines}" \| sed '/^$/d' \| wc -l \| tr -d ' ')" != "1" ]; then
			89	+	echo "Expected exactly one checksum for ${archive} in checksums.txt" >&2
			90	+	exit 1
			91	+	fi
			92	+	expected="$(printf '%s\n' "${checksum_lines}" \| awk '{print $1}')"
			93	+	if command -v sha256sum >/dev/null 2>&1; then
			94	+	actual="$(sha256sum "${dest}" \| awk '{print $1}')"
			95	+	elif command -v shasum >/dev/null 2>&1; then
			96	+	actual="$(shasum -a 256 "${dest}" \| awk '{print $1}')"
			97	+	else
			98	+	echo "Neither sha256sum nor shasum is available for checksum verification" >&2
			99	+	exit 1
			100	+	fi
			101	+	if [ "${expected}" != "${actual}" ]; then
			102	+	echo "Checksum verification failed for ${archive}" >&2
			103	+	echo "Expected: ${expected}" >&2
			104	+	echo "Actual: ${actual}" >&2
			105	+	exit 1
			106	+	fi
			107	+
			108	+	# Extract just the gordon binary and reject symlinks/directories
			109	+	mkdir -p "${extract_dir}"
			110	+	tar -xzf "${dest}" -C "${extract_dir}" gordon
			111	+	binary="${extract_dir}/gordon"
			112	+	if [ ! -f "${binary}" ] \|\| [ -L "${binary}" ]; then
			113	+	echo "Archive did not contain a regular Gordon binary" >&2
			114	+	exit 1
			115	+	fi
71			116
72	-	# Make executable and verify	117	+	# Install with explicit executable permissions and verify
73	-	chmod +x "${install_path}"	118	+	if [ -w "$(dirname "${install_path}")" ]; then
			119	+	install -m 0755 "${binary}" "${install_path}"
			120	+	else
			121	+	sudo install -m 0755 "${binary}" "${install_path}"
			122	+	fi
74		gordon version	123		gordon version
75			124
76		# Set outputs	125		# Set outputs

A .gitleaks.toml +32 -0

@@ -0,0 +1,32 @@
	1	+	title = "Gordon gitleaks configuration"
	2	+
	3	+	[extend]
	4	+	useDefault = true
	5	+
	6	+	[[allowlists]]
	7	+	description = "Allow documented placeholder credentials in Markdown examples"
	8	+	condition = "AND"
	9	+	paths = [
	10	+	'''docs/config/env\.md$''',
	11	+	'''docs/cli/auth\.md$''',
	12	+	'''docs/config/telemetry\.md$''',
	13	+	'''wiki/guides/remote-cli\.md$''',
	14	+	]
	15	+	regexes = [
	16	+	'''sk-1234567890''',
	17	+	'''8f3a2b1c4d5e6f7a8b9c0d1e2f3a4b5c\.\.\.''',
	18	+	'''YWRtaW5AZXhhbXBsZS5jb206c2VjcmV0''',
	19	+	'''eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.\.\.''',
	20	+	]
	21	+
	22	+	[[allowlists]]
	23	+	description = "Allow deterministic non-secret test fixtures"
	24	+	condition = "AND"
	25	+	paths = [
	26	+	'''internal/adapters/in/cli/remote/client_test\.go$''',
	27	+	'''internal/adapters/out/envloader/file_test\.go$''',
	28	+	]
	29	+	regexes = [
	30	+	'''short-lived-123''',
	31	+	'''YXBpLnN1Yi5leGFtcGxlLmNvbQ\.env''',
	32	+	]

M Dockerfile +5 -6

 # Multi-stage build for optimized container image
 # Build stage
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26.1-alpine3.22 AS builder
 # Install build dependencies
 RUN apk add --no-cache git ca-certificates tzdata
     -o gordon .
 # Runtime stage
-FROM alpine:latest
+FROM alpine:3.22
 # Install runtime dependencies
 RUN apk add --no-cache \
 USER gordon
 # Expose ports
-EXPOSE 8080 5000
+EXPOSE 8088 5000
-# Health check
+# Admin health is served on the registry/admin listener and is gated by auth in
-HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
+# normal deployments, so this image does not declare a Docker healthcheck.
-    CMD wget --quiet --tries=1 --spider http://localhost:8080/health || exit 1
 # Default command
 CMD ["./gordon", "serve"]

M docs/cli/auth.md +2 -1


@@ -139,7 +139,7 @@ Standard Go durations also work: `24h`, `30m`, `1h30m`
139			139
140		Registry scopes: `push`, `pull`, `push,pull`	140		Registry scopes: `push`, `pull`, `push,pull`
141			141
142	-	Admin scopes: `admin::`, `admin:routes:read`, `admin:routes:write`, `admin:config:read`, `admin:config:write`, `admin:status:read`, `admin:secrets:read`, `admin:secrets:write`	142	+	Admin scopes: `admin::`, `admin:routes:read`, `admin:routes:write`, `admin:config:read`, `admin:config:write`, `admin:status:read`, `admin:logs:read`, `admin:volumes:read`, `admin:volumes:write`, `admin:secrets:read`, `admin:secrets:write`
143			143
144		Combine scopes with commas:	144		Combine scopes with commas:
145			145

@@ -280,6 +280,7 @@ Usage:
280		\| `admin:config:read` \| Read-only config access \|	280		\| `admin:config:read` \| Read-only config access \|
281		\| `admin:config:write` \| Config write access \|	281		\| `admin:config:write` \| Config write access \|
282		\| `admin:status:read` \| Read-only status/health \|	282		\| `admin:status:read` \| Read-only status/health \|
			283	+	\| `admin:logs:read` \| Read-only logs access \|
283		\| `admin:secrets:read` \| List secret keys \|	284		\| `admin:secrets:read` \| List secret keys \|
284		\| `admin:secrets:write` \| Set/delete secrets \|	285		\| `admin:secrets:write` \| Set/delete secrets \|
285			286

M docs/cli/config.md +8 -7

 ## gordon config show
-Display the full Gordon server configuration including server settings,
+Display the Gordon server configuration including server settings,
-auto-route, network isolation, routes, and external routes.
+auto-route, network isolation, routes, and external route domains. Sensitive filesystem paths and upstream external route targets are redacted by default.
 ```bash
 gordon config show
   "server": {
     "port": 1111,
     "registry_port": 5000,
-    "registry_domain": "reg.example.com",
+    "registry_domain": "reg.example.com"
-    "data_dir": "/var/lib/gordon"
   },
   "auto_route": {
     "enabled": true,
   "routes": [
     {"domain": "app.example.com", "image": "myapp:latest"}
   ],
-  "external_routes": {
+  "external_routes": [
-    "reg.example.com": "localhost:5000"
+    {"domain": "reg.example.com"}
-  }
+  ]
 }
 ```
+External route targets and `server.data_dir` are intentionally omitted from the default admin config response because they reveal internal network and filesystem layout.
 ### Auto-Route Allowed Domains
 The `auto_route.allowed_domains` field lists domain patterns that auto-route may assign to containers. Manage this list with [`gordon autoroute allow`](./autoroute.md).

M docs/cli/serve.md +2 -0


@@ -235,6 +235,8 @@ gordon logs [domain] [options]
235	Remote targeting uses client config or an active remote by default.	235		Remote targeting uses client config or an active remote by default.
236	Use `--remote` and `--token` to override. See [CLI Overview](./index.md).	236		Use `--remote` and `--token` to override. See [CLI Overview](./index.md).
237		237
		238	+	Remote log access requires an admin token with `admin:logs:read` (or `admin::`). `admin:status:read` is not sufficient for logs.
		239	+
238	### Examples	240		### Examples
239		241
240	```bash	242		```bash

M docs/config/auth.md +3 -0


@@ -92,6 +92,9 @@ Admin scopes (for remote CLI):
92	\| `admin:config:read` \| Read-only config access \|	92		\| `admin:config:read` \| Read-only config access \|
93	\| `admin:config:write` \| Config write access \|	93		\| `admin:config:write` \| Config write access \|
94	\| `admin:status:read` \| Read-only status/health \|	94		\| `admin:status:read` \| Read-only status/health \|
		95	+	\| `admin:logs:read` \| Read-only logs access \|
		96	+	\| `admin:volumes:read` \| List Docker volumes \|
		97	+	\| `admin:volumes:write` \| Prune eligible Gordon-managed volumes \|
95	\| `admin:secrets:read` \| List secret keys \|	98		\| `admin:secrets:read` \| List secret keys \|
96	\| `admin:secrets:write` \| Set/delete secrets \|	99		\| `admin:secrets:write` \| Set/delete secrets \|
97		100

M docs/config/deploy.md +12 -0


@@ -98,6 +98,18 @@ container shutdown.
98		98
99	Default: `"30s"`	99		Default: `"30s"`
100		100
		101	+	## Container security profile
		102	+
		103	+	Runtime hardening is configured under `[containers]`:
		104	+
		105	+	```toml
		106	+	[containers]
		107	+	security_profile = "compat" # "compat" or "strict"
		108	+	```
		109	+
		110	+	- `compat` is the default and preserves existing image compatibility while keeping `no-new-privileges` and capability drop/add defaults.
		111	+	- `strict` enables a read-only root filesystem, drops all capabilities, and only adds `NET_BIND_SERVICE`. Images that write outside mounted volumes or need extra Linux capabilities may require changes before using this profile.
		112	+
101	## Notes	113		## Notes
102		114
103	- Changes to `deploy.pull_policy` require a restart to take effect.	115		- Changes to `deploy.pull_policy` require a restart to take effect.

M docs/config/images.md +6 -0


@@ -16,6 +16,10 @@ The CLI `gordon images prune` uses the same defaults as the scheduled job (keep
16	## Configuration	16		## Configuration
17		17
18	```toml	18		```toml
		19	+	[images]
		20	+	allowed_registries = []
		21	+	require_digest = false
		22	+
19	[images.prune]	23		[images.prune]
20	enabled = false	24		enabled = false
21	schedule = "daily"	25		schedule = "daily"

@@ -26,6 +30,8 @@ keep_last = 3
26		30
27	\| Key \| Type \| Default \| Description \|	31		\| Key \| Type \| Default \| Description \|
28	\|-----\|------\|---------\|-------------\|	32		\|-----\|------\|---------\|-------------\|
		33	+	\| `images.allowed_registries` \| array \| `[]` \| Allowlist for external image registries. Empty means no external registries are accepted. Unqualified image names such as `nginx:latest` are treated as Docker Hub (`docker.io`) for policy checks. Gordon always allows its configured registry and rejects localhost/private/link-local registries. Include ports when needed, e.g. `"registry.example.com:5000"`. \|
		34	+	\| `images.require_digest` \| bool \| `false` \| Require allowlisted external image references to use a valid `@sha256:<64 hex chars>` digest. Gordon registry images are exempt. \|
29	\| `images.prune.enabled` \| bool \| `false` \| Enables scheduled image cleanup \|	35		\| `images.prune.enabled` \| bool \| `false` \| Enables scheduled image cleanup \|
30	\| `images.prune.schedule` \| string \| `"daily"` \| Schedule preset: `hourly`, `daily`, `weekly`, `monthly` \|	36		\| `images.prune.schedule` \| string \| `"daily"` \| Schedule preset: `hourly`, `daily`, `weekly`, `monthly` \|
31	\| `images.prune.keep_last` \| int \| `3` \| Number of newest non-`latest` tags kept per repository during registry cleanup (`latest` is always kept when present) \|	37		\| `images.prune.keep_last` \| int \| `3` \| Number of newest non-`latest` tags kept per repository during registry cleanup (`latest` is always kept when present) \|

M docs/config/index.md +18 -1

 drain_timeout = "30s"                    # Max wait for in-flight drain
 drain_delay = "2s"                       # Wait after proxy invalidation before stopping the old container
+# Container runtime profile
+[containers]
+security_profile = "compat"              # compat or strict
 # Logging
 [logging]
 level = "info"                           # trace, debug, info, warn, error
 [network_isolation]
 enabled = true                           # Per-app isolated networks
 network_prefix = "gordon"                # Network name prefix
+internal = false                          # Set true to block direct egress from isolated networks
 # Auto-route
 [auto_route]
 monthly = 12
 # Images
+[images]
+allowed_registries = []                   # Explicit external registries allowed for deploy/attachments
+require_digest = false                    # Require digests for allowlisted external registries
 [images.prune]
 enabled = false
 schedule = "daily"
 | `[attachments]` | Service dependencies | [Attachments](./attachments.md) |
 | `[backups]` | Database backups | [Backups](./backups.md) |
 | `[images.prune]` | Scheduled image cleanup | [Images](./images.md) |
+| Security hardening | Security controls and recommended knobs | [Security Hardening](./security-hardening.md) |
 ## Default Values
 | `server.port` | `8088` |
 | `server.registry_port` | `5000` |
 | `server.data_dir` | `~/.gordon` |
+| `server.max_blob_chunk_size` | `"95MB"` |
+| `server.max_blob_size` | `"1GB"` |
 | `auth.enabled` | `true` |
 | `auth.secrets_backend` | `"unsafe"` |
 | `auth.token_expiry` | `"30d"` |
 | `deploy.drain_mode` | `"auto"` |
 | `deploy.drain_timeout` | `"30s"` |
 | `deploy.drain_delay` | `"2s"` |
+| `containers.security_profile` | `"compat"` |
 | `logging.level` | `"info"` |
 | `logging.format` | `"console"` |
 | `logging.file.enabled` | `false` |
 | `volumes.prefix` | `"gordon"` |
 | `volumes.preserve` | `true` |
 | `network_isolation.enabled` | `true` |
+| `network_isolation.internal` | `false` |
 | `auto_route.enabled` | `false` |
 | `backups.enabled` | `false` |
 | `backups.schedule` | `"daily"` (`"hourly"`, `"daily"`, `"weekly"`, `"monthly"`) |
+| `images.allowed_registries` | `[]` |
+| `images.require_digest` | `false` |
 | `images.prune.enabled` | `false` |
 | `images.prune.schedule` | `"daily"` |
 | `images.prune.keep_last` | `3` |
 | `server.gordon_domain` (registry domain) |
 | `server.registry_port` |
 | `server.max_proxy_body_size` |
-| `server.max_blob_chunk_size` |
 | `server.max_proxy_response_size` |
 | `server.max_concurrent_conns` |
 |---------|
 | `server.port` |
 | `server.data_dir` |
+| `server.max_blob_chunk_size` |
+| `server.max_blob_size` |
 | `auth.*` |
 | `deploy.readiness_mode` |
 | `deploy.readiness_delay` |

M docs/config/network-isolation.md +2 -0


@@ -8,6 +8,7 @@ Isolate applications in separate Docker networks for enhanced security.
8	[network_isolation]	8		[network_isolation]
9	enabled = true	9		enabled = true
10	network_prefix = "gordon"	10		network_prefix = "gordon"
		11	+	internal = false
11	```	12		```
12		13
13	## Migration Note	14		## Migration Note

@@ -26,6 +27,7 @@ enabled = false
26	\|--------\|------\|---------\|-------------\|	27		\|--------\|------\|---------\|-------------\|
27	\| `enabled` \| bool \| `true` \| Enable per-app network isolation (changed from `false`) \|	28		\| `enabled` \| bool \| `true` \| Enable per-app network isolation (changed from `false`) \|
28	\| `network_prefix` \| string \| `"gordon"` \| Prefix for created networks \|	29		\| `network_prefix` \| string \| `"gordon"` \| Prefix for created networks \|
		30	+	\| `internal` \| bool \| `false` \| Create isolated Docker networks with Docker's `Internal` flag, blocking direct external egress from containers on those networks. Default remains `false` for compatibility. \|
29		31
30	## How It Works	32		## How It Works
31		33

M docs/config/reference.md +19 -2

 force_https_redirect = false                 # Redirect all HTTP traffic to HTTPS (for direct-access setups)
 gordon_domain = ""                           # Required: Gordon domain (registry + API)
 data_dir = "~/.gordon"                       # Data directory (varies by install type)
-max_blob_chunk_size = "512MB"                # Max size per registry blob upload chunk
+max_blob_chunk_size = "95MB"                 # Max size per registry blob upload chunk
+max_blob_size = "1GB"                        # Max cumulative size per registry blob/layer upload
 registry_allowed_ips = []                    # IPs or CIDR ranges allowed to access the registry (empty = allow all)
 proxy_allowed_ips = []                       # IPs or CIDR ranges allowed to reach the proxy (empty = allow all, e.g. Cloudflare IPs)
 registry_listen_address = ""                 # Bind address for registry (empty = all interfaces, "127.0.0.1" = loopback only)
 drain_timeout = "30s"                        # Max wait for in-flight request drain
 drain_delay = "2s"                           # Wait after cache invalidation before old stop
+# =============================================================================
+# CONTAINERS
+# =============================================================================
+[containers]
+security_profile = "compat"                  # "compat" or "strict"
 # =============================================================================
 # AUTO-ROUTE
 # =============================================================================
 [network_isolation]
 enabled = true                               # Enable per-app Docker networks
 network_prefix = "gordon"                    # Prefix for created networks
+internal = false                             # Create Docker internal networks (blocks direct egress)
 # =============================================================================
 # VOLUMES
 # =============================================================================
 # IMAGES
 # =============================================================================
+[images]
+allowed_registries = []
+require_digest = false
 [images.prune]
 enabled = false                              # Enable scheduled image cleanup
 schedule = "daily"                          # "hourly", "daily", "weekly", "monthly"
 | `server.force_https_redirect` | `false` | Redirect all HTTP to HTTPS (for direct-access setups) |
 | `server.gordon_domain` | `""` | **Required** - Gordon domain |
 | `server.data_dir` | `~/.gordon` | Data directory |
-| `server.max_blob_chunk_size` | `"512MB"` | Max size per registry blob upload chunk |
+| `server.max_blob_chunk_size` | `"95MB"` | Max size per registry blob upload chunk |
+| `server.max_blob_size` | `"1GB"` | Max cumulative size per registry blob/layer upload |
 | `server.registry_allowed_ips` | `[]` | IPs or CIDR ranges allowed to access the registry (empty = allow all) |
 | `server.proxy_allowed_ips` | `[]` | IPs or CIDR ranges allowed to reach the proxy (empty = allow all) |
 | `server.registry_listen_address` | `""` | Bind address for registry (empty = all interfaces) |
 | `deploy.drain_mode` | `"auto"` | Drain strategy (`auto`, `inflight`, `delay`) |
 | `deploy.drain_timeout` | `"30s"` | Max wait for in-flight request drain before old stop |
 | `deploy.drain_delay` | `"2s"` | Delay before stopping previous container after cache invalidation |
+| `containers.security_profile` | `"compat"` | Runtime hardening profile: `compat` preserves existing behavior, `strict` enables read-only rootfs and narrower capabilities |
 | `auto_route.enabled` | `false` | Auto-route disabled |
 | `network_isolation.enabled` | `true` | Network isolation enabled |
 | `network_isolation.network_prefix` | `"gordon"` | Network prefix |
+| `network_isolation.internal` | `false` | Create Docker internal networks without direct external egress |
 | `volumes.auto_create` | `true` | Auto-create volumes |
 | `volumes.prefix` | `"gordon"` | Volume prefix |
 | `volumes.preserve` | `true` | Keep volumes |
 | `backups.retention.daily` | `0` | Keep no daily backups by default (recommend `7`) |
 | `backups.retention.weekly` | `0` | Keep no weekly backups by default |
 | `backups.retention.monthly` | `0` | Keep no monthly backups by default |
+| `images.allowed_registries` | `[]` | Explicit external registry allowlist; empty rejects explicit external registries; dangerous local/private registries are always rejected |
+| `images.require_digest` | `false` | Require digest-pinned references for allowlisted external registries |
 | `images.prune.enabled` | `false` | Scheduled image cleanup disabled |
 | `images.prune.schedule` | `"daily"` | Cleanup schedule preset |
 | `images.prune.keep_last` | `3` | Number of recent tags kept per repository |

A docs/config/security-hardening.md +90 -0

@@ -0,0 +1,90 @@
	1	+	# Security Hardening Controls
	2	+
	3	+	This page summarizes Gordon's security-related configuration knobs and the defaults operators should know before exposing an instance.
	4	+
	5	+	## Registry upload quotas
	6	+
	7	+	Registry blob uploads are bounded by two limits under `[server]`:
	8	+
	9	+	```toml
	10	+	[server]
	11	+	max_blob_chunk_size = "95MB"
	12	+	max_blob_size = "1GB"
	13	+	```
	14	+
	15	+	- `max_blob_chunk_size` limits a single upload chunk.
	16	+	- `max_blob_size` limits the cumulative blob/layer upload size.
	17	+	- Exceeding either limit returns an OCI-compatible size error and the failed upload is cleaned up.
	18	+
	19	+	## Admin logs permission
	20	+
	21	+	Container and deploy logs can include environment-derived output. Gordon gates log access behind a dedicated scope:
	22	+
	23	+	```bash
	24	+	gordon auth token generate --subject ops --scopes "admin:logs:read" --expiry 30d
	25	+	```
	26	+
	27	+	- `/admin/logs` and deploy failure logs require `admin:logs:read`.
	28	+	- `admin:status:read` does not grant log access.
	29	+	- Common secret patterns are redacted before logs are returned.
	30	+
	31	+	## Volume pruning scope
	32	+
	33	+	Volume pruning only removes unused Docker volumes explicitly managed by Gordon (`gordon.managed=true`). It ignores unrelated Docker volumes even if they are unused.
	34	+
	35	+	Use dedicated admin scopes:
	36	+
	37	+	- `admin:volumes:read` for listing volumes.
	38	+	- `admin:volumes:write` for prune operations.
	39	+
	40	+	## Pass migration plaintext handling
	41	+
	42	+	When Gordon migrates legacy plaintext `.env` files into `pass`, it removes the plaintext source after a successful migration and does not leave `.env.migrated` copies by default. If pass entries already exist, migration fails closed and leaves the plaintext file in place for manual operator review rather than deleting potentially unique values.
	43	+
	44	+	## External image registries
	45	+
	46	+	Gordon's configured registry is always allowed. Explicit external registries must be allowlisted:
	47	+
	48	+	```toml
	49	+	[images]
	50	+	allowed_registries = ["docker.io", "ghcr.io", "registry.example.com:5000"]
	51	+	require_digest = true
	52	+	```
	53	+
	54	+	- Empty `allowed_registries` rejects explicit external registries.
	55	+	- `localhost`, loopback, private, link-local, unspecified, and metadata-style registries are rejected.
	56	+	- `require_digest = true` requires allowlisted external images to use `@sha256:<64 hex chars>`.
	57	+	- Include ports in allowlist entries when the registry uses a non-default port.
	58	+
	59	+	## Docker network isolation
	60	+
	61	+	Per-app Docker networks are enabled by default. To block direct external egress from isolated networks, opt into Docker internal networks:
	62	+
	63	+	```toml
	64	+	[network_isolation]
	65	+	enabled = true
	66	+	internal = true
	67	+	```
	68	+
	69	+	`internal = false` remains the compatibility default because some applications and attachments need direct egress during startup.
	70	+
	71	+	## Container runtime profile
	72	+
	73	+	```toml
	74	+	[containers]
	75	+	security_profile = "compat" # or "strict"
	76	+	```
	77	+
	78	+	- `compat` preserves broad image compatibility while retaining `no-new-privileges` and default capability restrictions.
	79	+	- `strict` enables a read-only root filesystem, drops all capabilities, and only adds `NET_BIND_SERVICE`.
	80	+
	81	+	Use `strict` for images designed to write only to mounted volumes and run without extra Linux capabilities.
	82	+
	83	+	## Related
	84	+
	85	+	- [Auth](./auth.md)
	86	+	- [Images](./images.md)
	87	+	- [Network Isolation](./network-isolation.md)
	88	+	- [Deploy](./deploy.md)
	89	+	- [Volumes](./volumes.md)
	90	+	- [Reference](./reference.md)

M docs/config/server.md +19 -0


@@ -14,6 +14,8 @@ tls_port = 8443 # HTTPS listener port (0 = disabled)
14	# force_https_redirect = false # Redirect all HTTP traffic to HTTPS	14		# force_https_redirect = false # Redirect all HTTP traffic to HTTPS
15	gordon_domain = "gordon.mydomain.com" # Gordon domain (required)	15		gordon_domain = "gordon.mydomain.com" # Gordon domain (required)
16	# data_dir = "~/.gordon" # Data storage directory (default)	16		# data_dir = "~/.gordon" # Data storage directory (default)
		17	+	max_blob_chunk_size = "95MB" # Max registry blob upload chunk
		18	+	max_blob_size = "1GB" # Max cumulative registry blob/layer upload
17	```	19		```
18		20
19	## Options	21		## Options

@@ -31,6 +33,7 @@ gordon_domain = "gordon.mydomain.com" # Gordon domain (required)
31	\| `data_dir` \| string \| `~/.gordon` \| Directory for registry data, logs, and env files \|	33		\| `data_dir` \| string \| `~/.gordon` \| Directory for registry data, logs, and env files \|
32	\| `max_proxy_body_size` \| string \| `"512MB"` \| Maximum request body size for proxied requests \|	34		\| `max_proxy_body_size` \| string \| `"512MB"` \| Maximum request body size for proxied requests \|
33	\| `max_blob_chunk_size` \| string \| `"95MB"` \| Maximum request body size for a single registry blob upload chunk \|	35		\| `max_blob_chunk_size` \| string \| `"95MB"` \| Maximum request body size for a single registry blob upload chunk \|
		36	+	\| `max_blob_size` \| string \| `"1GB"` \| Maximum cumulative size for one registry blob/layer upload \|
34	\| `registry_allowed_ips` \| []string \| `[]` \| IPs or CIDR ranges allowed to access the registry (empty = allow all) \|	37		\| `registry_allowed_ips` \| []string \| `[]` \| IPs or CIDR ranges allowed to access the registry (empty = allow all) \|
35	\| `proxy_allowed_ips` \| []string \| `[]` \| IPs or CIDR ranges allowed to reach the proxy (empty = allow all) \|	38		\| `proxy_allowed_ips` \| []string \| `[]` \| IPs or CIDR ranges allowed to reach the proxy (empty = allow all) \|
36	\| `registry_listen_address` \| string \| `""` \| Bind address for registry (empty = all interfaces) \|	39		\| `registry_listen_address` \| string \| `""` \| Bind address for registry (empty = all interfaces) \|

@@ -274,6 +277,22 @@ max_blob_chunk_size = "1GB" # Allow larger layers
274	- Keep this below Cloudflare's 100MB per-request limit when operating behind Cloudflare; the default (`95MB`) is fine	277		- Keep this below Cloudflare's 100MB per-request limit when operating behind Cloudflare; the default (`95MB`) is fine
275	- Increase it only if you expect larger direct registry uploads from other clients	278		- Increase it only if you expect larger direct registry uploads from other clients
276		279
		280	+	## Maximum Registry Blob Size
		281	+
		282	+	The `max_blob_size` setting limits the cumulative size of one blob/layer upload across all chunks:
		283	+
		284	+	```toml
		285	+	[server]
		286	+	max_blob_size = "1GB" # Default
		287	+	```
		288	+
		289	+	Purpose: Prevents disk exhaustion from multi-chunk uploads where each individual chunk is below `max_blob_chunk_size` but the total blob grows without bound.
		290	+
		291	+	Behavior:
		292	+	- Gordon tracks the current upload size and rejects appends that would exceed the limit.
		293	+	- Rejected uploads return an OCI-compatible `413` size error.
		294	+	- Failed uploads are cleaned up so temporary blob data does not accumulate indefinitely.
		295	+
277	## Registry IP Allowlist	296		## Registry IP Allowlist
278		297
279	The `registry_allowed_ips` setting restricts registry access to specific IPs or IP ranges. Accepts both CIDR notation (`100.64.0.0/10`) and individual IPs (`203.0.113.50`). When set, only requests from listed addresses (plus localhost) can reach registry and auth endpoints. An empty list allows all traffic (default).	298		The `registry_allowed_ips` setting restricts registry access to specific IPs or IP ranges. Accepts both CIDR notation (`100.64.0.0/10`) and individual IPs (`203.0.113.50`). When set, only requests from listed addresses (plus localhost) can reach registry and auth endpoints. An empty list allows all traffic (default).

A docs/security-hardening-regression-matrix.md +222 -0

@@ -0,0 +1,222 @@
	1	+	# Security Hardening Regression Matrix
	2	+
	3	+	This matrix lists the behaviors that should be tested while implementing the security-hardening fixes from the audit. It is intentionally focused on regressions: normal Gordon workflows must continue to work while exploit paths are blocked.
	4	+
	5	+	## Registry uploads
	6	+
	7	+	### Normal behavior to preserve
	8	+	- Docker push of a small image succeeds.
	9	+	- Docker push with multiple layers succeeds when every layer is below the configured cumulative blob limit.
	10	+	- Chunked blob upload succeeds when the cumulative size remains below the new cumulative limit setting, tentatively named `max_blob_size` unless implementation chooses a clearer config name.
	11	+	- A final `PUT` with a valid digest finalizes the blob and returns OCI-compatible headers.
	12	+	- Existing `max_blob_chunk_size` behavior still rejects a single oversized chunk; this remains distinct from the cumulative per-blob/layer limit.
	13	+
	14	+	### Security behavior to verify
	15	+	- Repeated `PATCH` chunks cannot exceed the cumulative upload limit.
	16	+	- `Content-Length` larger than the remaining allowed size is rejected before writing when possible.
	17	+	- A rejected upload does not leave unbounded stale data on disk.
	18	+	- Cancel/cleanup paths remove upload temp files and upload locks.
	19	+	- Error response remains Docker Registry compatible (`413` / `SIZE_INVALID`).
	20	+
	21	+	### Suggested tests
	22	+	- Unit tests for filesystem blob append under and over cumulative size.
	23	+	- Handler tests for `PATCH` and final `PUT` over limit.
	24	+	- Integration/manual: push image with a large layer and confirm failure is clean.
	25	+
	26	+	## Deploy errors and logs
	27	+
	28	+	### Normal behavior to preserve
	29	+	- Successful deploy response still includes status, domain, and container ID.
	30	+	- Failed deploy still returns useful high-level error/cause/hint.
	31	+	- Operators with the new logs permission can still retrieve logs through `/admin/logs`.
	32	+	- CLI deploy displays helpful failure information without leaking raw secrets.
	33	+
	34	+	### Security behavior to verify
	35	+	- A token with only `admin:config:write` cannot receive raw container logs in `/admin/deploy` error responses.
	36	+	- Logs returned through log endpoints are redacted for common secret patterns.
	37	+	- `admin:status:read` no longer grants log read access.
	38	+	- `admin::` remains compatible and can access logs.
	39	+
	40	+	### Suggested tests
	41	+	- Handler tests for deploy error response with and without `logs:read`.
	42	+	- Scope tests for `logs:read`, wildcard, and old `status:read` behavior.
	43	+	- Redactor table tests for `PASSWORD=`, `TOKEN=`, `SECRET=`, `API_KEY=`, `DATABASE_URL=`, and simple JSON fields.
	44	+
	45	+	## Admin scopes and compatibility
	46	+
	47	+	### Normal behavior to preserve
	48	+	- Existing `admin::` tokens continue to work everywhere.
	49	+	- Existing `routes`, `config`, `secrets`, and `status` scopes keep their intended behavior.
	50	+	- Token exchange through `/auth/token` still works for admin scopes.
	51	+
	52	+	### Security behavior to verify
	53	+	- New sensitive resources such as `logs` and possibly `volumes` are parsed and enforced.
	54	+	- Unknown or malformed scopes remain ignored/denied, not accidentally allowed.
	55	+
	56	+	### Suggested tests
	57	+	- Domain auth scope parsing tests.
	58	+	- Admin middleware/handler tests for each sensitive endpoint.
	59	+
	60	+	## Auto-route env-file extraction
	61	+
	62	+	### Normal behavior to preserve
	63	+	- Valid `gordon.env-file` imports default env values for a newly created auto-route.
	64	+	- Existing env values still override image-provided defaults.
	65	+	- Secret reference rejection remains intact.
	66	+	- Auto-route without env-file remains unchanged.
	67	+
	68	+	### Security behavior to verify
	69	+	- Oversized env files are rejected before full memory read.
	70	+	- Disallowed paths (`/proc`, `/sys`, `/dev`, `/run`, `/var/run`, `/`, traversal) are rejected.
	71	+	- Failed env-file import does not prevent route/deploy behavior beyond the intended warning path unless explicitly designed.
	72	+
	73	+	### Suggested tests
	74	+	- Runtime extraction tests using a controlled reader larger than the limit.
	75	+	- Auto-route usecase tests for allowed/disallowed paths.
	76	+	- Tests confirming `${pass:...}` / `${sops:...}` refs remain rejected.
	77	+
	78	+	## Domain canonicalization and proxy routing
	79	+
	80	+	### Normal behavior to preserve
	81	+	- Existing lowercase route domains continue to resolve.
	82	+	- Registry domain still routes to registry.
	83	+	- External routes still resolve and retain SSRF protections.
	84	+	- Hostnames with expected public domains work through proxy.
	85	+
	86	+	### Security behavior to verify
	87	+	- `App.Example.com` and `app.example.com` map to the same canonical route.
	88	+	- Duplicate case-variant routes cannot be created.
	89	+	- Host with invalid port/trailing dot/case is handled consistently.
	90	+	- HTTP-to-HTTPS redirect does not reflect arbitrary unconfigured Host values.
	91	+
	92	+	### Suggested tests
	93	+	- Config service tests for add/update/list canonical route domains.
	94	+	- Auto-route tests for case variants.
	95	+	- Proxy handler tests for Host normalization.
	96	+	- Middleware tests for redirect target host validation.
	97	+
	98	+	## Volumes
	99	+
	100	+	### Normal behavior to preserve
	101	+	- Listing volumes still shows Gordon-managed volumes.
	102	+	- Dry-run prune still reports what would be removed.
	103	+	- Actual prune still removes unused Gordon-managed volumes.
	104	+	- In-use Gordon volumes are not removed.
	105	+
	106	+	### Security behavior to verify
	107	+	- Unused non-Gordon Docker volumes are not removed.
	108	+	- Volumes without explicit Gordon ownership metadata, preferably `gordon.managed=true`, are ignored; prefix-only matching is unsafe except as a constrained legacy fallback with dedicated tests.
	109	+	- Any new `volumes:read/write` scope is enforced correctly.
	110	+
	111	+	### Suggested tests
	112	+	- Volume service tests with mixed Gordon/non-Gordon, used/unused volumes.
	113	+	- Admin handler tests for permissions.
	114	+	- Manual: create an unrelated Docker volume, run Gordon prune dry-run/real, confirm it remains.
	115	+
	116	+	## Backups
	117	+
	118	+	### Normal behavior to preserve
	119	+	- Manual backup completes and appears in list.
	120	+	- Scheduled backup path format remains readable/listable.
	121	+	- Backup detect still finds supported DB attachments.
	122	+	- Existing backups can still be listed after filename format changes.
	123	+
	124	+	### Security behavior to verify
	125	+	- Two backups for same domain/db/schedule in the same second do not share tmp/final filenames.
	126	+	- Concurrent backups do not truncate each other.
	127	+	- Store uses unique tmp files and atomic rename.
	128	+	- Path traversal protections remain intact.
	129	+
	130	+	### Suggested tests
	131	+	- Filesystem storage tests with identical timestamps.
	132	+	- Concurrent store test with two readers and same domain/db/schedule.
	133	+	- List tests for old and new filename formats if compatibility is needed.
	134	+
	135	+	## Secrets and pass migration
	136	+
	137	+	### Normal behavior to preserve
	138	+	- `pass` backend still migrates existing env keys correctly.
	139	+	- Attachment env migration still works.
	140	+	- Unsafe backend still loads valid files under `dataDir/secrets` for development.
	141	+	- Existing env file parsing remains compatible.
	142	+
	143	+	### Security behavior to verify
	144	+	- Unsafe backend rejects `../` and absolute `auth.token_secret` paths.
	145	+	- Migration does not leave plaintext `.env.migrated` by default.
	146	+	- If an explicit keep/quarantine option exists, files are stored with restrictive permissions and loud warnings.
	147	+
	148	+	### Suggested tests
	149	+	- `loadSecret` path traversal tests.
	150	+	- Migration tests verifying plaintext source file removal/quarantine.
	151	+	- Permission tests where practical (`0600` files, `0700` dirs).
	152	+
	153	+	## Config snapshot
	154	+
	155	+	### Normal behavior to preserve
	156	+	- `/admin/config` still returns enough information for CLI/admin use.
	157	+	- Routes and network isolation status remain visible to authorized callers.
	158	+
	159	+	### Security behavior to verify
	160	+	- `data_dir` is hidden by default or only available under a deliberately stronger detailed mode.
	161	+	- External route targets are hidden/redacted by default or gated.
	162	+	- `config:read` behavior remains documented.
	163	+
	164	+	### Suggested tests
	165	+	- Admin config response tests for default and detailed modes.
	166	+	- CLI remote config tests if output shape changes.
	167	+
	168	+	## External image registries
	169	+
	170	+	### Normal behavior to preserve
	171	+	- Images in the Gordon registry deploy normally.
	172	+	- Explicitly allowlisted external registries deploy if configured.
	173	+	- Attachments still deploy from allowed sources.
	174	+
	175	+	### Security behavior to verify
	176	+	- `localhost`, loopback, private IP, link-local, metadata IP, and DNS resolving to private ranges are rejected unless a deliberate unsafe override exists.
	177	+	- Non-allowlisted external registries are rejected before Docker pull.
	178	+	- Error messages do not leak sensitive network details.
	179	+
	180	+	### Suggested tests
	181	+	- Image reference validation table tests.
	182	+	- Config tests for `allowed_registries`.
	183	+	- Container service tests ensuring rejected images do not call `PullImage`.
	184	+
	185	+	## Docker networks and runtime hardening
	186	+
	187	+	### Normal behavior to preserve
	188	+	- Default/compat profile keeps common apps and attachments working.
	189	+	- Attachments remain reachable by service alias where intended.
	190	+	- Network groups still work when configured.
	191	+
	192	+	### Security behavior to verify
	193	+	- `internal` network option is applied when configured.
	194	+	- Strict profile applies readonly rootfs/user/caps as designed.
	195	+	- `no-new-privileges:true` and cap dropping are preserved.
	196	+	- Compat profile behavior is documented and tested.
	197	+
	198	+	### Suggested tests
	199	+	- Docker adapter config construction tests.
	200	+	- Container service tests for network option propagation.
	201	+	- Manual smoke: deploy app + postgres attachment in compat profile.
	202	+	- Manual smoke: deploy simple read-only app in strict profile.
	203	+
	204	+	## Install, Dockerfile, and supply-chain
	205	+
	206	+	### Normal behavior to preserve
	207	+	- `install.sh` installs the binary on Linux/macOS.
	208	+	- GitHub composite action installs Gordon in CI.
	209	+	- Dockerfile builds successfully.
	210	+
	211	+	### Security behavior to verify
	212	+	- Tar extraction only extracts `gordon`.
	213	+	- Installed binary must be a regular file, not symlink/directory.
	214	+	- Permissions are explicit (`0755`).
	215	+	- Checksums/signatures are verified consistently.
	216	+	- Gitleaks output is clean or only contains allowlisted examples.
	217	+
	218	+	### Suggested tests
	219	+	- Shellcheck/manual review for install script.
	220	+	- Action script dry-run if practical.
	221	+	- Docker build smoke after version alignment.
	222	+	- Gitleaks on `git archive HEAD`, not local `.worktrees`.

M go.mod +1 -1


@@ -110,7 +110,7 @@ require (
110		go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0	110		go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0
111		go.opentelemetry.io/otel/metric v1.43.0	111		go.opentelemetry.io/otel/metric v1.43.0
112		go.opentelemetry.io/otel/trace v1.43.0	112		go.opentelemetry.io/otel/trace v1.43.0
113	-	golang.org/x/sys v0.43.0 // indirect	113	+	golang.org/x/sys v0.43.0
114		golang.org/x/text v0.35.0 // indirect	114		golang.org/x/text v0.35.0 // indirect
115		gopkg.in/yaml.v3 v3.0.1 // indirect	115		gopkg.in/yaml.v3 v3.0.1 // indirect
116		gotest.tools/v3 v3.5.2 // indirect	116		gotest.tools/v3 v3.5.2 // indirect

A gordon.toml.example +94 -0

@@ -0,0 +1,94 @@
	1	+	# Gordon example configuration
	2	+	# Copy this file to ~/.config/gordon/gordon.toml and adjust for your domain.
	3	+
	4	+	[server]
	5	+	port = 8088
	6	+	registry_port = 5000
	7	+	gordon_domain = "gordon.example.com"
	8	+	# data_dir = "~/.gordon"
	9	+
	10	+	[auth]
	11	+	enabled = true
	12	+	# Use "pass" or "sops" in production. The unsafe backend reads a local file
	13	+	# under server.data_dir/secrets and is intended for development only.
	14	+	secrets_backend = "pass"
	15	+	token_secret = "gordon/auth/token_secret"
	16	+	token_expiry = "30d"
	17	+	access_token_ttl = "15m"
	18	+
	19	+	[api.rate_limit]
	20	+	enabled = true
	21	+	global_rps = 500
	22	+	per_ip_rps = 50
	23	+	burst = 100
	24	+	trusted_proxies = []
	25	+
	26	+	[deploy]
	27	+	pull_policy = "if-tag-changed"
	28	+	readiness_mode = "auto"
	29	+	health_timeout = "90s"
	30	+	readiness_delay = "5s"
	31	+	drain_mode = "auto"
	32	+	drain_timeout = "30s"
	33	+	drain_delay = "2s"
	34	+
	35	+	[containers]
	36	+	# "compat" preserves broad image compatibility. "strict" enables a read-only
	37	+	# root filesystem and narrower Linux capabilities.
	38	+	security_profile = "compat"
	39	+
	40	+	[network_isolation]
	41	+	enabled = true
	42	+	network_prefix = "gordon"
	43	+	# Set true to create Docker internal networks without direct external egress.
	44	+	internal = false
	45	+
	46	+	[volumes]
	47	+	auto_create = true
	48	+	prefix = "gordon"
	49	+	preserve = true
	50	+
	51	+	[images]
	52	+	# Explicit external registries must be listed here. Gordon's own registry is
	53	+	# always allowed; localhost/private/link-local registries are always rejected.
	54	+	allowed_registries = []
	55	+	# Require @sha256:<digest> for allowlisted external registries.
	56	+	require_digest = false
	57	+
	58	+	[images.prune]
	59	+	enabled = false
	60	+	schedule = "daily"
	61	+	keep_last = 3
	62	+
	63	+	[auto_route]
	64	+	enabled = false
	65	+
	66	+	[logging]
	67	+	level = "info"
	68	+	format = "console"
	69	+
	70	+	[logging.container_logs]
	71	+	enabled = true
	72	+
	73	+	[backups]
	74	+	enabled = false
	75	+	schedule = "daily"
	76	+	storage_dir = ""
	77	+
	78	+	[backups.retention]
	79	+	hourly = 0
	80	+	daily = 0
	81	+	weekly = 0
	82	+	monthly = 0
	83	+
	84	+	[routes]
	85	+	# "app.example.com" = { image = "myapp:latest" }
	86	+
	87	+	[external_routes]
	88	+	# "status.example.com" = "127.0.0.1:9000"
	89	+
	90	+	[network_groups]
	91	+	# "backend" = ["app.example.com", "api.example.com"]
	92	+
	93	+	[attachments]
	94	+	# "app.example.com" = ["postgres:18"]

M install.sh +18 -7

 # Verify checksum
 echo "Verifying checksum..."
-EXPECTED_CHECKSUM=$(grep -E "[[:space:]]${TARBALL}\$" "$TMP_DIR/checksums.txt" | awk '{print $1}')
+TARBALL_ESCAPED=$(printf '%s\n' "$TARBALL" | sed 's/[.[\*^$()+?{|]/\\&/g')
-if [ -z "$EXPECTED_CHECKSUM" ]; then
+CHECKSUM_LINES=$(grep -E "^[0-9a-fA-F]{64}[[:space:]]+\*?${TARBALL_ESCAPED}\$" "$TMP_DIR/checksums.txt" || true)
-    echo "Error: Could not find checksum for ${TARBALL} in checksums.txt"
+CHECKSUM_COUNT=$(printf '%s\n' "$CHECKSUM_LINES" | sed '/^$/d' | wc -l | tr -d ' ')
+if [ "$CHECKSUM_COUNT" != "1" ]; then
+    echo "Error: Expected exactly one checksum for ${TARBALL} in checksums.txt"
     exit 1
 fi
+EXPECTED_CHECKSUM=$(printf '%s\n' "$CHECKSUM_LINES" | awk '{print $1}')
 # Calculate actual checksum (works on both Linux and macOS)
 if command -v sha256sum >/dev/null 2>&1; then
 fi
 echo "Checksum verified successfully."
-echo "Extracting..."
+echo "Extracting Gordon binary..."
-tar -xzf "$TMP_DIR/$TARBALL" -C "$TMP_DIR"
+EXTRACT_DIR="$TMP_DIR/extract"
+mkdir -p "$EXTRACT_DIR"
+tar -xzf "$TMP_DIR/$TARBALL" -C "$EXTRACT_DIR" gordon
+BINARY="$EXTRACT_DIR/gordon"
+if [ ! -f "$BINARY" ] || [ -L "$BINARY" ]; then
+    echo "Error: Archive did not contain a regular Gordon binary"
+    exit 1
+fi
 echo "Installing to ${INSTALL_DIR}..."
 if [ -w "$INSTALL_DIR" ]; then
-    mv "$TMP_DIR/gordon" "$INSTALL_DIR/gordon"
+    install -m 0755 "$BINARY" "$INSTALL_DIR/gordon"
 else
     echo "sudo required to install to ${INSTALL_DIR}"
-    sudo mv "$TMP_DIR/gordon" "$INSTALL_DIR/gordon"
+    sudo install -m 0755 "$BINARY" "$INSTALL_DIR/gordon"
 fi
 # Verify installation

M internal/adapters/dto/admin_config.go +2 -2


@@ -14,7 +14,7 @@ type ServerConfig struct {
14		Port int `json:"port"`	14		Port int `json:"port"`
15		RegistryPort int `json:"registry_port"`	15		RegistryPort int `json:"registry_port"`
16		RegistryDomain string `json:"registry_domain"`	16		RegistryDomain string `json:"registry_domain"`
17	-	DataDir string `json:"data_dir"`	17	+	DataDir string `json:"data_dir,omitempty"`
18		}	18		}
19			19
20		// AutoRouteConfig represents auto-route config details.	20		// AutoRouteConfig represents auto-route config details.

@@ -31,5 +31,5 @@ type NetworkIsolationConfig struct {
31		// ExternalRoute represents an external route config entry.	31		// ExternalRoute represents an external route config entry.
32		type ExternalRoute struct {	32		type ExternalRoute struct {
33		Domain string `json:"domain"`	33		Domain string `json:"domain"`
34	-	Target string `json:"target"`	34	+	Target string `json:"target,omitempty"`
35		}	35		}

M internal/adapters/in/cli/auth.go +4 -1

 Admin scopes (for remote CLI access):
   Format: admin:<resource>:<actions>
-  Resources: routes, secrets, config, status, * (all)
+  Resources: routes, secrets, config, status, logs, volumes, * (all)
   Actions:   read, write, * (all)
   Examples:
     admin:*:*              Full admin access (recommended for CLI)
     admin:routes:read      Read-only routes access
     admin:status:read      Read-only status access
+    admin:logs:read        Read-only log access
+    admin:volumes:read     Read-only volume access
+    admin:volumes:write    Volume management access
 Repository scoping:
   --repo myapp           Scope to specific repository

M internal/adapters/in/cli/config.go +13 -10

 	if err := cliWriteLine(out, cliRenderMeta("Registry Domain:", config.Server.RegistryDomain)); err != nil {
 		return err
 	}
-	if err := cliWriteLine(out, cliRenderMeta("Data Directory:", config.Server.DataDir)); err != nil {
+	if config.Server.DataDir != "" {
-		return err
+		if err := cliWriteLine(out, cliRenderMeta("Data Directory:", config.Server.DataDir)); err != nil {
+			return err
+		}
 	}
 	if err := cliWriteLine(out, cliRenderMeta("Auto-Route:", fmt.Sprintf("%v", config.AutoRoute.Enabled))); err != nil {
 		return err
 	if err := cliWriteLine(out, cliRenderTitle("External Routes")); err != nil {
 		return err
 	}
-	domains := make([]string, 0, len(config.ExternalRoutes))
+	routes := append([]remote.ExternalRoute(nil), config.ExternalRoutes...)
-	for d := range config.ExternalRoutes {
+	sort.Slice(routes, func(i, j int) bool { return routes[i].Domain < routes[j].Domain })
-		domains = append(domains, d)
-	}
-	sort.Strings(domains)
-	rows := make([][]string, 0, len(domains))
+	rows := make([][]string, 0, len(routes))
-	for _, d := range domains {
+	for _, route := range routes {
-		rows = append(rows, []string{d, config.ExternalRoutes[d]})
+		target := route.Target
+		if target == "" {
+			target = "[redacted]"
+		}
+		rows = append(rows, []string{route.Domain, target})
 	}
 	table := components.NewTable(
 		components.WithColumns([]components.TableColumn{

M internal/adapters/in/cli/controlplane_local.go +10 -2

 	"context"
 	"errors"
 	"fmt"
+	"sort"
 	"time"
 	"github.com/bnema/gordon/internal/adapters/dto"
 	if l.configSvc == nil {
 		return nil, fmt.Errorf("config service unavailable")
 	}
+	externalRoutes := l.configSvc.GetExternalRoutes()
+	externalResponses := make([]remote.ExternalRoute, 0, len(externalRoutes))
+	for domainName := range externalRoutes {
+		externalResponses = append(externalResponses, remote.ExternalRoute{Domain: domainName})
+	}
+	sort.Slice(externalResponses, func(i, j int) bool {
+		return externalResponses[i].Domain < externalResponses[j].Domain
+	})
 	cfg := &remote.Config{
 		Routes:         l.configSvc.GetRoutes(ctx),
-		ExternalRoutes: l.configSvc.GetExternalRoutes(),
+		ExternalRoutes: externalResponses,
 	}
 	cfg.Server.Port = l.configSvc.GetServerPort()
 	cfg.Server.RegistryPort = l.configSvc.GetRegistryPort()
 	cfg.Server.RegistryDomain = l.configSvc.GetRegistryDomain()
-	cfg.Server.DataDir = l.configSvc.GetDataDir()
 	cfg.AutoRoute.Enabled = l.configSvc.IsAutoRouteEnabled()
 	cfg.NetworkIsolation.Enabled = l.configSvc.IsNetworkIsolationEnabled()
 	cfg.NetworkIsolation.Prefix = l.configSvc.GetNetworkPrefix()

M internal/adapters/in/cli/remote/client.go +9 -3

 		Port           int    `json:"port"`
 		RegistryPort   int    `json:"registry_port"`
 		RegistryDomain string `json:"registry_domain"`
-		DataDir        string `json:"data_dir"`
+		DataDir        string `json:"data_dir,omitempty"`
 	} `json:"server"`
 	AutoRoute struct {
 		Enabled bool `json:"enabled"`
 		Enabled bool   `json:"enabled"`
 		Prefix  string `json:"prefix"`
 	} `json:"network_isolation"`
-	Routes         []domain.Route    `json:"routes"`
+	Routes         []domain.Route  `json:"routes"`
-	ExternalRoutes map[string]string `json:"external_routes"`
+	ExternalRoutes []ExternalRoute `json:"external_routes"`
+}
+// ExternalRoute represents a redacted external route config entry.
+type ExternalRoute struct {
+	Domain string `json:"domain"`
+	Target string `json:"target,omitempty"`
 }
 // GetConfig returns the Gordon configuration.

M internal/adapters/in/http/admin/handler.go +19 -10

 		addStep("route", "failed")
 		h.sendError(w, http.StatusBadRequest, err.Error())
 		return
+	case errors.Is(err, domain.ErrRouteConflict):
+		addStep("route", "failed")
+		h.sendError(w, http.StatusConflict, err.Error())
+		return
 	default:
 		addStep("route", "failed")
 		log.Error().Err(err).Str("domain", req.Domain).Str("image", req.Image).Msg("failed to bootstrap route")
 		switch {
 		case errors.Is(err, domain.ErrRouteDomainEmpty), errors.Is(err, domain.ErrRouteDomainInvalid), errors.Is(err, domain.ErrRouteImageEmpty):
 			h.sendError(w, http.StatusBadRequest, err.Error())
+		case errors.Is(err, domain.ErrRouteConflict):
+			h.sendError(w, http.StatusConflict, err.Error())
 		default:
 			h.sendError(w, http.StatusInternalServerError, "failed to add route")
 		}
 	externalRoutes := h.configSvc.GetExternalRoutes()
 	externalResponses := make([]dto.ExternalRoute, 0, len(externalRoutes))
-	for domain, target := range externalRoutes {
+	for domain := range externalRoutes {
 		externalResponses = append(externalResponses, dto.ExternalRoute{
 			Domain: domain,
-			Target: target,
 		})
 	}
 			Port:           h.configSvc.GetServerPort(),
 			RegistryPort:   h.configSvc.GetRegistryPort(),
 			RegistryDomain: h.configSvc.GetRegistryDomain(),
-			DataDir:        h.configSvc.GetDataDir(),
 		},
 		AutoRoute: dto.AutoRouteConfig{
 			Enabled: h.configSvc.IsAutoRouteEnabled(),
 		log.Error().Err(err).Str("domain", deployDomain).Msg("failed to deploy container")
 		var deployErr *domain.DeployFailureError
 		if errors.As(err, &deployErr) {
-			h.sendJSON(w, http.StatusInternalServerError, dto.DeployErrorResponse{
+			response := dto.DeployErrorResponse{
 				Error: deployErr.Error(),
 				Cause: deployErr.Cause,
 				Hint:  deployErr.Hint,
-				Logs:  deployErr.Logs,
+			}
-			})
+			if HasAccess(ctx, domain.AdminResourceLogs, domain.AdminActionRead) {
+				response.Logs = domain.RedactSecretLines(deployErr.Logs)
+			}
+			h.sendJSON(w, http.StatusInternalServerError, response)
 			return
 		}
 		h.sendError(w, http.StatusInternalServerError, "failed to deploy container")
 	log := zerowrap.FromCtx(ctx)
 	// Check read permission
-	if !HasAccess(ctx, domain.AdminResourceStatus, domain.AdminActionRead) {
+	if !HasAccess(ctx, domain.AdminResourceLogs, domain.AdminActionRead) {
-		h.sendError(w, http.StatusForbidden, "insufficient permissions for status:read")
+		h.sendError(w, http.StatusForbidden, "insufficient permissions for logs:read")
 		return
 	}
 		return
 	}
-	h.sendJSON(w, http.StatusOK, dto.ProcessLogsResponse{Lines: logLines})
+	h.sendJSON(w, http.StatusOK, dto.ProcessLogsResponse{Lines: domain.RedactSecretLines(logLines)})
 }
 // handleContainerLogs handles container logs for a specific domain.
 	h.sendJSON(w, http.StatusOK, dto.ContainerLogsResponse{
 		Domain: logDomain,
-		Lines:  logLines,
+		Lines:  domain.RedactSecretLines(logLines),
 	})
 }
 			if !ok {
 				return
 			}
+			line = domain.RedactSecrets(line)
 			// SECURITY: Normalize line endings and escape newlines in log lines to prevent SSE event injection.
 			// First normalize CRLF (\r\n) and CR (\r) to LF (\n), then escape newlines.
 			// Per the SSE spec, multi-line data must use separate "data:" prefixes.
 			if !ok {
 				return
 			}
+			line = domain.RedactSecrets(line)
 			// SECURITY: Normalize line endings and escape newlines in log lines to prevent SSE event injection.
 			// First normalize CRLF (\r\n) and CR (\r) to LF (\n), then escape newlines.
 			// Per the SSE spec, multi-line data must use separate "data:" prefixes.

M internal/adapters/in/http/admin/handler_test.go +166 -4


@@ -98,6 +98,64 @@ func newTestHandler(t testing.T, opts ...func(HandlerDeps)) *Handler {
98		return NewHandler(deps)	98		return NewHandler(deps)
99		}	99		}
100			100
			101	+	func TestHandler_VolumesGet_RequiresVolumesReadScope(t *testing.T) {
			102	+	volumeSvc := inmocks.NewMockVolumeService(t)
			103	+	handler := newTestHandler(t, func(d *HandlerDeps) { d.VolumeSvc = volumeSvc })
			104	+
			105	+	tests := []struct {
			106	+	name string
			107	+	scopes []string
			108	+	wantStatus int
			109	+	}{
			110	+	{name: "volumes read access granted", scopes: []string{"admin:volumes:read"}, wantStatus: http.StatusOK},
			111	+	{name: "all admin access granted", scopes: []string{"admin::"}, wantStatus: http.StatusOK},
			112	+	{name: "status read denied", scopes: []string{"admin:status:read"}, wantStatus: http.StatusForbidden},
			113	+	{name: "volumes write denied", scopes: []string{"admin:volumes:write"}, wantStatus: http.StatusForbidden},
			114	+	}
			115	+
			116	+	for _, tt := range tests {
			117	+	t.Run(tt.name, func(t *testing.T) {
			118	+	if tt.wantStatus == http.StatusOK {
			119	+	volumeSvc.EXPECT().ListVolumes(mock.Anything).Return([]*domain.VolumeInfo{}, nil).Once()
			120	+	}
			121	+	server := newScopedTestServer(t, handler, tt.scopes...)
			122	+	resp, err := http.Get(server.URL + "/admin/volumes")
			123	+	require.NoError(t, err)
			124	+	defer resp.Body.Close()
			125	+	assert.Equal(t, tt.wantStatus, resp.StatusCode)
			126	+	})
			127	+	}
			128	+	}
			129	+
			130	+	func TestHandler_VolumesPrune_RequiresVolumesWriteScope(t *testing.T) {
			131	+	volumeSvc := inmocks.NewMockVolumeService(t)
			132	+	handler := newTestHandler(t, func(d *HandlerDeps) { d.VolumeSvc = volumeSvc })
			133	+
			134	+	tests := []struct {
			135	+	name string
			136	+	scopes []string
			137	+	wantStatus int
			138	+	}{
			139	+	{name: "volumes write access granted", scopes: []string{"admin:volumes:write"}, wantStatus: http.StatusOK},
			140	+	{name: "all admin access granted", scopes: []string{"admin::"}, wantStatus: http.StatusOK},
			141	+	{name: "config write denied", scopes: []string{"admin:config:write"}, wantStatus: http.StatusForbidden},
			142	+	{name: "volumes read denied", scopes: []string{"admin:volumes:read"}, wantStatus: http.StatusForbidden},
			143	+	}
			144	+
			145	+	for _, tt := range tests {
			146	+	t.Run(tt.name, func(t *testing.T) {
			147	+	if tt.wantStatus == http.StatusOK {
			148	+	volumeSvc.EXPECT().PruneVolumes(mock.Anything, true).Return(&domain.VolumePruneReport{}, []*domain.VolumeInfo{}, nil).Once()
			149	+	}
			150	+	server := newScopedTestServer(t, handler, tt.scopes...)
			151	+	resp, err := http.Post(server.URL+"/admin/volumes/prune", "application/json", bytes.NewBufferString(`{"dry_run":true}`))
			152	+	require.NoError(t, err)
			153	+	defer resp.Body.Close()
			154	+	assert.Equal(t, tt.wantStatus, resp.StatusCode)
			155	+	})
			156	+	}
			157	+	}
			158	+
101		// Routes endpoint tests	159		// Routes endpoint tests
102			160
103		func TestHandler_RoutesGet_RequiresReadScope(t *testing.T) {	161		func TestHandler_RoutesGet_RequiresReadScope(t *testing.T) {

@@ -1064,6 +1122,36 @@ func TestHandler_Status_RequiresReadScope(t *testing.T) {
1064			1122
1065		// Config endpoint tests	1123		// Config endpoint tests
1066			1124
			1125	+	func TestHandler_Config_HidesSensitiveInventoryByDefault(t *testing.T) {
			1126	+	configSvc := inmocks.NewMockConfigService(t)
			1127	+	handler := newTestHandler(t, func(d *HandlerDeps) { d.ConfigSvc = configSvc })
			1128	+
			1129	+	configSvc.EXPECT().GetServerPort().Return(8080).Once()
			1130	+	configSvc.EXPECT().GetRegistryPort().Return(5000).Once()
			1131	+	configSvc.EXPECT().GetRegistryDomain().Return("registry.example.com").Once()
			1132	+	configSvc.EXPECT().IsAutoRouteEnabled().Return(true).Once()
			1133	+	configSvc.EXPECT().IsNetworkIsolationEnabled().Return(false).Once()
			1134	+	configSvc.EXPECT().GetNetworkPrefix().Return("gordon").Once()
			1135	+	configSvc.EXPECT().GetRoutes(mock.Anything).Return([]domain.Route{}).Once()
			1136	+	configSvc.EXPECT().GetExternalRoutes().Return(map[string]string{"db.example.com": "http://10.0.0.5:5432"}).Once()
			1137	+
			1138	+	server := newScopedTestServer(t, handler, "admin:config:read")
			1139	+	resp, err := http.Get(server.URL + "/admin/config")
			1140	+	require.NoError(t, err)
			1141	+	defer resp.Body.Close()
			1142	+	bodyBytes, err := io.ReadAll(resp.Body)
			1143	+	require.NoError(t, err)
			1144	+
			1145	+	require.Equal(t, http.StatusOK, resp.StatusCode)
			1146	+	body := string(bodyBytes)
			1147	+	var raw map[string]any
			1148	+	require.NoError(t, json.Unmarshal([]byte(body), &raw))
			1149	+	serverConfig := raw["server"].(map[string]any)
			1150	+	assert.NotContains(t, serverConfig, "data_dir")
			1151	+	assert.NotContains(t, body, "/var/lib/gordon")
			1152	+	assert.NotContains(t, body, "10.0.0.5")
			1153	+	}
			1154	+
1067		func TestHandler_Config_RequiresReadScope(t *testing.T) {	1155		func TestHandler_Config_RequiresReadScope(t *testing.T) {
1068		configSvc := inmocks.NewMockConfigService(t)	1156		configSvc := inmocks.NewMockConfigService(t)
1069		authSvc := inmocks.NewMockAuthService(t)	1157		authSvc := inmocks.NewMockAuthService(t)

@@ -1542,6 +1630,41 @@ func TestHandler_Restart_InvalidDomain(t *testing.T) {
1542		}	1630		}
1543		}	1631		}
1544			1632
			1633	+	func TestHandler_Deploy_ConfigWriteOnlyOmitsDeployFailureLogs(t *testing.T) {
			1634	+	configSvc := inmocks.NewMockConfigService(t)
			1635	+	containerSvc := inmocks.NewMockContainerService(t)
			1636	+	secretSvc := inmocks.NewMockSecretService(t)
			1637	+	route := &domain.Route{Domain: "app.example.com", Image: "registry.local/myapp:latest"}
			1638	+	deployErr := &domain.DeployFailureError{
			1639	+	Summary: "failed to deploy",
			1640	+	Cause: "image pull failed",
			1641	+	Hint: "push the image before retrying",
			1642	+	Logs: []string{"PASSWORD=hunter2", "TOKEN=abc123"},
			1643	+	}
			1644	+
			1645	+	handler := newTestHandler(t, func(d *HandlerDeps) {
			1646	+	d.ConfigSvc = configSvc
			1647	+	d.ContainerSvc = containerSvc
			1648	+	d.SecretSvc = secretSvc
			1649	+	})
			1650	+
			1651	+	configSvc.EXPECT().GetRoute(mock.Anything, "app.example.com").Return(route, nil).Once()
			1652	+	containerSvc.EXPECT().Deploy(mock.Anything, *route).Return(nil, deployErr).Once()
			1653	+
			1654	+	server := newScopedTestServer(t, handler, "admin:config:write")
			1655	+	resp, err := http.Post(server.URL+"/admin/deploy/app.example.com", "application/json", nil)
			1656	+	require.NoError(t, err)
			1657	+	defer resp.Body.Close()
			1658	+	bodyBytes, err := io.ReadAll(resp.Body)
			1659	+	require.NoError(t, err)
			1660	+	body := string(bodyBytes)
			1661	+
			1662	+	assert.Equal(t, http.StatusInternalServerError, resp.StatusCode)
			1663	+	assert.JSONEq(t, `{"error":"failed to deploy","cause":"image pull failed","hint":"push the image before retrying"}`, body)
			1664	+	assert.NotContains(t, body, "hunter2")
			1665	+	assert.NotContains(t, body, "abc123")
			1666	+	}
			1667	+
1545		func TestHandler_Deploy_StructuredDeployFailure(t *testing.T) {	1668		func TestHandler_Deploy_StructuredDeployFailure(t *testing.T) {
1546		configSvc := inmocks.NewMockConfigService(t)	1669		configSvc := inmocks.NewMockConfigService(t)
1547		authSvc := inmocks.NewMockAuthService(t)	1670		authSvc := inmocks.NewMockAuthService(t)

@@ -1553,8 +1676,8 @@ func TestHandler_Deploy_StructuredDeployFailure(t *testing.T) {
1553		Cause: "image pull failed",	1676		Cause: "image pull failed",
1554		Hint: "push the image before retrying",	1677		Hint: "push the image before retrying",
1555		Logs: []string{	1678		Logs: []string{
1556	-	"pulling manifest",	1679	+	"pulling manifest PASSWORD=hunter2",
1557	-	"manifest unknown",	1680	+	`{"TOKEN":"abc123"}`,
1558		},	1681		},
1559		Err: errors.New("manifest unknown: internal registry detail"),	1682		Err: errors.New("manifest unknown: internal registry detail"),
1560		}	1683		}

@@ -1566,7 +1689,7 @@ func TestHandler_Deploy_StructuredDeployFailure(t *testing.T) {
1566		d.SecretSvc = secretSvc	1689		d.SecretSvc = secretSvc
1567		})	1690		})
1568		s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {	1691		s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
1569	-	handler.ServeHTTP(w, r.WithContext(ctxWithScopes("admin:config:write")))	1692	+	handler.ServeHTTP(w, r.WithContext(ctxWithScopes("admin:config:write", "admin:logs:read")))
1570		}))	1693		}))
1571		defer s.Close()	1694		defer s.Close()
1572			1695

@@ -1582,8 +1705,10 @@ func TestHandler_Deploy_StructuredDeployFailure(t *testing.T) {
1582		assert.NoError(t, err)	1705		assert.NoError(t, err)
1583			1706
1584		assert.Equal(t, http.StatusInternalServerError, resp.StatusCode)	1707		assert.Equal(t, http.StatusInternalServerError, resp.StatusCode)
1585	-	assert.JSONEq(t, `{"error":"failed to deploy","cause":"image pull failed","hint":"push the image before retrying","logs":["pulling manifest","manifest unknown"]}`, string(body))	1708	+	assert.JSONEq(t, `{"error":"failed to deploy","cause":"image pull failed","hint":"push the image before retrying","logs":["pulling manifest PASSWORD=[REDACTED]","{\"TOKEN\":\"[REDACTED]\"}"]}`, string(body))
1586		assert.NotContains(t, string(body), "internal registry detail")	1709		assert.NotContains(t, string(body), "internal registry detail")
			1710	+	assert.NotContains(t, string(body), "hunter2")
			1711	+	assert.NotContains(t, string(body), "abc123")
1587		}	1712		}
1588			1713
1589		func TestHandler_Deploy_GenericErrorStillUsesLegacyBody(t *testing.T) {	1714		func TestHandler_Deploy_GenericErrorStillUsesLegacyBody(t *testing.T) {

@@ -2045,6 +2170,43 @@ func TestHandler_BackupsRunDomain_ChunkedBodyIsDecoded(t *testing.T) {
2045		assert.Contains(t, rec.Body.String(), "completed")	2170		assert.Contains(t, rec.Body.String(), "completed")
2046		}	2171		}
2047			2172
			2173	+	func TestHandler_LogsRequireLogsReadAndRedact(t *testing.T) {
			2174	+	logSvc := inmocks.NewMockLogService(t)
			2175	+	handler := newTestHandler(t, func(d *HandlerDeps) {
			2176	+	d.LogSvc = logSvc
			2177	+	})
			2178	+
			2179	+	t.Run("status read denied", func(t *testing.T) {
			2180	+	server := newScopedTestServer(t, handler, "admin:status:read")
			2181	+	resp, err := http.Get(server.URL + "/admin/logs")
			2182	+	require.NoError(t, err)
			2183	+	defer resp.Body.Close()
			2184	+	bodyBytes, err := io.ReadAll(resp.Body)
			2185	+	require.NoError(t, err)
			2186	+
			2187	+	assert.Equal(t, http.StatusForbidden, resp.StatusCode)
			2188	+	assert.Contains(t, string(bodyBytes), "insufficient permissions for logs:read")
			2189	+	})
			2190	+
			2191	+	t.Run("logs read allowed and redacted", func(t *testing.T) {
			2192	+	logSvc.EXPECT().GetProcessLogs(mock.Anything, 50).Return([]string{"PASSWORD=hunter2", `{"API_KEY":"abc123"}`}, nil).Once()
			2193	+
			2194	+	server := newScopedTestServer(t, handler, "admin:logs:read")
			2195	+	resp, err := http.Get(server.URL + "/admin/logs")
			2196	+	require.NoError(t, err)
			2197	+	defer resp.Body.Close()
			2198	+	bodyBytes, err := io.ReadAll(resp.Body)
			2199	+	require.NoError(t, err)
			2200	+	body := string(bodyBytes)
			2201	+
			2202	+	assert.Equal(t, http.StatusOK, resp.StatusCode)
			2203	+	assert.Contains(t, body, "PASSWORD=[REDACTED]")
			2204	+	assert.Contains(t, body, `\"API_KEY\":\"[REDACTED]\"`)
			2205	+	assert.NotContains(t, body, "hunter2")
			2206	+	assert.NotContains(t, body, "abc123")
			2207	+	})
			2208	+	}
			2209	+
2048		func TestHandler_BackupsDetectDomain(t *testing.T) {	2210		func TestHandler_BackupsDetectDomain(t *testing.T) {
2049		configSvc := inmocks.NewMockConfigService(t)	2211		configSvc := inmocks.NewMockConfigService(t)
2050		authSvc := inmocks.NewMockAuthService(t)	2212		authSvc := inmocks.NewMockAuthService(t)

M internal/adapters/in/http/admin/handler_volumes.go +4 -4


@@ -19,8 +19,8 @@ func (h Handler) handleListVolumes(w http.ResponseWriter, r http.Request) {
19			19
20		ctx := r.Context()	20		ctx := r.Context()
21			21
22	-	if !HasAccess(ctx, domain.AdminResourceStatus, domain.AdminActionRead) {	22	+	if !HasAccess(ctx, domain.AdminResourceVolumes, domain.AdminActionRead) {
23	-	h.sendError(w, http.StatusForbidden, "insufficient permissions for status:read")	23	+	h.sendError(w, http.StatusForbidden, "insufficient permissions for volumes:read")
24		return	24		return
25		}	25		}
26			26

@@ -63,8 +63,8 @@ func (h Handler) handlePruneVolumes(w http.ResponseWriter, r http.Request) {
63			63
64		ctx := r.Context()	64		ctx := r.Context()
65			65
66	-	if !HasAccess(ctx, domain.AdminResourceConfig, domain.AdminActionWrite) {	66	+	if !HasAccess(ctx, domain.AdminResourceVolumes, domain.AdminActionWrite) {
67	-	h.sendError(w, http.StatusForbidden, "insufficient permissions for config:write")	67	+	h.sendError(w, http.StatusForbidden, "insufficient permissions for volumes:write")
68		return	68		return
69		}	69		}
70			70

M internal/adapters/in/http/middleware/cidr.go +37 -5

 	"fmt"
 	"net"
 	"net/http"
+	"strconv"
 	"strings"
 	"github.com/bnema/zerowrap"
 	"github.com/bnema/gordon/internal/adapters/dto"
 	"github.com/bnema/gordon/internal/adapters/in/http/httphelper"
+	"github.com/bnema/gordon/internal/domain"
 )
 // cidrAllowlist is the shared implementation for CIDR-based access control middleware.
 // httpPort is the configured HTTP listener port (cfg.Server.Port) so the redirect
 // helper can map it to tlsPort. Hosts with no explicit port omit the TLS port from
 // the public URL; hosts with an unknown explicit port preserve it as-is.
-func HTTPSRedirect(proxyNets []*net.IPNet, httpPort, tlsPort int, forceAll bool, log zerowrap.Logger) func(http.Handler) http.Handler {
+func HTTPSRedirect(proxyNets []*net.IPNet, httpPort, tlsPort int, forceAll bool, log zerowrap.Logger, isHostAllowed func(string) bool) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		if tlsPort == 0 {
 			return next
 				}
 			}
-			target := httpsRedirectTarget(r.Host, r.RequestURI, httpPort, tlsPort)
+			target, ok := httpsRedirectTarget(r.Host, r.RequestURI, httpPort, tlsPort, isHostAllowed)
+			if !ok {
+				http.Error(w, "Bad Request", http.StatusBadRequest)
+				return
+			}
 			log.Debug().
 				Str("target", target).
 	}
 }
-// httpsRedirectTarget derives the HTTPS redirect URL from the request Host.
+// httpsRedirectTarget derives the HTTPS redirect URL from a validated request Host.
-func httpsRedirectTarget(host, requestURI string, httpPort, tlsPort int) string {
+func httpsRedirectTarget(host, requestURI string, httpPort, tlsPort int, isHostAllowed func(string) bool) (string, bool) {
+	host = strings.ToLower(strings.TrimSpace(host))
+	if host == "" {
+		return "", false
+	}
+	hostname, portStr, err := net.SplitHostPort(host)
+	if err != nil {
+		if strings.Contains(host, ":") {
+			return "", false
+		}
+		hostname = host
+	} else if port, err := strconv.Atoi(portStr); err != nil || port < 1 || port > 65535 {
+		return "", false
+	}
+	hostname = strings.TrimSuffix(hostname, ".")
+	canonicalHost, ok := domain.CanonicalRouteDomain(hostname)
+	if !ok {
+		return "", false
+	}
+	if isHostAllowed == nil || !isHostAllowed(canonicalHost) {
+		return "", false
+	}
 	path := requestURI
 	if !strings.HasPrefix(path, "/") {
 		path = "/"
 	}
-	return fmt.Sprintf("https://%s%s", httphelper.HTTPSAuthority(host, httpPort, tlsPort), path)
+	canonicalAuthority := canonicalHost
+	if portStr != "" {
+		canonicalAuthority = net.JoinHostPort(canonicalHost, portStr)
+	}
+	return fmt.Sprintf("https://%s%s", httphelper.HTTPSAuthority(canonicalAuthority, httpPort, tlsPort), path), true
 }
 // ProxyCIDRAllowlist returns middleware that restricts proxy access to the given CIDR ranges.

M internal/adapters/in/http/middleware/cidr_test.go +47 -17


@@ -2,7 +2,6 @@ package middleware
2			2
3		import (	3		import (
4		"encoding/json"	4		"encoding/json"
5	-	"fmt"
6		"net"	5		"net"
7		"net/http"	6		"net/http"
8		"net/http/httptest"	7		"net/http/httptest"

@@ -118,7 +117,7 @@ func TestHTTPSRedirect_NoPortHost_OmitsTLSPort(t *testing.T) {
118		w.WriteHeader(http.StatusOK)	117		w.WriteHeader(http.StatusOK)
119		})	118		})
120			119
121	-	handler := HTTPSRedirect(nil, 8088, 8443, true, log)(ok)	120	+	handler := HTTPSRedirect(nil, 8088, 8443, true, log, func(host string) bool { return host == "o2.bnema.dev" })(ok)
122		srv := httptest.NewServer(handler)	121		srv := httptest.NewServer(handler)
123		defer srv.Close()	122		defer srv.Close()
124			123

@@ -141,7 +140,7 @@ func TestHTTPSRedirect_HTTPListenerPort_MapsToTLSPort(t *testing.T) {
141		w.WriteHeader(http.StatusOK)	140		w.WriteHeader(http.StatusOK)
142		})	141		})
143			142
144	-	handler := HTTPSRedirect(nil, 8088, 8443, true, log)(ok)	143	+	handler := HTTPSRedirect(nil, 8088, 8443, true, log, func(host string) bool { return host == "o2.bnema.dev" })(ok)
145		srv := httptest.NewServer(handler)	144		srv := httptest.NewServer(handler)
146		defer srv.Close()	145		defer srv.Close()
147			146

@@ -164,7 +163,7 @@ func TestHTTPSRedirect_UnknownExplicitPort_IsPreserved(t *testing.T) {
164		w.WriteHeader(http.StatusOK)	163		w.WriteHeader(http.StatusOK)
165		})	164		})
166			165
167	-	handler := HTTPSRedirect(nil, 8088, 8443, true, log)(ok)	166	+	handler := HTTPSRedirect(nil, 8088, 8443, true, log, func(host string) bool { return host == "o2.bnema.dev" })(ok)
168		srv := httptest.NewServer(handler)	167		srv := httptest.NewServer(handler)
169		defer srv.Close()	168		defer srv.Close()
170			169

@@ -181,31 +180,62 @@ func TestHTTPSRedirect_UnknownExplicitPort_IsPreserved(t *testing.T) {
181		assert.Equal(t, "https://o2.bnema.dev:9999/", resp.Header.Get("Location"))	180		assert.Equal(t, "https://o2.bnema.dev:9999/", resp.Header.Get("Location"))
182		}	181		}
183			182
184	-	func TestHTTPSRedirect_InvalidExplicitPort_IsPreserved(t *testing.T) {	183	+	func TestHTTPSRedirect_TrailingDotHostRedirectsToCanonicalHost(t *testing.T) {
185		log := testLogger()	184		log := testLogger()
186		ok := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {	185		ok := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
187		w.WriteHeader(http.StatusOK)	186		w.WriteHeader(http.StatusOK)
188		})	187		})
			188	+	handler := HTTPSRedirect(nil, 8088, 8443, true, log, func(host string) bool { return host == "o2.bnema.dev" })(ok)
189			189
190	-	handler := HTTPSRedirect(nil, 8088, 8443, true, log)(ok)
191		srv := httptest.NewServer(handler)	190		srv := httptest.NewServer(handler)
192		defer srv.Close()	191		defer srv.Close()
			192	+	client := srv.Client()
			193	+	client.CheckRedirect = func(http.Request, []http.Request) error { return http.ErrUseLastResponse }
193			194
194	-	// Use a raw TCP connection because Go's HTTP client rejects the	195	+	req, err := http.NewRequest(http.MethodGet, srv.URL+"/path", nil)
195	-	// invalid port in the Location header before CheckRedirect fires.
196	-	conn, err := net.Dial("tcp", srv.Listener.Addr().String())
197		require.NoError(t, err)	196		require.NoError(t, err)
198	-	defer conn.Close()	197	+	req.Host = "O2.Bnema.Dev.:8088"
199	-		198	+	resp, err := client.Do(req)
200	-	_, err = fmt.Fprintf(conn, "GET / HTTP/1.1\r\nHost: o2.bnema.dev:abcd\r\nConnection: close\r\n\r\n")
201		require.NoError(t, err)	199		require.NoError(t, err)
			200	+	defer resp.Body.Close()
202			201
203	-	var buf [4096]byte	202	+	assert.Equal(t, http.StatusPermanentRedirect, resp.StatusCode)
204	-	n, _ := conn.Read(buf[:])	203	+	assert.Equal(t, "https://o2.bnema.dev:8443/path", resp.Header.Get("Location"))
205	-	raw := string(buf[:n])	204	+	}
206			205
207	-	assert.Contains(t, raw, "308")	206	+	func TestHTTPSRedirect_RejectsInvalidHost(t *testing.T) {
208	-	assert.Contains(t, raw, "Location: https://o2.bnema.dev:abcd/")	207	+	log := testLogger()
			208	+	ok := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
			209	+	w.WriteHeader(http.StatusOK)
			210	+	})
			211	+	handler := HTTPSRedirect(nil, 8088, 8443, true, log, func(host string) bool { return host == "o2.bnema.dev" })(ok)
			212	+
			213	+	tests := []struct {
			214	+	name string
			215	+	host string
			216	+	}{
			217	+	{name: "invalid port", host: "o2.bnema.dev:abcd"},
			218	+
			219	+	{name: "localhost", host: "localhost"},
			220	+	{name: "ipv6", host: "[::1]:8088"},
			221	+	{name: "unconfigured public host", host: "evil.example.com"},
			222	+	}
			223	+
			224	+	for _, tt := range tests {
			225	+	t.Run(tt.name, func(t *testing.T) {
			226	+	srv := httptest.NewServer(handler)
			227	+	defer srv.Close()
			228	+	req, err := http.NewRequest(http.MethodGet, srv.URL+"/", nil)
			229	+	require.NoError(t, err)
			230	+	req.Host = tt.host
			231	+	resp, err := srv.Client().Do(req)
			232	+	require.NoError(t, err)
			233	+	defer resp.Body.Close()
			234	+
			235	+	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
			236	+	assert.Empty(t, resp.Header.Get("Location"))
			237	+	})
			238	+	}
209		}	239		}
210			240
211		func TestProxyCIDRAllowlist(t *testing.T) {	241		func TestProxyCIDRAllowlist(t *testing.T) {

M internal/adapters/in/http/proxy/handler.go +33 -3


@@ -4,6 +4,8 @@ package proxy
4		import (	4		import (
5		"net"	5		"net"
6		"net/http"	6		"net/http"
			7	+	"strconv"
			8	+	"strings"
7		"sync/atomic"	9		"sync/atomic"
8			10
9		"github.com/bnema/zerowrap"	11		"github.com/bnema/zerowrap"

@@ -70,16 +72,22 @@ func (h Handler) ServeHTTP(w http.ResponseWriter, r http.Request) {
70		r = r.WithContext(ctx)	72		r = r.WithContext(ctx)
71		log := zerowrap.FromCtx(ctx)	73		log := zerowrap.FromCtx(ctx)
72			74
			75	+	host := normalizeRequestHost(r.Host)
			76	+	if host == "" {
			77	+	proxyError(w, "Bad Request", http.StatusBadRequest)
			78	+	return
			79	+	}
			80	+
73		// Check if this is the registry domain	81		// Check if this is the registry domain
74	-	if h.proxySvc.IsRegistryDomain(r.Host) {	82	+	if h.proxySvc.IsRegistryDomain(host) {
75		log.Debug().Msg("routing request to registry")	83		log.Debug().Msg("routing request to registry")
76		h.forwardToRegistry(w, r, cfg.RegistryPort)	84		h.forwardToRegistry(w, r, cfg.RegistryPort)
77		return	85		return
78		}	86		}
79			87
80		// Get target for this domain	88		// Get target for this domain
81	-	log.Debug().Str("resolving_target_for", r.Host).Msg("looking up proxy target")	89	+	log.Debug().Str("resolving_target_for", host).Msg("looking up proxy target")
82	-	target, err := h.proxySvc.GetTarget(ctx, r.Host)	90	+	target, err := h.proxySvc.GetTarget(ctx, host)
83		if err != nil {	91		if err != nil {
84		log.Warn().Err(err).Msg("no route found for domain")	92		log.Warn().Err(err).Msg("no route found for domain")
85		proxyError(w, "404 page not found", http.StatusNotFound)	93		proxyError(w, "404 page not found", http.StatusNotFound)

@@ -94,3 +102,25 @@ func (h Handler) ServeHTTP(w http.ResponseWriter, r http.Request) {
94			102
95		h.forwardToTarget(w, r, target, cfg.MaxResponseSize)	103		h.forwardToTarget(w, r, target, cfg.MaxResponseSize)
96		}	104		}
			105	+
			106	+	func normalizeRequestHost(host string) string {
			107	+	host = strings.TrimSpace(host)
			108	+	if h, port, err := net.SplitHostPort(host); err == nil {
			109	+	portNum, err := strconv.Atoi(port)
			110	+	if err != nil \|\| portNum < 1 \|\| portNum > 65535 {
			111	+	return ""
			112	+	}
			113	+	host = h
			114	+	} else if strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]") {
			115	+	inner := strings.TrimSuffix(strings.TrimPrefix(host, "["), "]")
			116	+	if ip := net.ParseIP(inner); ip == nil \|\| ip.To4() != nil {
			117	+	return ""
			118	+	}
			119	+	host = inner
			120	+	} else if strings.Contains(host, ":") {
			121	+	return ""
			122	+	}
			123	+	host = strings.ToLower(host)
			124	+	host = strings.TrimSuffix(host, ".")
			125	+	return host
			126	+	}

M internal/adapters/in/http/proxy/handler_test.go +53 -0


@@ -11,6 +11,7 @@ import (
11	"github.com/bnema/zerowrap"	11		"github.com/bnema/zerowrap"
12	"github.com/stretchr/testify/assert"	12		"github.com/stretchr/testify/assert"
13	"github.com/stretchr/testify/mock"	13		"github.com/stretchr/testify/mock"
		14	+	"github.com/stretchr/testify/require"
14		15
15	"github.com/bnema/gordon/internal/boundaries/in"	16		"github.com/bnema/gordon/internal/boundaries/in"
16	inmocks "github.com/bnema/gordon/internal/boundaries/in/mocks"	17		inmocks "github.com/bnema/gordon/internal/boundaries/in/mocks"

@@ -61,6 +62,58 @@ func TestHandler_RoutesToRegistry(t *testing.T) {
61	assert.True(t, w.Code == http.StatusBadGateway \|\| w.Code == http.StatusServiceUnavailable)	62		assert.True(t, w.Code == http.StatusBadGateway \|\| w.Code == http.StatusServiceUnavailable)
62	}	63		}
63		64
		65	+	func TestHandler_NormalizesRequestHostForLookup(t *testing.T) {
		66	+	tests := []struct {
		67	+	name string
		68	+	host string
		69	+	wantHost string
		70	+	}{
		71	+	{name: "mixed case", host: "App.Example.com", wantHost: "app.example.com"},
		72	+	{name: "explicit port", host: "App.Example.com:8080", wantHost: "app.example.com"},
		73	+	{name: "trailing dot", host: "App.Example.com.", wantHost: "app.example.com"},
		74	+	}
		75	+
		76	+	for _, tt := range tests {
		77	+	t.Run(tt.name, func(t *testing.T) {
		78	+	proxySvc := inmocks.NewMockProxyService(t)
		79	+	proxySvc.EXPECT().ProxyConfig().Return(in.ProxyServiceConfig{})
		80	+	proxySvc.EXPECT().IsRegistryDomain(tt.wantHost).Return(false)
		81	+	proxySvc.EXPECT().GetTarget(mock.Anything, tt.wantHost).Return(nil, domain.ErrNoTargetAvailable)
		82	+
		83	+	handler := NewHandler(proxySvc, nil, testLogger())
		84	+	srv := httptest.NewServer(handler)
		85	+	defer srv.Close()
		86	+	req, err := http.NewRequest(http.MethodGet, srv.URL+"/", nil)
		87	+	require.NoError(t, err)
		88	+	req.Host = tt.host
		89	+	resp, err := srv.Client().Do(req)
		90	+	require.NoError(t, err)
		91	+	defer resp.Body.Close()
		92	+
		93	+	assert.Equal(t, http.StatusNotFound, resp.StatusCode)
		94	+	})
		95	+	}
		96	+	}
		97	+
		98	+	func TestHandler_RejectsInvalidRequestHost(t *testing.T) {
		99	+	proxySvc := inmocks.NewMockProxyService(t)
		100	+	proxySvc.EXPECT().ProxyConfig().Return(in.ProxyServiceConfig{})
		101	+
		102	+	handler := NewHandler(proxySvc, nil, testLogger())
		103	+	srv := httptest.NewServer(handler)
		104	+	defer srv.Close()
		105	+	for _, host := range []string{"app.example.com:bad", "app.example.com:0", "app.example.com:99999"} {
		106	+	req, err := http.NewRequest(http.MethodGet, srv.URL+"/", nil)
		107	+	require.NoError(t, err)
		108	+	req.Host = host
		109	+	resp, err := srv.Client().Do(req)
		110	+	require.NoError(t, err)
		111	+	defer resp.Body.Close()
		112	+
		113	+	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
		114	+	}
		115	+	}
		116	+
64	func TestHandler_Returns404WhenNoTarget(t *testing.T) {	117		func TestHandler_Returns404WhenNoTarget(t *testing.T) {
65	proxySvc := inmocks.NewMockProxyService(t)	118		proxySvc := inmocks.NewMockProxyService(t)
66		119

M internal/adapters/in/http/registry/handler.go +73 -12

 package registry
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"net/http"
 	"strconv"
 	"strings"
+	"sync/atomic"
 	"github.com/bnema/zerowrap"
 	// Kept at 95MB to stay within Cloudflare's 100MB per-request limit.
 	// Users who need larger chunks can configure it explicitly via max_blob_chunk_size.
 	DefaultMaxBlobChunkSize = 95 * 1024 * 1024
+	// DefaultMaxBlobSize is the default maximum cumulative size for a blob upload.
+	DefaultMaxBlobSize = 1024 * 1024 * 1024
 )
+// blobLimits holds consistent blob size limits.
+type blobLimits struct {
+	MaxChunkSize int64
+	MaxBlobSize  int64
+}
 // Handler implements the HTTP handler for Docker Registry API v2.
 type Handler struct {
-	registrySvc      in.RegistryService
+	registrySvc in.RegistryService
-	log              zerowrap.Logger
+	log         zerowrap.Logger
-	maxBlobChunkSize int64
+	blobLimits  atomic.Value // stores *blobLimits
 }
 // NewHandler creates a new registry HTTP handler.
 	registrySvc in.RegistryService,
 	log zerowrap.Logger,
 	maxBlobChunkSize int64,
+	maxBlobSize ...int64,
 ) *Handler {
 	if maxBlobChunkSize <= 0 {
 		maxBlobChunkSize = DefaultMaxBlobChunkSize
 	}
+	blobSizeLimit := int64(DefaultMaxBlobSize)
+	if len(maxBlobSize) > 0 && maxBlobSize[0] > 0 {
+		blobSizeLimit = maxBlobSize[0]
+	}
-	return &Handler{
+	h := &Handler{
-		registrySvc:      registrySvc,
+		registrySvc: registrySvc,
-		log:              log,
+		log:         log,
-		maxBlobChunkSize: maxBlobChunkSize,
 	}
+	h.blobLimits.Store(&blobLimits{
+		MaxChunkSize: maxBlobChunkSize,
+		MaxBlobSize:  blobSizeLimit,
+	})
+	return h
+}
+// UpdateBlobLimits updates request-size limits used by live upload handlers.
+func (h *Handler) UpdateBlobLimits(maxBlobChunkSize, maxBlobSize int64) {
+	if maxBlobChunkSize <= 0 {
+		maxBlobChunkSize = DefaultMaxBlobChunkSize
+	}
+	if maxBlobSize <= 0 {
+		maxBlobSize = DefaultMaxBlobSize
+	}
+	h.blobLimits.Store(&blobLimits{
+		MaxChunkSize: maxBlobChunkSize,
+		MaxBlobSize:  maxBlobSize,
+	})
 }
 // RegisterRoutes registers the registry routes on the given mux.
 	}
 }
-func (h *Handler) handleBase(w http.ResponseWriter, r *http.Request) {
+func (h *Handler) handleBase(w http.ResponseWriter, _ *http.Request) {
 	w.Header().Set("Docker-Distribution-API-Version", "registry/2.0")
 	w.WriteHeader(http.StatusOK)
 }
 		}
 	}
+	// Load a consistent snapshot of both blob limits atomically
+	limits := h.blobLimits.Load().(*blobLimits)
+	maxBlobChunkSize := limits.MaxChunkSize
+	maxBlobSize := limits.MaxBlobSize
 	// Limit blob chunk size to prevent excessive uploads.
 	// MaxBytesReader wraps the body so the downstream io.Copy stops at the limit.
-	r.Body = http.MaxBytesReader(w, r.Body, h.maxBlobChunkSize)
+	r.Body = http.MaxBytesReader(w, r.Body, maxBlobChunkSize)
 	// Stream the body directly to storage — memory usage is bounded to a small
 	// copy buffer (~32KB) regardless of chunk size.
-	length, err := h.registrySvc.AppendBlobChunk(ctx, name, uuid, r.Body)
+	length, err := h.registrySvc.AppendBlobChunk(ctx, name, uuid, r.Body, r.ContentLength, maxBlobSize)
 	if err != nil {
 		var maxBytesErr *http.MaxBytesError
 		if errors.As(err, &maxBytesErr) {
-			log.Warn().Int64("max_size", h.maxBlobChunkSize).Msg("blob chunk too large")
+			log.Warn().Int64("max_size", maxBlobChunkSize).Msg("blob chunk too large")
+			if !h.cancelUploadAfterError(w, ctx, uuid, "failed to cancel oversized blob upload") {
+				return
+			}
 			h.sendRegistryError(w, http.StatusRequestEntityTooLarge, "SIZE_INVALID", "blob chunk exceeds maximum size")
 			return
 		}
+		if errors.Is(err, domain.ErrBlobSizeExceeded) {
+			log.Warn().Int64("max_size", maxBlobSize).Msg("blob upload too large")
+			if !h.cancelUploadAfterError(w, ctx, uuid, "failed to cancel oversized blob upload") {
+				return
+			}
+			h.sendRegistryError(w, http.StatusRequestEntityTooLarge, "SIZE_INVALID", "blob exceeds maximum size")
+			return
+		}
 		log.Error().Err(err).Msg("failed to append blob chunk")
 		h.sendRegistryError(w, http.StatusInternalServerError, "BLOB_UPLOAD_UNKNOWN", "failed to append blob chunk")
 		return
 	if r.Method == "PUT" && digest != "" {
 		if err := h.registrySvc.FinishUpload(ctx, uuid, digest); err != nil {
 			log.Error().Err(err).Str("digest", digest).Msg("failed to finalize blob upload")
-			_ = h.registrySvc.CancelUpload(ctx, uuid)
+			if !h.cancelUploadAfterError(w, ctx, uuid, "failed to cancel invalid blob upload") {
+				return
+			}
 			h.sendRegistryError(w, http.StatusBadRequest, "DIGEST_INVALID", "digest mismatch")
 			return
 		}
 	w.WriteHeader(http.StatusAccepted)
 }
+func (h *Handler) cancelUploadAfterError(w http.ResponseWriter, ctx context.Context, uuid, message string) bool {
+	if err := h.registrySvc.CancelUpload(ctx, uuid); err != nil {
+		log := zerowrap.FromCtx(ctx)
+		log.Error().Err(err).Str("uuid", uuid).Msg(message)
+		h.sendRegistryError(w, http.StatusInternalServerError, "UNKNOWN", "failed to cancel upload")
+		return false
+	}
+	return true
+}
 func (h *Handler) handleListTags(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	log := zerowrap.FromCtx(ctx)

M internal/adapters/in/http/registry/handler_test.go +83 -7


@@ -293,7 +293,7 @@ func TestHandler_BlobUpload_PATCH(t *testing.T) {
293		handler := NewHandler(registrySvc, testLogger(), DefaultMaxBlobChunkSize)	293		handler := NewHandler(registrySvc, testLogger(), DefaultMaxBlobChunkSize)
294			294
295		chunkData := []byte("chunk content")	295		chunkData := []byte("chunk content")
296	-	registrySvc.EXPECT().AppendBlobChunk(mock.Anything, "myapp", "550e8400-e29b-41d4-a716-446655440000", mock.Anything).Return(int64(len(chunkData)), nil)	296	+	registrySvc.EXPECT().AppendBlobChunk(mock.Anything, "myapp", "550e8400-e29b-41d4-a716-446655440000", mock.Anything, mock.Anything, mock.Anything).Return(int64(len(chunkData)), nil)
297			297
298		req := httptest.NewRequest("PATCH", "/v2/myapp/blobs/uploads/550e8400-e29b-41d4-a716-446655440000", bytes.NewReader(chunkData))	298		req := httptest.NewRequest("PATCH", "/v2/myapp/blobs/uploads/550e8400-e29b-41d4-a716-446655440000", bytes.NewReader(chunkData))
299		rec := httptest.NewRecorder()	299		rec := httptest.NewRecorder()

@@ -310,7 +310,7 @@ func TestHandler_BlobUpload_PUT_Finalize(t *testing.T) {
310		handler := NewHandler(registrySvc, testLogger(), DefaultMaxBlobChunkSize)	310		handler := NewHandler(registrySvc, testLogger(), DefaultMaxBlobChunkSize)
311			311
312		chunkData := []byte("final chunk")	312		chunkData := []byte("final chunk")
313	-	registrySvc.EXPECT().AppendBlobChunk(mock.Anything, "myapp", "550e8400-e29b-41d4-a716-446655440000", mock.Anything).Return(int64(len(chunkData)), nil)	313	+	registrySvc.EXPECT().AppendBlobChunk(mock.Anything, "myapp", "550e8400-e29b-41d4-a716-446655440000", mock.Anything, mock.Anything, mock.Anything).Return(int64(len(chunkData)), nil)
314		registrySvc.EXPECT().FinishUpload(mock.Anything, "550e8400-e29b-41d4-a716-446655440000", "sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4").Return(nil)	314		registrySvc.EXPECT().FinishUpload(mock.Anything, "550e8400-e29b-41d4-a716-446655440000", "sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4").Return(nil)
315			315
316		req := httptest.NewRequest("PUT", "/v2/myapp/blobs/uploads/550e8400-e29b-41d4-a716-446655440000?digest=sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4", bytes.NewReader(chunkData))	316		req := httptest.NewRequest("PUT", "/v2/myapp/blobs/uploads/550e8400-e29b-41d4-a716-446655440000?digest=sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4", bytes.NewReader(chunkData))

@@ -432,7 +432,7 @@ func TestHandler_BlobUpload_PATCH_ReturnsDockerUploadUUID(t *testing.T) {
432		handler := NewHandler(registrySvc, testLogger(), DefaultMaxBlobChunkSize)	432		handler := NewHandler(registrySvc, testLogger(), DefaultMaxBlobChunkSize)
433			433
434		chunkData := []byte("chunk content")	434		chunkData := []byte("chunk content")
435	-	registrySvc.EXPECT().AppendBlobChunk(mock.Anything, "myapp", "550e8400-e29b-41d4-a716-446655440000", mock.Anything).Return(int64(len(chunkData)), nil)	435	+	registrySvc.EXPECT().AppendBlobChunk(mock.Anything, "myapp", "550e8400-e29b-41d4-a716-446655440000", mock.Anything, mock.Anything, mock.Anything).Return(int64(len(chunkData)), nil)
436			436
437		req := httptest.NewRequest("PATCH", "/v2/myapp/blobs/uploads/550e8400-e29b-41d4-a716-446655440000", bytes.NewReader(chunkData))	437		req := httptest.NewRequest("PATCH", "/v2/myapp/blobs/uploads/550e8400-e29b-41d4-a716-446655440000", bytes.NewReader(chunkData))
438		rec := httptest.NewRecorder()	438		rec := httptest.NewRecorder()

@@ -453,12 +453,14 @@ func TestHandler_BlobUpload_PATCH_RespectsConfiguredMaxBlobChunkSize(t *testing.
453			453
454		// The handler wraps r.Body in MaxBytesReader and passes it to AppendBlobChunk.	454		// The handler wraps r.Body in MaxBytesReader and passes it to AppendBlobChunk.
455		// The mock must read the body to trigger MaxBytesError, which the handler detects.	455		// The mock must read the body to trigger MaxBytesError, which the handler detects.
456	-	registrySvc.EXPECT().AppendBlobChunk(mock.Anything, "myapp", "550e8400-e29b-41d4-a716-446655440000", mock.Anything).	456	+	registrySvc.EXPECT().AppendBlobChunk(mock.Anything, "myapp", "550e8400-e29b-41d4-a716-446655440000", mock.Anything, mock.Anything, mock.Anything).
457	-	Run(func(_ context.Context, _ string, _ string, data io.Reader) {	457	+	Run(func(_ context.Context, _ string, _ string, data io.Reader, _ int64, _ int64) {
458	-	// Drain the reader to trigger MaxBytesError	458	+	// Drain the reader to trigger MaxBytesError after the storage layer may
			459	+	// have written the limit-sized prefix.
459		_, _ = io.ReadAll(data)	460		_, _ = io.ReadAll(data)
460		}).	461		}).
461		Return(int64(0), &http.MaxBytesError{Limit: 5})	462		Return(int64(0), &http.MaxBytesError{Limit: 5})
			463	+	registrySvc.EXPECT().CancelUpload(mock.Anything, "550e8400-e29b-41d4-a716-446655440000").Return(nil)
462			464
463		req := httptest.NewRequest("PATCH", "/v2/myapp/blobs/uploads/550e8400-e29b-41d4-a716-446655440000", bytes.NewReader([]byte("chunk content")))	465		req := httptest.NewRequest("PATCH", "/v2/myapp/blobs/uploads/550e8400-e29b-41d4-a716-446655440000", bytes.NewReader([]byte("chunk content")))
464		rec := httptest.NewRecorder()	466		rec := httptest.NewRecorder()

@@ -473,7 +475,7 @@ func TestHandler_BlobUpload_PATCH_ReturnsRangeHeader(t *testing.T) {
473		handler := NewHandler(registrySvc, testLogger(), DefaultMaxBlobChunkSize)	475		handler := NewHandler(registrySvc, testLogger(), DefaultMaxBlobChunkSize)
474			476
475		chunkData := []byte("chunk content")	477		chunkData := []byte("chunk content")
476	-	registrySvc.EXPECT().AppendBlobChunk(mock.Anything, "myapp", "550e8400-e29b-41d4-a716-446655440000", mock.Anything).Return(int64(len(chunkData)), nil)	478	+	registrySvc.EXPECT().AppendBlobChunk(mock.Anything, "myapp", "550e8400-e29b-41d4-a716-446655440000", mock.Anything, mock.Anything, mock.Anything).Return(int64(len(chunkData)), nil)
477			479
478		req := httptest.NewRequest("PATCH", "/v2/myapp/blobs/uploads/550e8400-e29b-41d4-a716-446655440000", bytes.NewReader(chunkData))	480		req := httptest.NewRequest("PATCH", "/v2/myapp/blobs/uploads/550e8400-e29b-41d4-a716-446655440000", bytes.NewReader(chunkData))
479		rec := httptest.NewRecorder()	481		rec := httptest.NewRecorder()

@@ -484,3 +486,77 @@ func TestHandler_BlobUpload_PATCH_ReturnsRangeHeader(t *testing.T) {
484		// OCI spec: Range header should reflect total received bytes	486		// OCI spec: Range header should reflect total received bytes
485		assert.Equal(t, "0-12", rec.Header().Get("Range"))	487		assert.Equal(t, "0-12", rec.Header().Get("Range"))
486		}	488		}
			489	+
			490	+	func TestDefaultMaxBlobSize_Is1GB(t *testing.T) {
			491	+	assert.Equal(t, int64(102410241024), int64(DefaultMaxBlobSize))
			492	+	}
			493	+
			494	+	func TestHandler_BlobUpload_PATCH_MaxBlobSizeExceededReturnsSizeInvalidAndCancels(t *testing.T) {
			495	+	registrySvc := inmocks.NewMockRegistryService(t)
			496	+	handler := NewHandler(registrySvc, testLogger(), DefaultMaxBlobChunkSize, 10)
			497	+
			498	+	registrySvc.EXPECT().AppendBlobChunk(
			499	+	mock.Anything,
			500	+	"myapp",
			501	+	"550e8400-e29b-41d4-a716-446655440000",
			502	+	mock.Anything,
			503	+	int64(6),
			504	+	int64(10),
			505	+	).Return(int64(0), domain.ErrBlobSizeExceeded)
			506	+	registrySvc.EXPECT().CancelUpload(mock.Anything, "550e8400-e29b-41d4-a716-446655440000").Return(nil)
			507	+
			508	+	req := httptest.NewRequest("PATCH", "/v2/myapp/blobs/uploads/550e8400-e29b-41d4-a716-446655440000", bytes.NewReader([]byte("123456")))
			509	+	rec := httptest.NewRecorder()
			510	+
			511	+	handler.ServeHTTP(rec, req)
			512	+
			513	+	assert.Equal(t, http.StatusRequestEntityTooLarge, rec.Code)
			514	+	assert.Contains(t, rec.Body.String(), "SIZE_INVALID")
			515	+	}
			516	+
			517	+	func TestHandler_BlobUpload_PATCH_ContentLengthTooLargeReturnsSizeInvalidAndCancels(t *testing.T) {
			518	+	registrySvc := inmocks.NewMockRegistryService(t)
			519	+	handler := NewHandler(registrySvc, testLogger(), DefaultMaxBlobChunkSize, 10)
			520	+
			521	+	registrySvc.EXPECT().AppendBlobChunk(
			522	+	mock.Anything,
			523	+	"myapp",
			524	+	"550e8400-e29b-41d4-a716-446655440000",
			525	+	mock.Anything,
			526	+	int64(11),
			527	+	int64(10),
			528	+	).Return(int64(0), domain.ErrBlobSizeExceeded)
			529	+	registrySvc.EXPECT().CancelUpload(mock.Anything, "550e8400-e29b-41d4-a716-446655440000").Return(nil)
			530	+
			531	+	req := httptest.NewRequest("PATCH", "/v2/myapp/blobs/uploads/550e8400-e29b-41d4-a716-446655440000", bytes.NewReader([]byte("12345678901")))
			532	+	rec := httptest.NewRecorder()
			533	+
			534	+	handler.ServeHTTP(rec, req)
			535	+
			536	+	assert.Equal(t, http.StatusRequestEntityTooLarge, rec.Code)
			537	+	assert.Contains(t, rec.Body.String(), "SIZE_INVALID")
			538	+	}
			539	+
			540	+	func TestHandler_BlobUpload_PUT_FinalizeUnderMaxBlobSize(t *testing.T) {
			541	+	registrySvc := inmocks.NewMockRegistryService(t)
			542	+	handler := NewHandler(registrySvc, testLogger(), DefaultMaxBlobChunkSize, 10)
			543	+
			544	+	chunkData := []byte("1234567890")
			545	+	registrySvc.EXPECT().AppendBlobChunk(
			546	+	mock.Anything,
			547	+	"myapp",
			548	+	"550e8400-e29b-41d4-a716-446655440000",
			549	+	mock.Anything,
			550	+	int64(len(chunkData)),
			551	+	int64(10),
			552	+	).Return(int64(len(chunkData)), nil)
			553	+	registrySvc.EXPECT().FinishUpload(mock.Anything, "550e8400-e29b-41d4-a716-446655440000", "sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4").Return(nil)
			554	+
			555	+	req := httptest.NewRequest("PUT", "/v2/myapp/blobs/uploads/550e8400-e29b-41d4-a716-446655440000?digest=sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4", bytes.NewReader(chunkData))
			556	+	rec := httptest.NewRecorder()
			557	+
			558	+	handler.ServeHTTP(rec, req)
			559	+
			560	+	assert.Equal(t, http.StatusCreated, rec.Code)
			561	+	assert.Equal(t, "sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4", rec.Header().Get("Docker-Content-Digest"))
			562	+	}

M internal/adapters/out/docker/runtime.go +64 -51


@@ -161,6 +161,7 @@ func (r Runtime) CreateContainer(ctx context.Context, config domain.ContainerC
161		WorkingDir: config.WorkingDir,	161		WorkingDir: config.WorkingDir,
162		Cmd: config.Cmd,	162		Cmd: config.Cmd,
163		Labels: config.Labels,	163		Labels: config.Labels,
			164	+	User: config.User,
164		}	165		}
165			166
166		resources := container.Resources{	167		resources := container.Resources{

@@ -173,20 +174,24 @@ func (r Runtime) CreateContainer(ctx context.Context, config domain.ContainerC
173		if config.PidsLimit > 0 {	174		if config.PidsLimit > 0 {
174		resources.PidsLimit = &config.PidsLimit	175		resources.PidsLimit = &config.PidsLimit
175		}	176		}
			177	+	capDrop := strslice.StrSlice{"ALL"}
			178	+	capAdd := strslice.StrSlice{"CHOWN", "DAC_OVERRIDE", "FOWNER", "SETUID", "SETGID", "NET_BIND_SERVICE"}
			179	+	if config.CapDrop != nil {
			180	+	capDrop = strslice.StrSlice(config.CapDrop)
			181	+	}
			182	+	if config.CapAdd != nil {
			183	+	capAdd = strslice.StrSlice(config.CapAdd)
			184	+	}
176		hostConfig := &container.HostConfig{	185		hostConfig := &container.HostConfig{
177	-	PortBindings: portBindings,	186	+	PortBindings: portBindings,
178	-	AutoRemove: config.AutoRemove,	187	+	AutoRemove: config.AutoRemove,
179	-	Binds: binds,	188	+	Binds: binds,
180	-	NetworkMode: container.NetworkMode(config.NetworkMode),	189	+	NetworkMode: container.NetworkMode(config.NetworkMode),
181	-	Resources: resources,	190	+	Resources: resources,
182	-	SecurityOpt: []string{"no-new-privileges:true"},	191	+	SecurityOpt: []string{"no-new-privileges:true"},
183	-	CapDrop: strslice.StrSlice{"ALL"},	192	+	CapDrop: capDrop,
184	-	// Re-add the minimal set of capabilities that standard images need.	193	+	CapAdd: capAdd,
185	-	// CHOWN/FOWNER/DAC_OVERRIDE: postgres, mysql etc. chown/chmod data dirs	194	+	ReadonlyRootfs: config.ReadOnlyRootFS,
186	-	// owned by their service user during entrypoint init.
187	-	// SETUID/SETGID: gosu/su-exec to drop privileges after init.
188	-	// NET_BIND_SERVICE: nginx etc. binding to ports < 1024.
189	-	CapAdd: strslice.StrSlice{"CHOWN", "DAC_OVERRIDE", "FOWNER", "SETUID", "SETGID", "NET_BIND_SERVICE"},
190		}	195		}
191			196
192		// Create network configuration for container	197		// Create network configuration for container

@@ -1251,7 +1256,7 @@ func (r *Runtime) GetImageID(ctx context.Context, imageRef string) (string, erro
1251		}	1256		}
1252			1257
1253		// CreateNetwork creates a new Docker network.	1258		// CreateNetwork creates a new Docker network.
1254	-	func (r *Runtime) CreateNetwork(ctx context.Context, name string, options map[string]string) error {	1259	+	func (r *Runtime) CreateNetwork(ctx context.Context, name string, config domain.NetworkConfig) error {
1255		ctx = zerowrap.CtxWithFields(ctx, map[string]any{	1260		ctx = zerowrap.CtxWithFields(ctx, map[string]any{
1256		zerowrap.FieldLayer: "adapter",	1261		zerowrap.FieldLayer: "adapter",
1257		zerowrap.FieldAdapter: "docker",	1262		zerowrap.FieldAdapter: "docker",

@@ -1260,24 +1265,20 @@ func (r *Runtime) CreateNetwork(ctx context.Context, name string, options map[st
1260		})	1265		})
1261		log := zerowrap.FromCtx(ctx)	1266		log := zerowrap.FromCtx(ctx)
1262			1267
1263	-	// Set default driver to bridge if not specified	1268	+	driver := config.Driver
1264	-	driver := "bridge"	1269	+	if driver == "" {
1265	-	if driverOption, exists := options["driver"]; exists {	1270	+	driver = "bridge"
1266	-	driver = driverOption
1267		}	1271		}
1268	-		1272	+	labels := make(map[string]string, len(config.Labels)+1)
1269	-	createOptions := network.CreateOptions{	1273	+	for key, value := range config.Labels {
1270	-	Driver: driver,	1274	+	labels[key] = value
1271	-	Labels: map[string]string{
1272	-	domain.LabelManaged: "true",
1273	-	},
1274		}	1275		}
			1276	+	labels[domain.LabelManaged] = "true"
1275			1277
1276	-	// Add any additional options to labels	1278	+	createOptions := network.CreateOptions{
1277	-	for key, value := range options {	1279	+	Driver: driver,
1278	-	if key != "driver" {	1280	+	Internal: config.Internal,
1279	-	createOptions.Labels["gordon."+key] = value	1281	+	Labels: labels,
1280	-	}
1281		}	1282		}
1282			1283
1283		_, err := r.client.NetworkCreate(ctx, name, createOptions)	1284		_, err := r.client.NetworkCreate(ctx, name, createOptions)

@@ -1503,10 +1504,7 @@ func (r *Runtime) CopyFromContainer(ctx context.Context, containerID, srcPath st
1503		// extractFileFromTar extracts a single file from a tar archive.	1504		// extractFileFromTar extracts a single file from a tar archive.
1504		func extractFileFromTar(reader io.ReadCloser, targetPath string) (io.ReadCloser, error) {	1505		func extractFileFromTar(reader io.ReadCloser, targetPath string) (io.ReadCloser, error) {
1505		tr := tar.NewReader(reader)	1506		tr := tar.NewReader(reader)
1506	-		1507	+	targetName := normalizedTarPath(targetPath)
1507	-	// The path in the tar may be relative or absolute
1508	-	// We need to match based on the filename
1509	-	targetName := filepath.Base(targetPath)
1510			1508
1511		for {	1509		for {
1512		header, err := tr.Next()	1510		header, err := tr.Next()

@@ -1517,23 +1515,19 @@ func extractFileFromTar(reader io.ReadCloser, targetPath string) (io.ReadCloser,
1517		return nil, err	1515		return nil, err
1518		}	1516		}
1519			1517
1520	-	// Check if this is our target file	1518	+	if header.Typeflag == tar.TypeReg && normalizedTarPath(header.Name) == targetName {
1521	-	if header.Typeflag == tar.TypeReg {	1519	+	size := header.Size
1522	-	headerName := filepath.Base(header.Name)	1520	+	pr, pw := io.Pipe()
1523	-	if headerName == targetName {	1521	+	go func() {
1524	-	size := header.Size	1522	+	defer reader.Close()
1525	-	pr, pw := io.Pipe()	1523	+	_, copyErr := io.CopyN(pw, tr, size)
1526	-	go func() {	1524	+	if copyErr != nil {
1527	-	defer reader.Close()	1525	+	_ = pw.CloseWithError(copyErr)
1528	-	_, copyErr := io.CopyN(pw, tr, size)	1526	+	return
1529	-	if copyErr != nil {	1527	+	}
1530	-	_ = pw.CloseWithError(copyErr)	1528	+	_ = pw.Close()
1531	-	return	1529	+	}()
1532	-	}	1530	+	return &pipeReadCloser{pr: pr, pw: pw, original: reader}, nil
1533	-	_ = pw.Close()
1534	-	}()
1535	-	return &pipeReadCloser{pr: pr, pw: pw, original: reader}, nil
1536	-	}
1537		}	1531		}
1538		}	1532		}
1539			1533

@@ -1541,6 +1535,25 @@ func extractFileFromTar(reader io.ReadCloser, targetPath string) (io.ReadCloser,
1541		return nil, fmt.Errorf("file not found in container: %s", targetPath)	1535		return nil, fmt.Errorf("file not found in container: %s", targetPath)
1542		}	1536		}
1543			1537
			1538	+	func normalizedTarPath(path string) string {
			1539	+	path = filepath.ToSlash(filepath.Clean(path))
			1540	+	return strings.TrimPrefix(path, "/")
			1541	+	}
			1542	+
			1543	+	const maxExtractedEnvFileSize = 1 << 20 // 1 MiB
			1544	+
			1545	+	func readExtractedEnvFile(reader io.Reader) ([]byte, error) {
			1546	+	limited := io.LimitReader(reader, maxExtractedEnvFileSize+1)
			1547	+	data, err := io.ReadAll(limited)
			1548	+	if err != nil {
			1549	+	return nil, err
			1550	+	}
			1551	+	if len(data) > maxExtractedEnvFileSize {
			1552	+	return nil, fmt.Errorf("extracted env file exceeds %d bytes", maxExtractedEnvFileSize)
			1553	+	}
			1554	+	return data, nil
			1555	+	}
			1556	+
1544		// ExtractEnvFileFromImage extracts an env file from an image.	1557		// ExtractEnvFileFromImage extracts an env file from an image.
1545		// This creates a temporary container, copies the file, and removes the container.	1558		// This creates a temporary container, copies the file, and removes the container.
1546		func (r *Runtime) ExtractEnvFileFromImage(ctx context.Context, imageRef, envFilePath string) ([]byte, error) {	1559		func (r *Runtime) ExtractEnvFileFromImage(ctx context.Context, imageRef, envFilePath string) ([]byte, error) {

@@ -1583,7 +1596,7 @@ func (r *Runtime) ExtractEnvFileFromImage(ctx context.Context, imageRef, envFile
1583		}	1596		}
1584		defer reader.Close()	1597		defer reader.Close()
1585			1598
1586	-	data, err := io.ReadAll(reader)	1599	+	data, err := readExtractedEnvFile(reader)
1587		if err != nil {	1600		if err != nil {
1588		return nil, log.WrapErr(err, "failed to read extracted env file")	1601		return nil, log.WrapErr(err, "failed to read extracted env file")
1589		}	1602		}

M internal/adapters/out/docker/runtime_exec_test.go +30 -0

@@ -1,9 +1,12 @@
1	package docker	1		package docker
2		2
3	import (	3		import (
		4	+	"archive/tar"
4	"bytes"	5		"bytes"
5	"context"	6		"context"
6	"encoding/binary"	7		"encoding/binary"
		8	+	"io"
		9	+	"strings"
7	"testing"	10		"testing"
8		11
9	"github.com/stretchr/testify/assert"	12		"github.com/stretchr/testify/assert"

@@ -47,3 +50,30 @@ func frameDockerStream(streamID byte, payload []byte) []byte {
47	copy(frame[8:], payload)	50		copy(frame[8:], payload)
48	return frame	51		return frame
49	}	52		}
		53	+
		54	+	func TestExtractFileFromTarMatchesFullCleanPath(t *testing.T) {
		55	+	var buf bytes.Buffer
		56	+	tw := tar.NewWriter(&buf)
		57	+	require.NoError(t, tw.WriteHeader(&tar.Header{Name: "other/.env", Typeflag: tar.TypeReg, Size: int64(len("wrong"))}))
		58	+	_, err := tw.Write([]byte("wrong"))
		59	+	require.NoError(t, err)
		60	+	require.NoError(t, tw.WriteHeader(&tar.Header{Name: "app/.env", Typeflag: tar.TypeReg, Size: int64(len("right"))}))
		61	+	_, err = tw.Write([]byte("right"))
		62	+	require.NoError(t, err)
		63	+	require.NoError(t, tw.Close())
		64	+
		65	+	rc, err := extractFileFromTar(io.NopCloser(bytes.NewReader(buf.Bytes())), "/app/.env")
		66	+	require.NoError(t, err)
		67	+	defer rc.Close()
		68	+
		69	+	data, err := io.ReadAll(rc)
		70	+	require.NoError(t, err)
		71	+	assert.Equal(t, "right", string(data))
		72	+	}
		73	+
		74	+	func TestReadExtractedEnvFileRejectsOversizedContent(t *testing.T) {
		75	+	data, err := readExtractedEnvFile(io.NopCloser(strings.NewReader(strings.Repeat("a", maxExtractedEnvFileSize+1))))
		76	+	require.Error(t, err)
		77	+	assert.Nil(t, data)
		78	+	assert.Contains(t, err.Error(), "exceeds")
		79	+	}

M internal/adapters/out/domainsecrets/pass_store.go +111 -0


@@ -8,6 +8,7 @@ import (
8	"regexp"	8		"regexp"
9	"sort"	9		"sort"
10	"strings"	10		"strings"
		11	+	"sync"
11	"time"	12		"time"
12		13
13	"github.com/bnema/zerowrap"	14		"github.com/bnema/zerowrap"

@@ -27,6 +28,7 @@ const (
27		28
28	// PassStore implements the DomainSecretStore interface using the pass password manager.	29		// PassStore implements the DomainSecretStore interface using the pass password manager.
29	type PassStore struct {	30		type PassStore struct {
		31	+	mu sync.Mutex
30	timeout time.Duration	32		timeout time.Duration
31	log zerowrap.Logger	33		log zerowrap.Logger
32	}	34		}

@@ -138,6 +140,26 @@ func (s *PassStore) GetAll(domainName string) (map[string]string, error) {
138	return secretsMap, nil	140		return secretsMap, nil
139	}	141		}
140		142
		143	+	// SetIfEmpty sets multiple secrets for a domain only when no keys already exist.
		144	+	// It performs the precondition check inside the store adapter so migration
		145	+	// callers cannot accidentally split the check and write into separate steps.
		146	+	func (s *PassStore) SetIfEmpty(domainName string, secretsMap map[string]string) ([]string, error) {
		147	+	s.mu.Lock()
		148	+	defer s.mu.Unlock()
		149	+
		150	+	existingKeys, err := s.ListKeys(domainName)
		151	+	if err != nil {
		152	+	return nil, err
		153	+	}
		154	+	if len(existingKeys) > 0 {
		155	+	return nil, fmt.Errorf("%w: pass secrets already exist for %s (found %d keys)", domain.ErrSecretsAlreadyExist, domainName, len(existingKeys))
		156	+	}
		157	+	if err := s.Set(domainName, secretsMap); err != nil {
		158	+	return nil, err
		159	+	}
		160	+	return sortedMapKeys(secretsMap), nil
		161	+	}
		162	+
141	// Set sets or updates multiple secrets for a domain.	163		// Set sets or updates multiple secrets for a domain.
142	func (s *PassStore) Set(domainName string, secretsMap map[string]string) error {	164		func (s *PassStore) Set(domainName string, secretsMap map[string]string) error {
143	if _, err := s.domainPath(domainName); err != nil {	165		if _, err := s.domainPath(domainName); err != nil {

@@ -253,6 +275,26 @@ func (s *PassStore) Delete(domainName, key string) error {
253	return nil	275		return nil
254	}	276		}
255		277
		278	+	// SetAttachmentIfEmpty sets attachment secrets only when no keys already exist.
		279	+	// It performs the precondition check inside the store adapter so migration
		280	+	// callers cannot accidentally split the check and write into separate steps.
		281	+	func (s *PassStore) SetAttachmentIfEmpty(containerName string, secretsMap map[string]string) ([]string, error) {
		282	+	s.mu.Lock()
		283	+	defer s.mu.Unlock()
		284	+
		285	+	existingKeys, err := s.listAttachmentKeysRecover(containerName)
		286	+	if err != nil {
		287	+	return nil, err
		288	+	}
		289	+	if len(existingKeys) > 0 {
		290	+	return nil, fmt.Errorf("%w: pass secrets already exist for attachment %s (found %d keys)", domain.ErrSecretsAlreadyExist, containerName, len(existingKeys))
		291	+	}
		292	+	if err := s.SetAttachment(containerName, secretsMap); err != nil {
		293	+	return nil, err
		294	+	}
		295	+	return sortedMapKeys(secretsMap), nil
		296	+	}
		297	+
256	// SetAttachment sets or updates multiple secrets for an attachment container.	298		// SetAttachment sets or updates multiple secrets for an attachment container.
257	func (s *PassStore) SetAttachment(containerName string, secretsMap map[string]string) error {	299		func (s *PassStore) SetAttachment(containerName string, secretsMap map[string]string) error {
258	if _, err := s.attachmentPath(containerName); err != nil {	300		if _, err := s.attachmentPath(containerName); err != nil {

@@ -613,6 +655,66 @@ func (s *PassStore) listAttachmentKeys(containerName string) ([]string, error) {
613	keys = append(keys, key)	655		keys = append(keys, key)
614	}	656		}
615		657
		658	+	sort.Strings(keys)
		659	+	return keys, nil
		660	+	}
		661	+
		662	+	func (s *PassStore) listAttachmentKeysRecover(containerName string) ([]string, error) {
		663	+	keys, err := s.listAttachmentKeys(containerName)
		664	+	if err != nil {
		665	+	return nil, err
		666	+	}
		667	+	discovered, err := s.discoverAttachmentKeys(containerName)
		668	+	if err != nil {
		669	+	return nil, err
		670	+	}
		671	+	merged, changed := mergeUniqueKeys(keys, discovered)
		672	+	if changed {
		673	+	manifestPath, err := s.attachmentManifestPath(containerName)
		674	+	if err != nil {
		675	+	return nil, err
		676	+	}
		677	+	writeCtx, writeCancel := context.WithTimeout(context.Background(), s.timeout)
		678	+	writeErr := s.passInsert(writeCtx, manifestPath, strings.Join(merged, "\n"))
		679	+	writeCancel()
		680	+	if writeErr != nil {
		681	+	s.log.Warn().
		682	+	Str(zerowrap.FieldLayer, "adapter").
		683	+	Str(zerowrap.FieldAdapter, "domainsecrets").
		684	+	Str("container", containerName).
		685	+	Err(writeErr).
		686	+	Msg("failed to self-heal attachment pass manifest, continuing with recovered keys")
		687	+	}
		688	+	}
		689	+	return merged, nil
		690	+	}
		691	+
		692	+	func (s *PassStore) discoverAttachmentKeys(containerName string) ([]string, error) {
		693	+	basePath, err := s.attachmentPath(containerName)
		694	+	if err != nil {
		695	+	return nil, err
		696	+	}
		697	+
		698	+	ctx, cancel := context.WithTimeout(context.Background(), s.timeout)
		699	+	defer cancel()
		700	+
		701	+	entries, err := s.listTopLevelEntries(ctx, basePath)
		702	+	if err != nil {
		703	+	return nil, err
		704	+	}
		705	+
		706	+	keys := make([]string, 0, len(entries))
		707	+	for _, entry := range entries {
		708	+	if entry == ".keys" {
		709	+	continue
		710	+	}
		711	+	if err := domain.ValidateEnvKey(entry); err != nil {
		712	+	continue
		713	+	}
		714	+	keys = append(keys, entry)
		715	+	}
		716	+
		717	+	sort.Strings(keys)
616	return keys, nil	718		return keys, nil
617	}	719		}
618		720

@@ -778,6 +880,15 @@ func passEntryMissing(output string) bool {
778	strings.Contains(lower, "password store is empty")	880		strings.Contains(lower, "password store is empty")
779	}	881		}
780		882
		883	+	func sortedMapKeys(values map[string]string) []string {
		884	+	keys := make([]string, 0, len(values))
		885	+	for key := range values {
		886	+	keys = append(keys, key)
		887	+	}
		888	+	sort.Strings(keys)
		889	+	return keys
		890	+	}
		891	+
781	func mergeUniqueKeys(primary, secondary []string) ([]string, bool) {	892		func mergeUniqueKeys(primary, secondary []string) ([]string, bool) {
782	mergedSet := make(map[string]struct{}, len(primary)+len(secondary))	893		mergedSet := make(map[string]struct{}, len(primary)+len(secondary))
783	for _, key := range primary {	894		for _, key := range primary {

M internal/adapters/out/filesystem/backup_storage.go +36 -4

 import (
 	"context"
+	"crypto/rand"
+	"encoding/hex"
 	"errors"
 	"fmt"
 	"io"
 		return "", fmt.Errorf("failed to create backup path: %w", err)
 	}
-	fileName := timestamp.UTC().Format(backupTimestampLayout) + ".bak"
+	fileName := timestamp.UTC().Format(time.RFC3339Nano) + "-" + randomBackupSuffix() + ".bak"
+	fileName = sanitizeBackupFileName(fileName)
 	finalPath := filepath.Join(backupDir, fileName)
 	tmpPath := finalPath + ".tmp"
-	f, err := os.OpenFile(tmpPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
+	f, err := os.OpenFile(tmpPath, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600)
 	if err != nil {
 		return "", fmt.Errorf("failed to create temp backup file: %w", err)
 	}
 		if walkErr != nil {
 			return walkErr
 		}
-		if d.IsDir() {
+		if d.IsDir() || !strings.HasSuffix(d.Name(), ".bak") {
 			return nil
 		}
 		startedAt := info.ModTime().UTC()
 		base := filepath.Base(path)
-		if ts, err := time.Parse(backupTimestampLayout+".bak", base); err == nil {
+		if ts, ok := parseBackupStartedAt(base); ok {
 			startedAt = ts.UTC()
 		}
 	}
 }
+func parseBackupStartedAt(base string) (time.Time, bool) {
+	if !strings.HasSuffix(base, ".bak") {
+		return time.Time{}, false
+	}
+	if ts, err := time.Parse(backupTimestampLayout+".bak", base); err == nil {
+		return ts, true
+	}
+	trimmed := strings.TrimSuffix(base, ".bak")
+	if idx := strings.LastIndex(trimmed, "-"); idx >= 0 {
+		trimmed = trimmed[:idx]
+	}
+	if ts, err := time.Parse(time.RFC3339Nano, strings.ReplaceAll(trimmed, "_", ":")); err == nil {
+		return ts, true
+	}
+	return time.Time{}, false
+}
+func randomBackupSuffix() string {
+	var b [8]byte
+	if _, err := rand.Read(b[:]); err != nil {
+		return fmt.Sprintf("%d", time.Now().UTC().UnixNano())
+	}
+	return hex.EncodeToString(b[:])
+}
+func sanitizeBackupFileName(input string) string {
+	return strings.NewReplacer(":", "_").Replace(input)
+}
 func sanitizeBackupPathComponent(input string) string {
 	clean := strings.TrimSpace(input)
 	if clean == "" {

M internal/adapters/out/filesystem/backup_storage_test.go +34 -1


@@ -31,6 +31,39 @@ func TestBackupStorage_StoreAndGet(t *testing.T) {
31		assert.Equal(t, payload, data)	31		assert.Equal(t, payload, data)
32		}	32		}
33			33
			34	+	func TestBackupStorage_StoreSameSecondBackupsUseDistinctFinalAndTempPaths(t *testing.T) {
			35	+	rootDir := t.TempDir()
			36	+	storage, err := NewBackupStorage(rootDir, testLogger())
			37	+	require.NoError(t, err)
			38	+
			39	+	now := time.Date(2026, 2, 7, 11, 0, 0, 0, time.UTC)
			40	+	firstPayload := []byte("first-backup")
			41	+	secondPayload := []byte("second-backup")
			42	+
			43	+	firstPath, err := storage.Store(context.Background(), "app.example.com", "postgres", domain.ScheduleDaily, now, bytes.NewReader(firstPayload))
			44	+	require.NoError(t, err)
			45	+	secondPath, err := storage.Store(context.Background(), "app.example.com", "postgres", domain.ScheduleDaily, now, bytes.NewReader(secondPayload))
			46	+	require.NoError(t, err)
			47	+
			48	+	assert.NotEqual(t, firstPath, secondPath)
			49	+	assert.NoFileExists(t, firstPath+".tmp")
			50	+	assert.NoFileExists(t, secondPath+".tmp")
			51	+
			52	+	firstRead, err := storage.Get(context.Background(), firstPath)
			53	+	require.NoError(t, err)
			54	+	defer firstRead.Close()
			55	+	firstData, err := io.ReadAll(firstRead)
			56	+	require.NoError(t, err)
			57	+	assert.Equal(t, firstPayload, firstData)
			58	+
			59	+	secondRead, err := storage.Get(context.Background(), secondPath)
			60	+	require.NoError(t, err)
			61	+	defer secondRead.Close()
			62	+	secondData, err := io.ReadAll(secondRead)
			63	+	require.NoError(t, err)
			64	+	assert.Equal(t, secondPayload, secondData)
			65	+	}
			66	+
34		func TestBackupStorage_ListWithScheduleFilter(t *testing.T) {	67		func TestBackupStorage_ListWithScheduleFilter(t *testing.T) {
35		storage, err := NewBackupStorage(t.TempDir(), testLogger())	68		storage, err := NewBackupStorage(t.TempDir(), testLogger())
36		require.NoError(t, err)	69		require.NoError(t, err)

@@ -71,7 +104,7 @@ func TestBackupStorage_ApplyRetention(t *testing.T) {
71		require.NoError(t, err)	104		require.NoError(t, err)
72			105
73		base := time.Date(2026, 2, 7, 6, 0, 0, 0, time.UTC)	106		base := time.Date(2026, 2, 7, 6, 0, 0, 0, time.UTC)
74	-	for i := 0; i < 4; i++ {	107	+	for i := range 4 {
75		_, err := storage.Store(context.Background(), "app.example.com", "postgres", domain.ScheduleDaily, base.Add(time.Duration(i)*time.Hour), bytes.NewReader([]byte("data")))	108		_, err := storage.Store(context.Background(), "app.example.com", "postgres", domain.ScheduleDaily, base.Add(time.Duration(i)*time.Hour), bytes.NewReader([]byte("data")))
76		require.NoError(t, err)	109		require.NoError(t, err)
77		}	110		}

M internal/adapters/out/filesystem/blob.go +24 -2

 	"github.com/bnema/zerowrap"
 	"github.com/google/uuid"
+	"github.com/bnema/gordon/internal/domain"
 	"github.com/bnema/gordon/pkg/validation"
 )
 }
 // AppendBlobChunk appends data to an in-progress upload.
-func (s *BlobStorage) AppendBlobChunk(name, uuid string, data io.Reader) (int64, error) {
+func (s *BlobStorage) AppendBlobChunk(name, uuid string, data io.Reader, contentLength, maxBlobSize int64) (int64, error) {
 	uploadPath, err := s.getUploadPath(uuid)
 	if err != nil {
 		return 0, fmt.Errorf("invalid upload path: %w", err)
 	}
 	defer file.Close()
+	fi, err := file.Stat()
+	if err != nil {
+		return 0, fmt.Errorf("failed to get file info: %w", err)
+	}
+	originalSize := fi.Size()
+	if maxBlobSize > 0 {
+		remaining := maxBlobSize - originalSize
+		if remaining < 0 || (contentLength >= 0 && contentLength > remaining) {
+			return 0, domain.ErrBlobSizeExceeded
+		}
+		data = io.LimitReader(data, remaining+1)
+	}
 	written, err := io.Copy(file, data)
 	if err != nil {
 		return 0, fmt.Errorf("failed to write chunk to upload file: %w", err)
 	}
-	fi, err := file.Stat()
+	if maxBlobSize > 0 && originalSize+written > maxBlobSize {
+		if err := file.Truncate(originalSize); err != nil {
+			return 0, fmt.Errorf("failed to truncate oversized upload: %w", err)
+		}
+		return 0, domain.ErrBlobSizeExceeded
+	}
+	fi, err = file.Stat()
 	if err != nil {
 		return 0, fmt.Errorf("failed to get file info: %w", err)
 	}

M internal/adapters/out/filesystem/blob_test.go +95 -12

 	"bytes"
 	"crypto/sha256"
 	"encoding/hex"
+	"errors"
 	"io"
 	"os"
 	"path/filepath"
 	"github.com/bnema/zerowrap"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"github.com/bnema/gordon/internal/domain"
 )
 const (
 	return zerowrap.Default()
 }
+type readFailer struct {
+	read bool
+}
+func (r *readFailer) Read(_ []byte) (int, error) {
+	r.read = true
+	return 0, io.ErrUnexpectedEOF
+}
 func TestNewBlobStorage(t *testing.T) {
 	tmpDir := t.TempDir()
 	log := testLogger()
 	// Append first chunk
 	chunk1 := []byte("first chunk")
-	size1, err := storage.AppendBlobChunk("myapp", uuid, bytes.NewReader(chunk1))
+	size1, err := storage.AppendBlobChunk("myapp", uuid, bytes.NewReader(chunk1), -1, 0)
 	require.NoError(t, err)
 	assert.Equal(t, int64(len(chunk1)), size1)
 	// Append second chunk
 	chunk2 := []byte(" second chunk")
-	size2, err := storage.AppendBlobChunk("myapp", uuid, bytes.NewReader(chunk2))
+	size2, err := storage.AppendBlobChunk("myapp", uuid, bytes.NewReader(chunk2), -1, 0)
 	require.NoError(t, err)
 	assert.Equal(t, int64(len(chunk1)+len(chunk2)), size2)
 }
 	storage, err := NewBlobStorage(tmpDir, log)
 	require.NoError(t, err)
-	_, err = storage.AppendBlobChunk("myapp", "00000000-0000-4000-a000-000000000000", bytes.NewReader([]byte("data")))
+	_, err = storage.AppendBlobChunk("myapp", "00000000-0000-4000-a000-000000000000", bytes.NewReader([]byte("data")), -1, 100)
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "upload not found")
 }
+func TestBlobStorage_AppendBlobChunk_MaxBlobSize(t *testing.T) {
+	tmpDir := t.TempDir()
+	log := testLogger()
+	storage, err := NewBlobStorage(tmpDir, log)
+	require.NoError(t, err)
+	uuid, err := storage.StartBlobUpload("myapp")
+	require.NoError(t, err)
+	size, err := storage.AppendBlobChunk("myapp", uuid, bytes.NewReader([]byte("12345")), -1, 10)
+	require.NoError(t, err)
+	assert.Equal(t, int64(5), size)
+	size, err = storage.AppendBlobChunk("myapp", uuid, bytes.NewReader([]byte("67890")), -1, 10)
+	require.NoError(t, err)
+	assert.Equal(t, int64(10), size)
+	_, err = storage.AppendBlobChunk("myapp", uuid, bytes.NewReader([]byte("x")), -1, 10)
+	require.Error(t, err)
+	assert.True(t, errors.Is(err, domain.ErrBlobSizeExceeded))
+	uploadPath := filepath.Join(tmpDir, "uploads", uuid)
+	info, statErr := os.Stat(uploadPath)
+	require.NoError(t, statErr)
+	assert.Equal(t, int64(10), info.Size())
+}
+func TestBlobStorage_AppendBlobChunk_MaxBlobSizeContentLengthTooLargeDoesNotRead(t *testing.T) {
+	tmpDir := t.TempDir()
+	log := testLogger()
+	storage, err := NewBlobStorage(tmpDir, log)
+	require.NoError(t, err)
+	uuid, err := storage.StartBlobUpload("myapp")
+	require.NoError(t, err)
+	_, err = storage.AppendBlobChunk("myapp", uuid, bytes.NewReader([]byte("12345")), 5, 10)
+	require.NoError(t, err)
+	reader := &readFailer{}
+	_, err = storage.AppendBlobChunk("myapp", uuid, reader, 6, 10)
+	require.Error(t, err)
+	assert.ErrorIs(t, err, domain.ErrBlobSizeExceeded)
+	assert.False(t, reader.read)
+}
+func TestBlobStorage_AppendBlobChunk_MaxBlobSizeOverflowMidReadTruncates(t *testing.T) {
+	tmpDir := t.TempDir()
+	log := testLogger()
+	storage, err := NewBlobStorage(tmpDir, log)
+	require.NoError(t, err)
+	uuid, err := storage.StartBlobUpload("myapp")
+	require.NoError(t, err)
+	_, err = storage.AppendBlobChunk("myapp", uuid, bytes.NewReader([]byte("12345")), -1, 10)
+	require.NoError(t, err)
+	_, err = storage.AppendBlobChunk("myapp", uuid, bytes.NewReader([]byte("6789012345")), -1, 10)
+	require.Error(t, err)
+	assert.True(t, errors.Is(err, domain.ErrBlobSizeExceeded))
+	uploadPath := filepath.Join(tmpDir, "uploads", uuid)
+	info, statErr := os.Stat(uploadPath)
+	require.NoError(t, statErr)
+	assert.Equal(t, int64(5), info.Size())
+}
 func TestBlobStorage_GetBlobUpload(t *testing.T) {
 	tmpDir := t.TempDir()
 	log := testLogger()
 	// Append data - content that hashes to testDigest1
 	blobData := []byte("complete blob content")
-	_, err = storage.AppendBlobChunk("myapp", uuid, bytes.NewReader(blobData))
+	_, err = storage.AppendBlobChunk("myapp", uuid, bytes.NewReader(blobData), -1, 0)
 	require.NoError(t, err)
 	// Finish upload - use testDigest1 (validation will pass, but hash won't match)
 	var totalSize int64
 	for _, chunk := range chunks {
-		size, err := storage.AppendBlobChunk(repoName, uuid, bytes.NewReader(chunk))
+		size, err := storage.AppendBlobChunk(repoName, uuid, bytes.NewReader(chunk), -1, 0)
 		require.NoError(t, err)
 		totalSize = size
 	}
 	require.NoError(t, err)
 	initialData := []byte("initial-")
-	_, err = storage.AppendBlobChunk("myapp", uuid, bytes.NewReader(initialData))
+	_, err = storage.AppendBlobChunk("myapp", uuid, bytes.NewReader(initialData), -1, 0)
 	require.NoError(t, err)
 	appendChunk := []byte("chunk")
 		go func() {
 			defer wg.Done()
 			<-appendReady
-			_, appendErr := storage.AppendBlobChunk("myapp", uuid, bytes.NewReader(appendChunk))
+			_, appendErr := storage.AppendBlobChunk("myapp", uuid, bytes.NewReader(appendChunk), -1, 0)
 			appendErrs <- appendErr
 		}()
 	}
 		assert.Equal(t, fullyAppended, blobData)
 	}
-	_, err = storage.AppendBlobChunk("myapp", uuid, bytes.NewReader([]byte("after")))
+	_, err = storage.AppendBlobChunk("myapp", uuid, bytes.NewReader([]byte("after")), -1, 0)
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "upload not found")
 }
 	require.NoError(t, err)
 	blobData := []byte("finalized content")
-	_, err = storage.AppendBlobChunk("myapp", uuid, bytes.NewReader(blobData))
+	_, err = storage.AppendBlobChunk("myapp", uuid, bytes.NewReader(blobData), -1, 0)
 	require.NoError(t, err)
 	err = storage.FinishBlobUpload(uuid, digestForData(blobData))
 	require.NoError(t, err)
-	_, err = storage.AppendBlobChunk("myapp", uuid, bytes.NewReader([]byte("more")))
+	_, err = storage.AppendBlobChunk("myapp", uuid, bytes.NewReader([]byte("more")), -1, 0)
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "upload not found")
 }
 	require.NoError(t, err)
 	blobData := []byte("retryable finalize")
-	_, err = storage.AppendBlobChunk("myapp", uuid, bytes.NewReader(blobData))
+	_, err = storage.AppendBlobChunk("myapp", uuid, bytes.NewReader(blobData), -1, 0)
 	require.NoError(t, err)
 	err = storage.FinishBlobUpload(uuid, testDigest1)
 	var blobData []byte
 	for _, chunk := range chunks {
 		blobData = append(blobData, chunk...)
-		_, err = storage.AppendBlobChunk("myapp", uuid, bytes.NewReader(chunk))
+		_, err = storage.AppendBlobChunk("myapp", uuid, bytes.NewReader(chunk), -1, 0)
 		require.NoError(t, err)
 	}

M internal/app/migrate_env.go +76 -71

@@ -1,6 +1,7 @@
1		package app	1		package app
2			2
3		import (	3		import (
			4	+	"errors"
4		"fmt"	5		"fmt"
5		"os"	6		"os"
6		"path/filepath"	7		"path/filepath"

@@ -79,59 +80,46 @@ func migrateEnvFile(envDir, name string, passStore *domainsecrets.PassStore, log
79		return nil	80		return nil
80		}	81		}
81			82
82	-	existingKeys, err := passStore.ListKeys(domainName)	83	+	writtenKeys, err := passStore.SetIfEmpty(domainName, secrets)
83		if err != nil {	84		if err != nil {
84	-	return fmt.Errorf("failed to read pass keys for %s: %w", domainName, err)	85	+	if errors.Is(err, domain.ErrSecretsAlreadyExist) {
85	-	}	86	+	return fmt.Errorf("%w; refusing to delete plaintext env file automatically", err)
86	-
87	-	missing := missingSecrets(existingKeys, secrets)
88	-	if len(missing) > 0 {
89	-	if err := passStore.Set(domainName, missing); err != nil {
90	-	return fmt.Errorf("failed to migrate secrets for %s: %w", domainName, err)
91		}	87		}
92	-	}	88	+	return fmt.Errorf("failed to migrate secrets for %s: %w", domainName, err)
93	-		89	+	}
94	-	migratedPath := filePath + ".migrated"	90	+
95	-	if err := os.Rename(filePath, migratedPath); err != nil {	91	+	if err := os.Remove(filePath); err != nil {
96	-	return fmt.Errorf("failed to rename env file %s: %w", filePath, err)	92	+	// Check if the stored secrets match what we just wrote
			93	+	storedSecrets, getErr := passStore.GetAll(domainName)
			94	+	if getErr == nil && secretsMatch(storedSecrets, secrets) {
			95	+	// Migration was successful, removal failed but secrets are stored
			96	+	log.Warn().
			97	+	Str("file", filePath).
			98	+	Str("domain", domainName).
			99	+	Msg("secrets migrated successfully but failed to remove original file; treating as success")
			100	+	return nil
			101	+	}
			102	+	// Attempt rollback: remove only the pass entries this migration wrote.
			103	+	for _, key := range writtenKeys {
			104	+	if delErr := passStore.Delete(domainName, key); delErr != nil {
			105	+	log.Error().
			106	+	Err(delErr).
			107	+	Str("domain", domainName).
			108	+	Str("key", key).
			109	+	Msg("failed to rollback pass entry after file removal failure")
			110	+	}
			111	+	}
			112	+	return fmt.Errorf("failed to remove migrated env file %s: %w", filePath, err)
97		}	113		}
98			114
99		log.Info().	115		log.Info().
100	-	Int(zerowrap.FieldCount, len(missing)).	116	+	Int(zerowrap.FieldCount, len(secrets)).
101		Str("domain", domainName).	117		Str("domain", domainName).
102	-	Msg("migrated secrets for domain from plain text to pass")	118	+	Msg("migrated secrets for domain from plain text to pass and removed original env file")
103	-	log.Info().
104	-	Str("file", migratedPath).
105	-	Msg("original file renamed to .env.migrated - you can safely remove it")
106			119
107		return nil	120		return nil
108		}	121		}
109			122
110	-	func missingSecrets(existingKeys []string, secrets map[string]string) map[string]string {
111	-	if len(secrets) == 0 {
112	-	return nil
113	-	}
114	-
115	-	existingSet := make(map[string]struct{}, len(existingKeys))
116	-	for _, key := range existingKeys {
117	-	existingSet[key] = struct{}{}
118	-	}
119	-
120	-	missing := make(map[string]string)
121	-	for key, value := range secrets {
122	-	if _, exists := existingSet[key]; exists {
123	-	continue
124	-	}
125	-	missing[key] = value
126	-	}
127	-
128	-	if len(missing) == 0 {
129	-	return nil
130	-	}
131	-
132	-	return missing
133	-	}
134	-
135		func migrateAttachmentEnvFilesToPass(envDir string, passStore *domainsecrets.PassStore, log zerowrap.Logger) error {	123		func migrateAttachmentEnvFilesToPass(envDir string, passStore *domainsecrets.PassStore, log zerowrap.Logger) error {
136		entries, err := readEnvDir(envDir)	124		entries, err := readEnvDir(envDir)
137		if err != nil {	125		if err != nil {

@@ -180,39 +168,43 @@ func migrateAttachmentEnvFile(envDir, name string, passStore *domainsecrets.Pass
180		return nil	168		return nil
181		}	169		}
182			170
183	-	existingSecrets, err := passStore.GetAllAttachment(containerName)	171	+	writtenKeys, err := passStore.SetAttachmentIfEmpty(containerName, secrets)
184		if err != nil {	172		if err != nil {
185	-	return fmt.Errorf("failed to read pass secrets for attachment %s: %w", containerName, err)	173	+	if errors.Is(err, domain.ErrSecretsAlreadyExist) {
186	-	}	174	+	return fmt.Errorf("%w; refusing to delete plaintext env file automatically", err)
187	-
188	-	existingKeys := make([]string, 0, len(existingSecrets))
189	-	for key := range existingSecrets {
190	-	existingKeys = append(existingKeys, key)
191	-	}
192	-
193	-	missing := missingSecrets(existingKeys, secrets)
194	-	if len(missing) > 0 {
195	-	if err := passStore.SetAttachment(containerName, missing); err != nil {
196	-	return fmt.Errorf("failed to migrate attachment secrets for %s: %w", containerName, err)
197		}	175		}
198	-	log.Info().	176	+	return fmt.Errorf("failed to migrate attachment secrets for %s: %w", containerName, err)
199	-	Int(zerowrap.FieldCount, len(missing)).	177	+	}
200	-	Str("container", containerName).	178	+
201	-	Msg("migrated secrets for attachment container from plain text to pass")	179	+	if err := os.Remove(filePath); err != nil {
202	-	} else {	180	+	// Check if the stored secrets match what we just wrote
203	-	log.Info().	181	+	storedSecrets, getErr := passStore.GetAllAttachment(containerName)
204	-	Str("container", containerName).	182	+	if getErr == nil && secretsMatch(storedSecrets, secrets) {
205	-	Msg("all attachment secrets already exist in pass; no migration needed")	183	+	// Migration was successful, removal failed but secrets are stored
206	-	}	184	+	log.Warn().
207	-		185	+	Str("file", filePath).
208	-	migratedPath := filePath + ".migrated"	186	+	Str("container", containerName).
209	-	if err := os.Rename(filePath, migratedPath); err != nil {	187	+	Msg("attachment secrets migrated successfully but failed to remove original file; treating as success")
210	-	return fmt.Errorf("failed to rename attachment env file %s: %w", filePath, err)	188	+	return nil
			189	+	}
			190	+	// Attempt rollback: remove only the pass entries this migration wrote.
			191	+	for _, key := range writtenKeys {
			192	+	if delErr := passStore.DeleteAttachment(containerName, key); delErr != nil {
			193	+	log.Error().
			194	+	Err(delErr).
			195	+	Str("container", containerName).
			196	+	Str("key", key).
			197	+	Msg("failed to rollback pass entry after file removal failure")
			198	+	}
			199	+	}
			200	+	return fmt.Errorf("failed to remove migrated attachment env file %s: %w", filePath, err)
211		}	201		}
212			202
213		log.Info().	203		log.Info().
214	-	Str("file", migratedPath).	204	+	Int(zerowrap.FieldCount, len(secrets)).
215	-	Msg("original attachment file renamed to .env.migrated - you can safely remove it")	205	+	Str("container", containerName).
			206	+	Str("file", filePath).
			207	+	Msg("migrated attachment secrets to pass and removed original env file")
216			208
217		return nil	209		return nil
218		}	210		}

@@ -221,3 +213,16 @@ func extractContainerNameFromAttachmentFile(filename string) string {
221		name := strings.TrimSuffix(filename, ".env")	213		name := strings.TrimSuffix(filename, ".env")
222		return name	214		return name
223		}	215		}
			216	+
			217	+	func secretsMatch(a, b map[string]string) bool {
			218	+	if len(a) != len(b) {
			219	+	return false
			220	+	}
			221	+	for k, v := range a {
			222	+	bv, ok := b[k]
			223	+	if !ok \|\| bv != v {
			224	+	return false
			225	+	}
			226	+	}
			227	+	return true
			228	+	}

M internal/app/migrate_env_test.go +4 -6

 	err = migrateEnvFile(tmpDir, envFileName, store, logger)
 	require.NoError(t, err)
-	migratedPath := envFilePath + ".migrated"
 	_, err = os.Stat(envFilePath)
 	assert.True(t, os.IsNotExist(err), "original .env file should be removed")
-	_, err = os.Stat(migratedPath)
+	_, err = os.Stat(envFilePath + ".migrated")
-	assert.NoError(t, err, ".env.migrated file should exist")
+	assert.True(t, os.IsNotExist(err), ".env.migrated plaintext should not be preserved by default")
 	passKeys, err := store.ListKeys(domainName)
 	require.NoError(t, err)
 	err = migrateAttachmentEnvFile(tmpDir, envFileName, store, logger)
 	require.NoError(t, err)
-	migratedPath := envFilePath + ".migrated"
 	_, err = os.Stat(envFilePath)
 	assert.True(t, os.IsNotExist(err), "original .env file should be removed")
-	_, err = os.Stat(migratedPath)
+	_, err = os.Stat(envFilePath + ".migrated")
-	assert.NoError(t, err, ".env.migrated file should exist")
+	assert.True(t, os.IsNotExist(err), ".env.migrated plaintext should not be preserved by default")
 	values, err := store.GetAllAttachment(storedContainerName)
 	require.NoError(t, err)

M internal/app/run.go +143 -27

 	"github.com/bnema/zerowrap"
 	zerowrapotel "github.com/bnema/zerowrap/otel"
 	"github.com/spf13/viper"
+	"golang.org/x/sys/unix"
 	// Adapters - Output
 	"github.com/bnema/gordon/internal/adapters/out/accesslog"
 		DataDir              string   `mapstructure:"data_dir"`
 		MaxProxyBodySize     string   `mapstructure:"max_proxy_body_size"`     // e.g., "512MB", "1GB"
 		MaxBlobChunkSize     string   `mapstructure:"max_blob_chunk_size"`     // e.g., "512MB", "1GB"
+		MaxBlobSize          string   `mapstructure:"max_blob_size"`           // e.g., "1GB", "2GB"
 		MaxProxyResponseSize string   `mapstructure:"max_proxy_response_size"` // e.g., "1GB", "0" for no limit
 		MaxConcurrentConns   int      `mapstructure:"max_concurrent_connections"`
 		RegistryAllowedIPs   []string `mapstructure:"registry_allowed_ips"`
 	} `mapstructure:"backups"`
 	Images struct {
-		Prune struct {
+		AllowedRegistries []string `mapstructure:"allowed_registries"`
+		RequireDigest     bool     `mapstructure:"require_digest"`
+		Prune             struct {
 			Enabled  bool   `mapstructure:"enabled"`
 			Schedule string `mapstructure:"schedule"`
 			KeepLast int    `mapstructure:"keep_last"`
 	} `mapstructure:"images"`
 	Containers struct {
-		MemoryLimit string  `mapstructure:"memory_limit"` // e.g., "512MB", "1GB"
+		MemoryLimit     string  `mapstructure:"memory_limit"`     // e.g., "512MB", "1GB"
-		CPULimit    float64 `mapstructure:"cpu_limit"`    // CPU cores, e.g., 1.0 = 1 core
+		CPULimit        float64 `mapstructure:"cpu_limit"`        // CPU cores, e.g., 1.0 = 1 core
-		PidsLimit   int64   `mapstructure:"pids_limit"`   // e.g., 512
+		PidsLimit       int64   `mapstructure:"pids_limit"`       // e.g., 512
+		SecurityProfile string  `mapstructure:"security_profile"` // compat or strict
 	} `mapstructure:"containers"`
 	Telemetry telemetry.Config `mapstructure:"telemetry"`
 	previewService    *preview.Service
 	envDir            string
 	maxBlobChunkSize  int64
+	maxBlobSize       int64
 	caAdapter         *pkiadapter.CA
 	pkiSvc            *pkiusecase.Service
 	reloadCoordinator *reloadCoordinator
+	registryHandler   interface {
+		UpdateBlobLimits(maxBlobChunkSize, maxBlobSize int64)
+	}
 }
 // Run initializes and starts the Gordon application.
 		return nil, err
 	}
-	si.svc.reloadCoordinator = newReloadCoordinator(v, si.svc.configSvc, si.svc.proxySvc, si.svc.eventBus, log)
+	si.svc.reloadCoordinator = newReloadCoordinator(v, si.svc.configSvc, si.svc.proxySvc, nil, si.svc.eventBus, log)
 	si.initHandlers()
 		return err
 	}
 	si.svc.maxBlobChunkSize = proxyCfg.maxBlobChunkSize
+	si.svc.maxBlobSize = proxyCfg.maxBlobSize
 	si.svc.proxySvc = proxy.NewService(si.svc.runtime, si.svc.containerSvc, si.svc.configSvc, proxyCfg.proxyConfig)
 	// Wire synchronous proxy cache invalidation for zero-downtime deployments.
 		provider := secrets.NewSopsProvider(log)
 		return provider.GetSecret(ctx, path)
 	case domain.SecretsBackendUnsafe:
-		// For unsafe backend, path is relative to dataDir/secrets/
+		// For unsafe backend, path is relative to dataDir/secrets/.
-		secretFile := filepath.Join(dataDir, "secrets", path)
+		return readUnsafeSecret(dataDir, path)
-		data, err := os.ReadFile(secretFile)
-		if err != nil {
-			return "", fmt.Errorf("failed to read secret file: %w", err)
-		}
-		return string(data), nil
 	default:
 		return "", fmt.Errorf("unknown secrets backend: %s", backend)
 	}
 }
+func readFileBeneath(root, cleanedRelPath string) ([]byte, error) {
+	rootFD, err := unix.Open(root, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0)
+	if err != nil {
+		return nil, fmt.Errorf("failed to open secrets root: %w", err)
+	}
+	defer unix.Close(rootFD)
+	parts := strings.Split(filepath.ToSlash(cleanedRelPath), "/")
+	dirFD := rootFD
+	var closeDirFDs []int
+	defer func() {
+		for i := len(closeDirFDs) - 1; i >= 0; i-- {
+			_ = unix.Close(closeDirFDs[i])
+		}
+	}()
+	for i, part := range parts {
+		if part == "" || part == "." || part == ".." {
+			return nil, fmt.Errorf("invalid secret path: path must stay under dataDir/secrets")
+		}
+		last := i == len(parts)-1
+		if last {
+			fd, err := unix.Openat(dirFD, part, unix.O_RDONLY|unix.O_NONBLOCK|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0)
+			if err != nil {
+				return nil, fmt.Errorf("failed to read secret file: %w", err)
+			}
+			defer unix.Close(fd)
+			var st unix.Stat_t
+			if err := unix.Fstat(fd, &st); err != nil {
+				return nil, fmt.Errorf("failed to stat secret file: %w", err)
+			}
+			if st.Mode&unix.S_IFMT != unix.S_IFREG {
+				return nil, fmt.Errorf("invalid secret path: secret must be a regular file")
+			}
+			data, err := os.ReadFile(fmt.Sprintf("/proc/self/fd/%d", fd))
+			if err != nil {
+				return nil, fmt.Errorf("failed to read secret file: %w", err)
+			}
+			return data, nil
+		}
+		nextFD, err := unix.Openat(dirFD, part, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0)
+		if err != nil {
+			return nil, fmt.Errorf("failed to open secret path component: %w", err)
+		}
+		closeDirFDs = append(closeDirFDs, nextFD)
+		dirFD = nextFD
+	}
+	return nil, fmt.Errorf("invalid secret path: empty path")
+}
+func readUnsafeSecret(dataDir, secretPath string) (string, error) {
+	if filepath.IsAbs(secretPath) {
+		return "", fmt.Errorf("invalid secret path: absolute paths are not allowed")
+	}
+	cleaned := filepath.Clean(secretPath)
+	if cleaned == "." || cleaned == ".." || strings.HasPrefix(cleaned, ".."+string(filepath.Separator)) {
+		return "", fmt.Errorf("invalid secret path: path must stay under dataDir/secrets")
+	}
+	root := filepath.Clean(filepath.Join(dataDir, "secrets"))
+	data, err := readFileBeneath(root, cleaned)
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}
 // proxyConfigResult holds parsed proxy and blob chunk size config.
 type proxyConfigResult struct {
 	proxyConfig      proxy.Config
 	maxBlobChunkSize int64
+	maxBlobSize      int64
 }
 type configWatcher interface {
 	lastRun  time.Time
 	debounce time.Duration
-	configSvc configReloader
+	configSvc      configReloader
-	v         *viper.Viper
+	v              *viper.Viper
-	proxySvc  proxyConfigUpdater
+	proxySvc       proxyConfigUpdater
-	eventBus  out.EventPublisher
+	registryLimits interface {
-	log       zerowrap.Logger
+		UpdateBlobLimits(maxBlobChunkSize, maxBlobSize int64)
+	}
+	eventBus out.EventPublisher
+	log      zerowrap.Logger
 }
-func newReloadCoordinator(v *viper.Viper, configSvc configReloader, proxySvc proxyConfigUpdater, eventBus out.EventPublisher, log zerowrap.Logger) *reloadCoordinator {
+func newReloadCoordinator(v *viper.Viper, configSvc configReloader, proxySvc proxyConfigUpdater, registryLimits interface {
+	UpdateBlobLimits(maxBlobChunkSize, maxBlobSize int64)
+}, eventBus out.EventPublisher, log zerowrap.Logger) *reloadCoordinator {
 	return &reloadCoordinator{
-		debounce:  500 * time.Millisecond,
+		debounce:       500 * time.Millisecond,
-		configSvc: configSvc,
+		configSvc:      configSvc,
-		v:         v,
+		v:              v,
-		proxySvc:  proxySvc,
+		proxySvc:       proxySvc,
-		eventBus:  eventBus,
+		registryLimits: registryLimits,
-		log:       log,
+		eventBus:       eventBus,
+		log:            log,
 	}
 }
+func (c *reloadCoordinator) SetRegistryLimits(limits interface {
+	UpdateBlobLimits(maxBlobChunkSize, maxBlobSize int64)
+}) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.registryLimits = limits
+}
 func (c *reloadCoordinator) Trigger(ctx context.Context) error {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	}
 	c.proxySvc.UpdateConfig(reloadedProxy.proxyConfig)
+	if c.registryLimits != nil {
+		c.registryLimits.UpdateBlobLimits(reloadedProxy.maxBlobChunkSize, reloadedProxy.maxBlobSize)
+	}
 	if c.eventBus != nil {
 		if err := c.eventBus.Publish(domain.EventConfigReload, nil); err != nil {
 		maxBlobChunkSize = parsedSize
 	}
+	maxBlobSize := int64(registry.DefaultMaxBlobSize)
+	if cfg.Server.MaxBlobSize != "" {
+		parsedSize, err := bytesize.Parse(cfg.Server.MaxBlobSize)
+		if err != nil {
+			return nil, log.WrapErrWithFields(err, "invalid server.max_blob_size configuration", map[string]any{"value": cfg.Server.MaxBlobSize})
+		}
+		maxBlobSize = parsedSize
+	}
 	maxProxyResponseSize := int64(1 << 30) // 1GB default
 	if cfg.Server.MaxProxyResponseSize != "" {
 		parsedSize, err := bytesize.Parse(cfg.Server.MaxProxyResponseSize)
 			MaxConcurrentConns: maxConcurrentConns,
 		},
 		maxBlobChunkSize: maxBlobChunkSize,
+		maxBlobSize:      maxBlobSize,
 	}, nil
 }
 		NetworkIsolation:           v.GetBool("network_isolation.enabled"),
 		NetworkPrefix:              v.GetString("network_isolation.network_prefix"),
 		NetworkGroups:              attachmentConfig.NetworkGroups,
+		NetworkInternal:            v.GetBool("network_isolation.internal"),
 		Attachments:                attachmentConfig.Attachments,
+		AllowedRegistries:          cfg.Images.AllowedRegistries,
+		RequireImageDigest:         cfg.Images.RequireDigest,
+		SecurityProfile:            cfg.Containers.SecurityProfile,
 		ReadinessDelay:             v.GetDuration("deploy.readiness_delay"),
 		ReadinessMode:              v.GetString("deploy.readiness_mode"),
 		HealthTimeout:              v.GetDuration("deploy.health_timeout"),
 	// This ensures consistent IP extraction across logging, rate limiting, and auth.
 	trustedNets := httphelper.ParseTrustedProxies(cfg.API.RateLimit.TrustedProxies)
-	// Registry handler (unchanged)
+	// Registry handler
-	registryHandler := registry.NewHandler(svc.registrySvc, log, svc.maxBlobChunkSize)
+	registryHandler := registry.NewHandler(svc.registrySvc, log, svc.maxBlobChunkSize, svc.maxBlobSize)
+	svc.registryHandler = registryHandler
+	if svc.reloadCoordinator != nil {
+		svc.reloadCoordinator.SetRegistryLimits(registryHandler)
+	}
 	registryWithMiddleware, cidrAllowlistMiddleware, rateLimitMiddleware := buildRegistryHandlerWithMiddleware(
 		svc,
 		cfg,
 		middleware.PanicRecovery(log),
 		middleware.RequestLogger(log, trustedNets),
 		middleware.SecurityHeaders,
-		middleware.HTTPSRedirect(proxyAllowedNets, cfg.Server.Port, cfg.Server.TLSPort, cfg.Server.ForceHTTPSRedirect, log),
+		middleware.HTTPSRedirect(proxyAllowedNets, cfg.Server.Port, cfg.Server.TLSPort, cfg.Server.ForceHTTPSRedirect, log, func(host string) bool {
+			return svc.proxySvc.IsKnownHost(context.Background(), host)
+		}),
 	}
 	if proxyCIDRMiddleware != nil {
 		httpProxyMiddlewares = append(httpProxyMiddlewares, proxyCIDRMiddleware)
 	v.SetDefault("auto_route.enabled", false)
 	v.SetDefault("network_isolation.enabled", true)
 	v.SetDefault("network_isolation.network_prefix", "gordon")
+	v.SetDefault("network_isolation.internal", false)
 	v.SetDefault("volumes.auto_create", true)
 	v.SetDefault("volumes.prefix", "gordon")
 	v.SetDefault("volumes.preserve", true)
 	v.SetDefault("backups.retention.daily", 0)
 	v.SetDefault("backups.retention.weekly", 0)
 	v.SetDefault("backups.retention.monthly", 0)
+	v.SetDefault("images.allowed_registries", []string{})
+	v.SetDefault("images.require_digest", false)
 	v.SetDefault("images.prune.enabled", false)
 	v.SetDefault("images.prune.schedule", string(domain.ScheduleDaily))
 	v.SetDefault("images.prune.keep_last", domain.DefaultImagePruneKeepLast)
+	v.SetDefault("containers.security_profile", "compat")
 	v.SetDefault("telemetry.enabled", false)
 	v.SetDefault("telemetry.endpoint", "")
 	v.SetDefault("telemetry.auth_token", "")

M internal/app/run_auth_config_test.go +85 -1


@@ -2,13 +2,18 @@ package app
2			2
3		import (	3		import (
4		"context"	4		"context"
			5	+	"os"
			6	+	"path/filepath"
			7	+	"runtime"
5		"testing"	8		"testing"
6			9
7	-	"github.com/bnema/gordon/internal/domain"
8		"github.com/bnema/zerowrap"	10		"github.com/bnema/zerowrap"
9		"github.com/spf13/viper"	11		"github.com/spf13/viper"
10		"github.com/stretchr/testify/assert"	12		"github.com/stretchr/testify/assert"
11		"github.com/stretchr/testify/require"	13		"github.com/stretchr/testify/require"
			14	+	"golang.org/x/sys/unix"
			15	+
			16	+	"github.com/bnema/gordon/internal/domain"
12		)	17		)
13			18
14		func TestBuildAuthConfig_UsesConfigEnabledFlag(t *testing.T) {	19		func TestBuildAuthConfig_UsesConfigEnabledFlag(t *testing.T) {

@@ -65,3 +70,82 @@ func TestLoadConfig_DoesNotDefaultSecretsBackendToUnsafe(t *testing.T) {
65		require.NoError(t, err)	70		require.NoError(t, err)
66		assert.Empty(t, v.GetString("auth.secrets_backend"), "expected empty default for auth.secrets_backend")	71		assert.Empty(t, v.GetString("auth.secrets_backend"), "expected empty default for auth.secrets_backend")
67		}	72		}
			73	+
			74	+	func TestLoadSecretUnsafeRejectsTraversalAndAbsolutePaths(t *testing.T) {
			75	+	dataDir := t.TempDir()
			76	+	secretsDir := filepath.Join(dataDir, "secrets")
			77	+	require.NoError(t, os.MkdirAll(secretsDir, 0700))
			78	+	require.NoError(t, os.WriteFile(filepath.Join(secretsDir, "token"), []byte("safe-secret"), 0600))
			79	+	outside := filepath.Join(dataDir, "outside")
			80	+	require.NoError(t, os.WriteFile(outside, []byte("outside-secret"), 0600))
			81	+
			82	+	for _, path := range []string{"../outside", filepath.Join(dataDir, "outside")} {
			83	+	t.Run(path, func(t *testing.T) {
			84	+	_, err := loadSecret(context.Background(), domain.SecretsBackendUnsafe, path, dataDir, zerowrap.Default())
			85	+	require.Error(t, err)
			86	+	assert.Contains(t, err.Error(), "invalid secret path")
			87	+	})
			88	+	}
			89	+	}
			90	+
			91	+	func TestLoadSecretUnsafeAllowsRelativePathUnderSecretsDir(t *testing.T) {
			92	+	dataDir := t.TempDir()
			93	+	secretsDir := filepath.Join(dataDir, "secrets", "auth")
			94	+	require.NoError(t, os.MkdirAll(secretsDir, 0700))
			95	+	require.NoError(t, os.WriteFile(filepath.Join(secretsDir, "token"), []byte("safe-secret"), 0600))
			96	+
			97	+	secret, err := loadSecret(context.Background(), domain.SecretsBackendUnsafe, "auth/token", dataDir, zerowrap.Default())
			98	+	require.NoError(t, err)
			99	+	assert.Equal(t, "safe-secret", secret)
			100	+	}
			101	+
			102	+	func TestLoadSecretUnsafeRejectsMissingCandidate(t *testing.T) {
			103	+	dataDir := t.TempDir()
			104	+	secretsDir := filepath.Join(dataDir, "secrets")
			105	+	require.NoError(t, os.MkdirAll(secretsDir, 0700))
			106	+
			107	+	_, err := loadSecret(context.Background(), domain.SecretsBackendUnsafe, "missing", dataDir, zerowrap.Default())
			108	+	require.Error(t, err)
			109	+	assert.Contains(t, err.Error(), "failed to read secret file")
			110	+	}
			111	+
			112	+	func TestLoadSecretUnsafeRejectsIntermediateSymlinkEscape(t *testing.T) {
			113	+	dataDir := t.TempDir()
			114	+	secretsDir := filepath.Join(dataDir, "secrets")
			115	+	outsideDir := filepath.Join(dataDir, "outside")
			116	+	require.NoError(t, os.MkdirAll(secretsDir, 0700))
			117	+	require.NoError(t, os.MkdirAll(outsideDir, 0700))
			118	+	require.NoError(t, os.WriteFile(filepath.Join(outsideDir, "token"), []byte("outside-secret"), 0600))
			119	+	require.NoError(t, os.Symlink(outsideDir, filepath.Join(secretsDir, "linkdir")))
			120	+
			121	+	_, err := loadSecret(context.Background(), domain.SecretsBackendUnsafe, "linkdir/token", dataDir, zerowrap.Default())
			122	+	require.Error(t, err)
			123	+	assert.Contains(t, err.Error(), "failed to open secret path component")
			124	+	}
			125	+
			126	+	func TestLoadSecretUnsafeRejectsNonRegularFile(t *testing.T) {
			127	+	if runtime.GOOS == "windows" {
			128	+	t.Skip("unix mkfifo is not available on windows")
			129	+	}
			130	+	dataDir := t.TempDir()
			131	+	secretsDir := filepath.Join(dataDir, "secrets")
			132	+	require.NoError(t, os.MkdirAll(secretsDir, 0700))
			133	+	require.NoError(t, unix.Mkfifo(filepath.Join(secretsDir, "token"), 0600))
			134	+
			135	+	_, err := loadSecret(context.Background(), domain.SecretsBackendUnsafe, "token", dataDir, zerowrap.Default())
			136	+	require.Error(t, err)
			137	+	assert.Contains(t, err.Error(), "secret must be a regular file")
			138	+	}
			139	+
			140	+	func TestLoadSecretUnsafeRejectsSymlinkEscape(t *testing.T) {
			141	+	dataDir := t.TempDir()
			142	+	secretsDir := filepath.Join(dataDir, "secrets")
			143	+	require.NoError(t, os.MkdirAll(secretsDir, 0700))
			144	+	outside := filepath.Join(dataDir, "outside")
			145	+	require.NoError(t, os.WriteFile(outside, []byte("outside-secret"), 0600))
			146	+	require.NoError(t, os.Symlink(outside, filepath.Join(secretsDir, "token")))
			147	+
			148	+	_, err := loadSecret(context.Background(), domain.SecretsBackendUnsafe, "token", dataDir, zerowrap.Default())
			149	+	require.Error(t, err)
			150	+	assert.Contains(t, err.Error(), "failed to read secret file")
			151	+	}

M internal/app/run_reload_test.go +46 -5

 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"github.com/bnema/gordon/internal/adapters/in/http/registry"
 	"github.com/bnema/gordon/internal/domain"
 	"github.com/bnema/gordon/internal/usecase/proxy"
 )
 	p.config = config
 }
+type registryLimitsRecorder struct {
+	calls            int
+	maxBlobChunkSize int64
+	maxBlobSize      int64
+}
+func (r *registryLimitsRecorder) UpdateBlobLimits(maxBlobChunkSize, maxBlobSize int64) {
+	r.calls++
+	r.maxBlobChunkSize = maxBlobChunkSize
+	r.maxBlobSize = maxBlobSize
+}
 type eventBusRecorder struct {
 	mu        sync.Mutex
 	calls     int
 	require.Equal(t, 0, coordinator.TriggerCalls())
 }
+func TestBuildProxyConfig_ParsesMaxBlobSizeWithoutChangingChunkDefault(t *testing.T) {
+	cfg := Config{}
+	cfg.Server.MaxBlobSize = "2GB"
+	result, err := buildProxyConfig(cfg, zerowrap.Default())
+	require.NoError(t, err)
+	assert.Equal(t, int64(2<<30), result.maxBlobSize)
+	assert.Equal(t, int64(registry.DefaultMaxBlobChunkSize), result.maxBlobChunkSize)
+}
+func TestBuildProxyConfig_DefaultMaxBlobSize(t *testing.T) {
+	result, err := buildProxyConfig(Config{}, zerowrap.Default())
+	require.NoError(t, err)
+	assert.Equal(t, int64(registry.DefaultMaxBlobSize), result.maxBlobSize)
+}
 func TestReloadCoordinator_ApplyLoadedConfig_RebuildsProxyConfigAndPublishesEvent(t *testing.T) {
 	ctx := context.Background()
 	v := viper.New()
 	v.Set("server.registry_port", 5000)
 	v.Set("server.max_proxy_body_size", "5MB")
 	v.Set("server.max_blob_chunk_size", "6MB")
+	v.Set("server.max_blob_size", "8MB")
 	v.Set("server.max_proxy_response_size", "7MB")
 	v.Set("server.max_concurrent_connections", 99)
 	proxySvc := &proxyRecorder{}
 	events := &eventBusRecorder{}
-	coord := newReloadCoordinator(v, reloadSvc, proxySvc, events, zerowrap.Default())
+	registryLimits := &registryLimitsRecorder{}
+	coord := newReloadCoordinator(v, reloadSvc, proxySvc, registryLimits, events, zerowrap.Default())
 	require.NoError(t, coord.ApplyLoadedConfig(ctx))
 	require.Equal(t, 0, reloadSvc.Calls())
 	require.Equal(t, 1, proxySvc.calls)
 	require.Equal(t, 1, events.Calls())
+	require.Equal(t, 1, registryLimits.calls)
+	require.Equal(t, int64(6<<20), registryLimits.maxBlobChunkSize)
+	require.Equal(t, int64(8<<20), registryLimits.maxBlobSize)
 	require.Equal(t, domain.EventConfigReload, events.eventType)
 	require.Equal(t, proxy.Config{
 		RegistryDomain:     "reload.example.com",
 	v.Set("server.registry_port", 5000)
 	v.Set("server.max_proxy_body_size", "5MB")
 	v.Set("server.max_blob_chunk_size", "6MB")
+	v.Set("server.max_blob_size", "8MB")
 	v.Set("server.max_proxy_response_size", "7MB")
 	v.Set("server.max_concurrent_connections", 99)
 	proxySvc := &proxyRecorder{}
 	events := &eventBusRecorder{}
-	coord := newReloadCoordinator(v, reloadSvc, proxySvc, events, zerowrap.Default())
+	registryLimits := &registryLimitsRecorder{}
+	coord := newReloadCoordinator(v, reloadSvc, proxySvc, registryLimits, events, zerowrap.Default())
 	require.NoError(t, coord.Trigger(ctx))
 	require.NoError(t, coord.Trigger(ctx))
 	require.Equal(t, 1, reloadSvc.Calls())
 	require.Equal(t, 1, proxySvc.calls)
 	require.Equal(t, 1, events.Calls())
+	require.Equal(t, 1, registryLimits.calls)
+	require.Equal(t, int64(6<<20), registryLimits.maxBlobChunkSize)
+	require.Equal(t, int64(8<<20), registryLimits.maxBlobSize)
 	require.Equal(t, domain.EventConfigReload, events.eventType)
 	require.Equal(t, proxy.Config{
 		RegistryDomain:     "new.example.com",
 	reloadErr := errors.New("reload failed")
 	reloadSvc := &reloadRecorder{err: reloadErr}
 	proxySvc := &proxyRecorder{}
-	coord := newReloadCoordinator(v, reloadSvc, proxySvc, nil, zerowrap.Default())
+	coord := newReloadCoordinator(v, reloadSvc, proxySvc, nil, nil, zerowrap.Default())
 	err := coord.Trigger(ctx)
 	require.ErrorIs(t, err, reloadErr)
 	proxySvc := &proxyRecorder{}
 	events := &eventBusRecorder{err: publishErr}
-	coord := newReloadCoordinator(v, reloadSvc, proxySvc, events, zerowrap.Default())
+	coord := newReloadCoordinator(v, reloadSvc, proxySvc, nil, events, zerowrap.Default())
 	err := coord.Trigger(ctx)
 	require.ErrorIs(t, err, publishErr)
 		<-release
 	}}
 	proxySvc := &proxyRecorder{}
-	coord := newReloadCoordinator(v, reloadSvc, proxySvc, nil, zerowrap.Default())
+	coord := newReloadCoordinator(v, reloadSvc, proxySvc, nil, nil, zerowrap.Default())
 	firstDone := make(chan struct{})
 	go func() {

M internal/boundaries/in/mocks/mock_proxy_service.go +57 -0


@@ -107,6 +107,63 @@ func (_c *MockProxyService_GetTarget_Call) RunAndReturn(run func(ctx context.Con
107	return _c	107		return _c
108	}	108		}
109		109
		110	+	// IsKnownHost provides a mock function for the type MockProxyService
		111	+	func (_mock *MockProxyService) IsKnownHost(ctx context.Context, host string) bool {
		112	+	ret := _mock.Called(ctx, host)
		113	+
		114	+	if len(ret) == 0 {
		115	+	panic("no return value specified for IsKnownHost")
		116	+	}
		117	+
		118	+	var r0 bool
		119	+	if returnFunc, ok := ret.Get(0).(func(context.Context, string) bool); ok {
		120	+	r0 = returnFunc(ctx, host)
		121	+	} else {
		122	+	r0 = ret.Get(0).(bool)
		123	+	}
		124	+	return r0
		125	+	}
		126	+
		127	+	// MockProxyService_IsKnownHost_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'IsKnownHost'
		128	+	type MockProxyService_IsKnownHost_Call struct {
		129	+	*mock.Call
		130	+	}
		131	+
		132	+	// IsKnownHost is a helper method to define mock.On call
		133	+	// - ctx context.Context
		134	+	// - host string
		135	+	func (_e MockProxyService_Expecter) IsKnownHost(ctx interface{}, host interface{}) MockProxyService_IsKnownHost_Call {
		136	+	return &MockProxyService_IsKnownHost_Call{Call: _e.mock.On("IsKnownHost", ctx, host)}
		137	+	}
		138	+
		139	+	func (_c MockProxyService_IsKnownHost_Call) Run(run func(ctx context.Context, host string)) MockProxyService_IsKnownHost_Call {
		140	+	_c.Call.Run(func(args mock.Arguments) {
		141	+	var arg0 context.Context
		142	+	if args[0] != nil {
		143	+	arg0 = args[0].(context.Context)
		144	+	}
		145	+	var arg1 string
		146	+	if args[1] != nil {
		147	+	arg1 = args[1].(string)
		148	+	}
		149	+	run(
		150	+	arg0,
		151	+	arg1,
		152	+	)
		153	+	})
		154	+	return _c
		155	+	}
		156	+
		157	+	func (_c MockProxyService_IsKnownHost_Call) Return(b bool) MockProxyService_IsKnownHost_Call {
		158	+	_c.Call.Return(b)
		159	+	return _c
		160	+	}
		161	+
		162	+	func (_c MockProxyService_IsKnownHost_Call) RunAndReturn(run func(ctx context.Context, host string) bool) MockProxyService_IsKnownHost_Call {
		163	+	_c.Call.Return(run)
		164	+	return _c
		165	+	}
		166	+
110	// IsRegistryDomain provides a mock function for the type MockProxyService	167		// IsRegistryDomain provides a mock function for the type MockProxyService
111	func (_mock *MockProxyService) IsRegistryDomain(host string) bool {	168		func (_mock *MockProxyService) IsRegistryDomain(host string) bool {
112	ret := _mock.Called(host)	169		ret := _mock.Called(host)

M internal/boundaries/in/mocks/mock_registry_service.go +24 -12

 }
 // AppendBlobChunk provides a mock function for the type MockRegistryService
-func (_mock *MockRegistryService) AppendBlobChunk(ctx context.Context, name string, uuid string, data io.Reader) (int64, error) {
+func (_mock *MockRegistryService) AppendBlobChunk(ctx context.Context, name string, uuid string, data io.Reader, contentLength int64, maxBlobSize int64) (int64, error) {
-	ret := _mock.Called(ctx, name, uuid, data)
+	ret := _mock.Called(ctx, name, uuid, data, contentLength, maxBlobSize)
 	if len(ret) == 0 {
 		panic("no return value specified for AppendBlobChunk")
 	var r0 int64
 	var r1 error
-	if returnFunc, ok := ret.Get(0).(func(context.Context, string, string, io.Reader) (int64, error)); ok {
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, string, io.Reader, int64, int64) (int64, error)); ok {
-		return returnFunc(ctx, name, uuid, data)
+		return returnFunc(ctx, name, uuid, data, contentLength, maxBlobSize)
 	}
-	if returnFunc, ok := ret.Get(0).(func(context.Context, string, string, io.Reader) int64); ok {
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, string, io.Reader, int64, int64) int64); ok {
-		r0 = returnFunc(ctx, name, uuid, data)
+		r0 = returnFunc(ctx, name, uuid, data, contentLength, maxBlobSize)
 	} else {
 		r0 = ret.Get(0).(int64)
 	}
-	if returnFunc, ok := ret.Get(1).(func(context.Context, string, string, io.Reader) error); ok {
+	if returnFunc, ok := ret.Get(1).(func(context.Context, string, string, io.Reader, int64, int64) error); ok {
-		r1 = returnFunc(ctx, name, uuid, data)
+		r1 = returnFunc(ctx, name, uuid, data, contentLength, maxBlobSize)
 	} else {
 		r1 = ret.Error(1)
 	}
 //   - name string
 //   - uuid string
 //   - data io.Reader
-func (_e *MockRegistryService_Expecter) AppendBlobChunk(ctx interface{}, name interface{}, uuid interface{}, data interface{}) *MockRegistryService_AppendBlobChunk_Call {
+//   - contentLength int64
-	return &MockRegistryService_AppendBlobChunk_Call{Call: _e.mock.On("AppendBlobChunk", ctx, name, uuid, data)}
+//   - maxBlobSize int64
+func (_e *MockRegistryService_Expecter) AppendBlobChunk(ctx interface{}, name interface{}, uuid interface{}, data interface{}, contentLength interface{}, maxBlobSize interface{}) *MockRegistryService_AppendBlobChunk_Call {
+	return &MockRegistryService_AppendBlobChunk_Call{Call: _e.mock.On("AppendBlobChunk", ctx, name, uuid, data, contentLength, maxBlobSize)}
 }
-func (_c *MockRegistryService_AppendBlobChunk_Call) Run(run func(ctx context.Context, name string, uuid string, data io.Reader)) *MockRegistryService_AppendBlobChunk_Call {
+func (_c *MockRegistryService_AppendBlobChunk_Call) Run(run func(ctx context.Context, name string, uuid string, data io.Reader, contentLength int64, maxBlobSize int64)) *MockRegistryService_AppendBlobChunk_Call {
 	_c.Call.Run(func(args mock.Arguments) {
 		var arg0 context.Context
 		if args[0] != nil {
 		if args[3] != nil {
 			arg3 = args[3].(io.Reader)
 		}
+		var arg4 int64
+		if args[4] != nil {
+			arg4 = args[4].(int64)
+		}
+		var arg5 int64
+		if args[5] != nil {
+			arg5 = args[5].(int64)
+		}
 		run(
 			arg0,
 			arg1,
 			arg2,
 			arg3,
+			arg4,
+			arg5,
 		)
 	})
 	return _c
 	return _c
 }
-func (_c *MockRegistryService_AppendBlobChunk_Call) RunAndReturn(run func(ctx context.Context, name string, uuid string, data io.Reader) (int64, error)) *MockRegistryService_AppendBlobChunk_Call {
+func (_c *MockRegistryService_AppendBlobChunk_Call) RunAndReturn(run func(ctx context.Context, name string, uuid string, data io.Reader, contentLength int64, maxBlobSize int64) (int64, error)) *MockRegistryService_AppendBlobChunk_Call {
 	_c.Call.Return(run)
 	return _c
 }

M internal/boundaries/in/proxy.go +3 -0


@@ -24,6 +24,9 @@ type ProxyService interface {
24	// IsRegistryDomain returns true if the host matches the configured registry domain.	24		// IsRegistryDomain returns true if the host matches the configured registry domain.
25	IsRegistryDomain(host string) bool	25		IsRegistryDomain(host string) bool
26		26
		27	+	// IsKnownHost returns true if the host is configured as registry, route, or external route.
		28	+	IsKnownHost(ctx context.Context, host string) bool
		29	+
27	// TrackInFlight records an in-flight request for a container.	30		// TrackInFlight records an in-flight request for a container.
28	// Returns a release function that must be called when the request completes.	31		// Returns a release function that must be called when the request completes.
29	TrackInFlight(containerID string) func()	32		TrackInFlight(containerID string) func()

M internal/boundaries/in/registry.go +1 -1


@@ -22,7 +22,7 @@ type RegistryService interface {
22			22
23		// Upload operations	23		// Upload operations
24		StartUpload(ctx context.Context, name string) (string, error)	24		StartUpload(ctx context.Context, name string) (string, error)
25	-	AppendBlobChunk(ctx context.Context, name, uuid string, data io.Reader) (int64, error)	25	+	AppendBlobChunk(ctx context.Context, name, uuid string, data io.Reader, contentLength, maxBlobSize int64) (int64, error)
26		FinishUpload(ctx context.Context, uuid, digest string) error	26		FinishUpload(ctx context.Context, uuid, digest string) error
27		CancelUpload(ctx context.Context, uuid string) error	27		CancelUpload(ctx context.Context, uuid string) error
28			28

M internal/boundaries/out/mocks/mock_blob_storage.go +24 -12

 }
 // AppendBlobChunk provides a mock function for the type MockBlobStorage
-func (_mock *MockBlobStorage) AppendBlobChunk(name string, uuid string, data io.Reader) (int64, error) {
+func (_mock *MockBlobStorage) AppendBlobChunk(name string, uuid string, data io.Reader, contentLength int64, maxBlobSize int64) (int64, error) {
-	ret := _mock.Called(name, uuid, data)
+	ret := _mock.Called(name, uuid, data, contentLength, maxBlobSize)
 	if len(ret) == 0 {
 		panic("no return value specified for AppendBlobChunk")
 	var r0 int64
 	var r1 error
-	if returnFunc, ok := ret.Get(0).(func(string, string, io.Reader) (int64, error)); ok {
+	if returnFunc, ok := ret.Get(0).(func(string, string, io.Reader, int64, int64) (int64, error)); ok {
-		return returnFunc(name, uuid, data)
+		return returnFunc(name, uuid, data, contentLength, maxBlobSize)
 	}
-	if returnFunc, ok := ret.Get(0).(func(string, string, io.Reader) int64); ok {
+	if returnFunc, ok := ret.Get(0).(func(string, string, io.Reader, int64, int64) int64); ok {
-		r0 = returnFunc(name, uuid, data)
+		r0 = returnFunc(name, uuid, data, contentLength, maxBlobSize)
 	} else {
 		r0 = ret.Get(0).(int64)
 	}
-	if returnFunc, ok := ret.Get(1).(func(string, string, io.Reader) error); ok {
+	if returnFunc, ok := ret.Get(1).(func(string, string, io.Reader, int64, int64) error); ok {
-		r1 = returnFunc(name, uuid, data)
+		r1 = returnFunc(name, uuid, data, contentLength, maxBlobSize)
 	} else {
 		r1 = ret.Error(1)
 	}
 //   - name string
 //   - uuid string
 //   - data io.Reader
-func (_e *MockBlobStorage_Expecter) AppendBlobChunk(name interface{}, uuid interface{}, data interface{}) *MockBlobStorage_AppendBlobChunk_Call {
+//   - contentLength int64
-	return &MockBlobStorage_AppendBlobChunk_Call{Call: _e.mock.On("AppendBlobChunk", name, uuid, data)}
+//   - maxBlobSize int64
+func (_e *MockBlobStorage_Expecter) AppendBlobChunk(name interface{}, uuid interface{}, data interface{}, contentLength interface{}, maxBlobSize interface{}) *MockBlobStorage_AppendBlobChunk_Call {
+	return &MockBlobStorage_AppendBlobChunk_Call{Call: _e.mock.On("AppendBlobChunk", name, uuid, data, contentLength, maxBlobSize)}
 }
-func (_c *MockBlobStorage_AppendBlobChunk_Call) Run(run func(name string, uuid string, data io.Reader)) *MockBlobStorage_AppendBlobChunk_Call {
+func (_c *MockBlobStorage_AppendBlobChunk_Call) Run(run func(name string, uuid string, data io.Reader, contentLength int64, maxBlobSize int64)) *MockBlobStorage_AppendBlobChunk_Call {
 	_c.Call.Run(func(args mock.Arguments) {
 		var arg0 string
 		if args[0] != nil {
 		if args[2] != nil {
 			arg2 = args[2].(io.Reader)
 		}
+		var arg3 int64
+		if args[3] != nil {
+			arg3 = args[3].(int64)
+		}
+		var arg4 int64
+		if args[4] != nil {
+			arg4 = args[4].(int64)
+		}
 		run(
 			arg0,
 			arg1,
 			arg2,
+			arg3,
+			arg4,
 		)
 	})
 	return _c
 	return _c
 }
-func (_c *MockBlobStorage_AppendBlobChunk_Call) RunAndReturn(run func(name string, uuid string, data io.Reader) (int64, error)) *MockBlobStorage_AppendBlobChunk_Call {
+func (_c *MockBlobStorage_AppendBlobChunk_Call) RunAndReturn(run func(name string, uuid string, data io.Reader, contentLength int64, maxBlobSize int64) (int64, error)) *MockBlobStorage_AppendBlobChunk_Call {
 	_c.Call.Return(run)
 	return _c
 }

M internal/boundaries/out/mocks/mock_container_runtime.go +11 -11


@@ -246,16 +246,16 @@ func (_c *MockContainerRuntime_CreateContainer_Call) RunAndReturn(run func(ctx c
246		}	246		}
247			247
248		// CreateNetwork provides a mock function for the type MockContainerRuntime	248		// CreateNetwork provides a mock function for the type MockContainerRuntime
249	-	func (_mock *MockContainerRuntime) CreateNetwork(ctx context.Context, name string, options map[string]string) error {	249	+	func (_mock *MockContainerRuntime) CreateNetwork(ctx context.Context, name string, config domain.NetworkConfig) error {
250	-	ret := _mock.Called(ctx, name, options)	250	+	ret := _mock.Called(ctx, name, config)
251			251
252		if len(ret) == 0 {	252		if len(ret) == 0 {
253		panic("no return value specified for CreateNetwork")	253		panic("no return value specified for CreateNetwork")
254		}	254		}
255			255
256		var r0 error	256		var r0 error
257	-	if returnFunc, ok := ret.Get(0).(func(context.Context, string, map[string]string) error); ok {	257	+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, domain.NetworkConfig) error); ok {
258	-	r0 = returnFunc(ctx, name, options)	258	+	r0 = returnFunc(ctx, name, config)
259		} else {	259		} else {
260		r0 = ret.Error(0)	260		r0 = ret.Error(0)
261		}	261		}

@@ -270,12 +270,12 @@ type MockContainerRuntime_CreateNetwork_Call struct {
270		// CreateNetwork is a helper method to define mock.On call	270		// CreateNetwork is a helper method to define mock.On call
271		// - ctx context.Context	271		// - ctx context.Context
272		// - name string	272		// - name string
273	-	// - options map[string]string	273	+	// - config domain.NetworkConfig
274	-	func (_e MockContainerRuntime_Expecter) CreateNetwork(ctx interface{}, name interface{}, options interface{}) MockContainerRuntime_CreateNetwork_Call {	274	+	func (_e MockContainerRuntime_Expecter) CreateNetwork(ctx interface{}, name interface{}, config interface{}) MockContainerRuntime_CreateNetwork_Call {
275	-	return &MockContainerRuntime_CreateNetwork_Call{Call: _e.mock.On("CreateNetwork", ctx, name, options)}	275	+	return &MockContainerRuntime_CreateNetwork_Call{Call: _e.mock.On("CreateNetwork", ctx, name, config)}
276		}	276		}
277			277
278	-	func (_c MockContainerRuntime_CreateNetwork_Call) Run(run func(ctx context.Context, name string, options map[string]string)) MockContainerRuntime_CreateNetwork_Call {	278	+	func (_c MockContainerRuntime_CreateNetwork_Call) Run(run func(ctx context.Context, name string, config domain.NetworkConfig)) MockContainerRuntime_CreateNetwork_Call {
279		_c.Call.Run(func(args mock.Arguments) {	279		_c.Call.Run(func(args mock.Arguments) {
280		var arg0 context.Context	280		var arg0 context.Context
281		if args[0] != nil {	281		if args[0] != nil {

@@ -285,9 +285,9 @@ func (_c *MockContainerRuntime_CreateNetwork_Call) Run(run func(ctx context.Cont
285		if args[1] != nil {	285		if args[1] != nil {
286		arg1 = args[1].(string)	286		arg1 = args[1].(string)
287		}	287		}
288	-	var arg2 map[string]string	288	+	var arg2 domain.NetworkConfig
289		if args[2] != nil {	289		if args[2] != nil {
290	-	arg2 = args[2].(map[string]string)	290	+	arg2 = args[2].(domain.NetworkConfig)
291		}	291		}
292		run(	292		run(
293		arg0,	293		arg0,

@@ -303,7 +303,7 @@ func (_c MockContainerRuntime_CreateNetwork_Call) Return(err error) MockContai
303		return _c	303		return _c
304		}	304		}
305			305
306	-	func (_c MockContainerRuntime_CreateNetwork_Call) RunAndReturn(run func(ctx context.Context, name string, options map[string]string) error) MockContainerRuntime_CreateNetwork_Call {	306	+	func (_c MockContainerRuntime_CreateNetwork_Call) RunAndReturn(run func(ctx context.Context, name string, config domain.NetworkConfig) error) MockContainerRuntime_CreateNetwork_Call {
307		_c.Call.Return(run)	307		_c.Call.Return(run)
308		return _c	308		return _c
309		}	309		}

M internal/boundaries/out/runtime.go +1 -1


@@ -70,7 +70,7 @@ type ContainerRuntime interface {
70		CopyFromContainer(ctx context.Context, containerID, srcPath string) (io.ReadCloser, error)	70		CopyFromContainer(ctx context.Context, containerID, srcPath string) (io.ReadCloser, error)
71			71
72		// Network management	72		// Network management
73	-	CreateNetwork(ctx context.Context, name string, options map[string]string) error	73	+	CreateNetwork(ctx context.Context, name string, config domain.NetworkConfig) error
74		RemoveNetwork(ctx context.Context, name string) error	74		RemoveNetwork(ctx context.Context, name string) error
75		ListNetworks(ctx context.Context) ([]*domain.NetworkInfo, error)	75		ListNetworks(ctx context.Context) ([]*domain.NetworkInfo, error)
76		NetworkExists(ctx context.Context, name string) (bool, error)	76		NetworkExists(ctx context.Context, name string) (bool, error)

M internal/boundaries/out/storage.go +1 -1


@@ -30,7 +30,7 @@ type BlobStorage interface {
30		StartBlobUpload(name string) (string, error)	30		StartBlobUpload(name string) (string, error)
31			31
32		// AppendBlobChunk appends data to an in-progress upload.	32		// AppendBlobChunk appends data to an in-progress upload.
33	-	AppendBlobChunk(name, uuid string, data io.Reader) (int64, error)	33	+	AppendBlobChunk(name, uuid string, data io.Reader, contentLength, maxBlobSize int64) (int64, error)
34			34
35		// GetBlobUpload returns a writer for the upload.	35		// GetBlobUpload returns a writer for the upload.
36		GetBlobUpload(uuid string) (io.WriteCloser, error)	36		GetBlobUpload(uuid string) (io.WriteCloser, error)

M internal/domain/auth.go +13 -1

 	AdminResourceSecrets = "secrets"
 	AdminResourceConfig  = "config"
 	AdminResourceStatus  = "status"
+	AdminResourceLogs    = "logs"
+	AdminResourceVolumes = "volumes"
 	AdminResourceAll     = "*"
 )
 // AdminScope represents an admin API scope (admin:resource:actions).
 // Format: admin:routes:read,write or admin:*:* for full access.
 type AdminScope struct {
-	Resource string   // routes, secrets, config, status, or *
+	Resource string   // routes, secrets, config, status, logs, volumes, or *
 	Actions  []string // read, write, or *
 }
 	return fmt.Sprintf("%s:%s:%s", ScopeTypeAdmin, AdminResourceStatus, strings.Join(actions, ","))
 }
+// AdminScopeLogs creates an admin scope for logs with the given actions.
+func AdminScopeLogs(actions ...string) string {
+	return fmt.Sprintf("%s:%s:%s", ScopeTypeAdmin, AdminResourceLogs, strings.Join(actions, ","))
+}
+// AdminScopeVolumes creates an admin scope for volumes with the given actions.
+func AdminScopeVolumes(actions ...string) string {
+	return fmt.Sprintf("%s:%s:%s", ScopeTypeAdmin, AdminResourceVolumes, strings.Join(actions, ","))
+}
 // AuthStatus represents status of an authentication session.
 type AuthStatus struct {
 	Valid     bool

M internal/domain/auth_test.go +28 -0


@@ -491,6 +491,34 @@ func TestScopesGrantAdminAccess(t *testing.T) {
491	action: "write",	491		action: "write",
492	want: true,	492		want: true,
493	},	493		},
		494	+	{
		495	+	name: "logs read grants logs resource",
		496	+	granted: []string{"admin:logs:read"},
		497	+	resource: AdminResourceLogs,
		498	+	action: AdminActionRead,
		499	+	want: true,
		500	+	},
		501	+	{
		502	+	name: "status read does not grant logs resource",
		503	+	granted: []string{"admin:status:read"},
		504	+	resource: AdminResourceLogs,
		505	+	action: AdminActionRead,
		506	+	want: false,
		507	+	},
		508	+	{
		509	+	name: "full admin wildcard grants logs resource",
		510	+	granted: []string{"admin::"},
		511	+	resource: AdminResourceLogs,
		512	+	action: AdminActionRead,
		513	+	want: true,
		514	+	},
		515	+	{
		516	+	name: "volumes read grants volumes resource",
		517	+	granted: []string{"admin:volumes:read"},
		518	+	resource: AdminResourceVolumes,
		519	+	action: AdminActionRead,
		520	+	want: true,
		521	+	},
494	{	522		{
495	name: "repository scope is ignored for admin access",	523		name: "repository scope is ignored for admin access",
496	granted: []string{"repository:myrepo:push"},	524		granted: []string{"repository:myrepo:push"},

M internal/domain/container.go +11 -0


@@ -26,6 +26,13 @@ type NetworkInfo struct {
26	Labels map[string]string	26		Labels map[string]string
27	}	27		}
28		28
		29	+	// NetworkConfig holds options for creating a container network.
		30	+	type NetworkConfig struct {
		31	+	Driver string
		32	+	Internal bool
		33	+	Labels map[string]string
		34	+	}
		35	+
29	// Attachment represents an attached service container.	36		// Attachment represents an attached service container.
30	type Attachment struct {	37		type Attachment struct {
31	Name string	38		Name string

@@ -64,6 +71,10 @@ type ContainerConfig struct {
64	MemoryLimit int64 // Memory limit in bytes (0 = no limit)	71		MemoryLimit int64 // Memory limit in bytes (0 = no limit)
65	NanoCPUs int64 // CPU quota in nanoseconds (1e9 = 1 core, 0 = no limit)	72		NanoCPUs int64 // CPU quota in nanoseconds (1e9 = 1 core, 0 = no limit)
66	PidsLimit int64 // Max number of PIDs (0 = no limit)	73		PidsLimit int64 // Max number of PIDs (0 = no limit)
		74	+	ReadOnlyRootFS bool // Mount container root filesystem read-only
		75	+	User string // User to run as
		76	+	CapDrop []string // Linux capabilities to drop; nil uses runtime compat defaults
		77	+	CapAdd []string // Linux capabilities to add; nil uses runtime compat defaults
67	}	78		}
68		79
69	// ContainerStatus represents the current state of a container.	80		// ContainerStatus represents the current state of a container.

M internal/domain/errors.go +3 -0


@@ -34,6 +34,7 @@ var (
34	ErrInvalidDigest = errors.New("invalid digest")	34		ErrInvalidDigest = errors.New("invalid digest")
35	ErrDigestMismatch = errors.New("digest mismatch")	35		ErrDigestMismatch = errors.New("digest mismatch")
36	ErrUnauthorized = errors.New("unauthorized")	36		ErrUnauthorized = errors.New("unauthorized")
		37	+	ErrBlobSizeExceeded = errors.New("blob size exceeds maximum")
37		38
38	// Network errors	39		// Network errors
39	ErrNetworkNotFound = errors.New("network not found")	40		ErrNetworkNotFound = errors.New("network not found")

@@ -51,10 +52,12 @@ var (
51	ErrInvalidConfig = errors.New("invalid configuration")	52		ErrInvalidConfig = errors.New("invalid configuration")
52	ErrConfigLoadFailed = errors.New("failed to load configuration")	53		ErrConfigLoadFailed = errors.New("failed to load configuration")
53	ErrInvalidDomainPattern = errors.New("invalid domain pattern")	54		ErrInvalidDomainPattern = errors.New("invalid domain pattern")
		55	+	ErrRouteConflict = errors.New("route conflicts with existing configuration")
54		56
55	// Environment errors	57		// Environment errors
56	ErrEnvFileNotFound = errors.New("environment file not found")	58		ErrEnvFileNotFound = errors.New("environment file not found")
57	ErrSecretNotFound = errors.New("secret not found")	59		ErrSecretNotFound = errors.New("secret not found")
		60	+	ErrSecretsAlreadyExist = errors.New("secrets already exist")
58	ErrProviderNotFound = errors.New("secret provider not found")	61		ErrProviderNotFound = errors.New("secret provider not found")
59	ErrInvalidContainerName = errors.New("invalid container name")	62		ErrInvalidContainerName = errors.New("invalid container name")
60		63

A internal/domain/redact.go +46 -0

@@ -0,0 +1,46 @@
	1	+	package domain
	2	+
	3	+	import "regexp"
	4	+
	5	+	type secretRedactionPattern struct {
	6	+	re *regexp.Regexp
	7	+	repl string
	8	+	}
	9	+
	10	+	const secretKeyPattern = `[A-Z0-9_](?:PASSWORD\|TOKEN\|SECRET\|API[_-]?KEY\|DATABASE[_-]?URL)[A-Z0-9_]` //nolint:gosec // Regex pattern for secret-like key names, not a credential.
	11	+
	12	+	var secretValuePatterns = []secretRedactionPattern{
	13	+	{
	14	+	re: regexp.MustCompile(`(?i)(\b` + secretKeyPattern + `\b\s=\s)(?:"(?:\\.\|[^"])"\|'(?:\\.\|[^'])'\|[^\s]+)`),
	15	+	repl: `${1}[REDACTED]`,
	16	+	},
	17	+	{
	18	+	re: regexp.MustCompile(`(?i)("` + secretKeyPattern + `"\s:\s")((?:\\.\|[^"])*)(")`),
	19	+	repl: `${1}[REDACTED]${3}`,
	20	+	},
	21	+	{
	22	+	re: regexp.MustCompile(`(?i)(\bAuthorization\s:\sBearer\s+)([^\s]+)`),
	23	+	repl: `${1}[REDACTED]`,
	24	+	},
	25	+	}
	26	+
	27	+	// RedactSecrets redacts common secret values from a single log or diagnostic line.
	28	+	func RedactSecrets(line string) string {
	29	+	redacted := line
	30	+	for _, pattern := range secretValuePatterns {
	31	+	redacted = pattern.re.ReplaceAllString(redacted, pattern.repl)
	32	+	}
	33	+	return redacted
	34	+	}
	35	+
	36	+	// RedactSecretLines redacts common secret values from log or diagnostic lines.
	37	+	func RedactSecretLines(lines []string) []string {
	38	+	if lines == nil {
	39	+	return nil
	40	+	}
	41	+	redacted := make([]string, len(lines))
	42	+	for i, line := range lines {
	43	+	redacted[i] = RedactSecrets(line)
	44	+	}
	45	+	return redacted
	46	+	}

A internal/domain/redact_test.go +45 -0

@@ -0,0 +1,45 @@
	1	+	package domain
	2	+
	3	+	import (
	4	+	"testing"
	5	+
	6	+	"github.com/stretchr/testify/assert"
	7	+	)
	8	+
	9	+	func TestRedactSecrets(t *testing.T) {
	10	+	tests := []struct {
	11	+	name string
	12	+	in string
	13	+	want string
	14	+	}{
	15	+	{"password env", "PASSWORD=hunter2", "PASSWORD=[REDACTED]"},
	16	+	{"token env", "TOKEN=abc123", "TOKEN=[REDACTED]"},
	17	+	{"secret env", "SECRET=shh", "SECRET=[REDACTED]"},
	18	+	{"api key env", "API_KEY=key-value", "API_KEY=[REDACTED]"},
	19	+	{"database url env", "DATABASE_URL=postgres://user:pass@db/app", "DATABASE_URL=[REDACTED]"},
	20	+	{"quoted password env with spaces", `PASSWORD="hunter 2"`, "PASSWORD=[REDACTED]"},
	21	+	{"single quoted token env with spaces", `TOKEN='abc 123'`, "TOKEN=[REDACTED]"},
	22	+	{"json password field", `{"PASSWORD":"hunter2","ok":"value"}`, `{"PASSWORD":"[REDACTED]","ok":"value"}`},
	23	+	{"json token field with spaces", `{"TOKEN": "abc123"}`, `{"TOKEN": "[REDACTED]"}`},
	24	+	{"case insensitive", "database_url=postgres://user:pass@db/app", "database_url=[REDACTED]"},
	25	+	{"prefixed password env", "POSTGRES_PASSWORD=hunter2", "POSTGRES_PASSWORD=[REDACTED]"},
	26	+	{"prefixed token env", "GORDON_TOKEN=abc123", "GORDON_TOKEN=[REDACTED]"},
	27	+	{"secret key env", "SECRET_KEY=shh", "SECRET_KEY=[REDACTED]"},
	28	+	{"api token env", "API_TOKEN=abc123", "API_TOKEN=[REDACTED]"},
	29	+	{"authorization bearer", "Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.secret", "Authorization: Bearer [REDACTED]"},
	30	+	{"json prefixed password field", `{"POSTGRES_PASSWORD":"hunter2"}`, `{"POSTGRES_PASSWORD":"[REDACTED]"}`},
	31	+	{"json secret key field", `{"secret_key": "shh"}`, `{"secret_key": "[REDACTED]"}`},
	32	+	}
	33	+
	34	+	for _, tt := range tests {
	35	+	t.Run(tt.name, func(t *testing.T) {
	36	+	assert.Equal(t, tt.want, RedactSecrets(tt.in))
	37	+	})
	38	+	}
	39	+	}
	40	+
	41	+	func TestRedactSecretLinesPreservesEmptySlice(t *testing.T) {
	42	+	assert.Nil(t, RedactSecretLines(nil))
	43	+	assert.Empty(t, RedactSecretLines([]string{}))
	44	+	assert.NotNil(t, RedactSecretLines([]string{}))
	45	+	}

M internal/domain/validation.go +8 -0


@@ -17,6 +17,14 @@ var hostnamePattern = regexp.MustCompile(`^[a-zA-Z0-9.-]+$`)
17	//	17		//
18	// Valid: app.example.com, api.site.org, my-app.co.uk	18		// Valid: app.example.com, api.site.org, my-app.co.uk
19	// Invalid: 192.168.1.1, localhost, myapp.local, example.com:8080	19		// Invalid: 192.168.1.1, localhost, myapp.local, example.com:8080
		20	+	func CanonicalRouteDomain(domainName string) (string, bool) {
		21	+	canonical := strings.ToLower(strings.TrimSpace(domainName))
		22	+	if !IsValidRouteDomain(canonical) {
		23	+	return "", false
		24	+	}
		25	+	return canonical, true
		26	+	}
		27	+
20	func IsValidRouteDomain(domain string) bool {	28		func IsValidRouteDomain(domain string) bool {
21	// Reject empty	29		// Reject empty
22	if domain == "" {	30		if domain == "" {

M internal/usecase/backup/integration_test.go +4 -1

 	require.NoError(t, runtime.PullImage(pullCtx, image))
 	netCtx, cancelNet := context.WithTimeout(ctx, 2*time.Minute)
 	defer cancelNet()
-	require.NoError(t, runtime.CreateNetwork(netCtx, networkName, map[string]string{"driver": "bridge"}))
+	require.NoError(t, runtime.CreateNetwork(netCtx, networkName, domain.NetworkConfig{Driver: "bridge"}))
 	t.Cleanup(func() {
 		cleanupCtx, cancelCleanup := context.WithTimeout(context.Background(), 20*time.Second)
 		defer cancelCleanup()
 	return nil
 }
+func (s *integrationContainerService) UpdateAttachments(map[string][]string) {
+}
 func (s *integrationContainerService) AutoStart(context.Context, []domain.Route) error {
 	return nil
 }

M internal/usecase/config/service.go +73 -11

 		return log.WrapErr(err, "failed to load routes")
 	}
 	newConfig.Routes = routes
-	newConfig.ExternalRoutes = loadStringMap(s.viper.Get("external_routes"))
+	externalRoutes, err := loadExternalRoutes(s.viper.Get("external_routes"))
+	if err != nil {
+		return log.WrapErr(err, "failed to load external routes")
+	}
+	for domainName := range externalRoutes {
+		if _, exists := routes[domainName]; exists {
+			return fmt.Errorf("external route %q conflicts with configured route", domainName)
+		}
+	}
+	newConfig.ExternalRoutes = externalRoutes
 	newConfig.NetworkGroups = loadStringArrayMap(s.viper.Get("network_groups"))
 	newConfig.Attachments = loadStringArrayMap(s.viper.Get("attachments"))
 	return result
 }
+// loadExternalRoutes loads and canonicalizes external route mappings.
+func loadExternalRoutes(raw any) (map[string]string, error) {
+	result := make(map[string]string)
+	if raw == nil {
+		return result, nil
+	}
+	m, ok := raw.(map[string]any)
+	if !ok {
+		return result, nil
+	}
+	for k, v := range m {
+		vs, ok := v.(string)
+		if !ok {
+			continue
+		}
+		canonicalKey, ok := domain.CanonicalRouteDomain(k)
+		if !ok {
+			return nil, fmt.Errorf("invalid external route key %q: %w", k, domain.ErrRouteDomainInvalid)
+		}
+		if _, exists := result[canonicalKey]; exists {
+			return nil, fmt.Errorf("duplicate external route key %q canonicalizes to %q", k, canonicalKey)
+		}
+		result[canonicalKey] = vs
+	}
+	return result, nil
+}
 // loadStringArrayMap loads a map[string][]string from a viper value.
 func loadStringArrayMap(raw any) map[string][]string {
 	result := make(map[string][]string)
 		if err != nil {
 			return nil, err
 		}
-		result[key] = route
+		canonicalKey, _ := domain.CanonicalRouteDomain(key)
+		if _, exists := result[canonicalKey]; exists {
+			return nil, fmt.Errorf("duplicate route key %q canonicalizes to %q", key, canonicalKey)
+		}
+		result[canonicalKey] = route
 	}
 	for key, value := range routes {
 		}
 		domainName := strings.TrimPrefix(key, "http://")
-		if _, exists := result[domainName]; exists {
+		canonicalDomain, ok := domain.CanonicalRouteDomain(domainName)
+		if !ok {
+			return nil, fmt.Errorf("invalid route key %q: %w", legacyRouteStorageKey(domainName), domain.ErrRouteDomainInvalid)
+		}
+		if _, exists := result[canonicalDomain]; exists {
 			continue
 		}
 		if err != nil {
 			return nil, err
 		}
-		result[domainName] = route
+		result[canonicalDomain] = route
 	}
 	return result, nil
 }
 func parseCanonicalRouteEntry(domainName string, raw any) (routeConfig, error) {
-	if !domain.IsValidRouteDomain(domainName) {
+	canonicalDomain, ok := domain.CanonicalRouteDomain(domainName)
+	if !ok {
 		return routeConfig{}, fmt.Errorf("invalid route key %q: %w", domainName, domain.ErrRouteDomainInvalid)
 	}
+	domainName = canonicalDomain
 	switch value := raw.(type) {
 	case string:
 }
 func parseLegacyRouteEntry(domainName string, raw any) (routeConfig, error) {
-	if !domain.IsValidRouteDomain(domainName) {
+	canonicalDomain, ok := domain.CanonicalRouteDomain(domainName)
+	if !ok {
 		return routeConfig{}, fmt.Errorf("invalid route key %q: %w", legacyRouteStorageKey(domainName), domain.ErrRouteDomainInvalid)
 	}
+	domainName = canonicalDomain
 	value, ok := raw.(string)
 	if !ok {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
+	domainName, ok := domain.CanonicalRouteDomain(domainName)
+	if !ok {
+		return nil, domain.ErrRouteNotFound
+	}
 	routeCfg, ok := s.config.Routes[domainName]
 	if !ok {
 		return nil, domain.ErrRouteNotFound
 	if route.Domain == "" {
 		return domain.ErrRouteDomainEmpty
 	}
-	if !domain.IsValidRouteDomain(route.Domain) {
+	canonicalDomain, ok := domain.CanonicalRouteDomain(route.Domain)
+	if !ok {
 		return domain.ErrRouteDomainInvalid
 	}
+	route.Domain = canonicalDomain
 	if route.Image == "" {
 		return domain.ErrRouteImageEmpty
 	}
 	if currentConfig.Routes == nil {
 		currentConfig.Routes = make(map[string]routeConfig)
 	}
+	if _, exists := currentConfig.ExternalRoutes[route.Domain]; exists {
+		s.mu.Unlock()
+		return fmt.Errorf("%w: route %q conflicts with external route", domain.ErrRouteConflict, route.Domain)
+	}
 	previousCanonicalRoute, canonicalExisted := currentConfig.Routes[route.Domain]
 	legacyKey := legacyRouteStorageKey(route.Domain)
 	_, legacyExisted := currentConfig.Routes[legacyKey]
 	if route.Domain == "" {
 		return domain.ErrRouteDomainEmpty
 	}
-	if !domain.IsValidRouteDomain(route.Domain) {
+	canonicalDomain, ok := domain.CanonicalRouteDomain(route.Domain)
+	if !ok {
 		return domain.ErrRouteDomainInvalid
 	}
+	route.Domain = canonicalDomain
 	if route.Image == "" {
 		return domain.ErrRouteImageEmpty
 	}
 	if domainName == "" {
 		return domain.ErrRouteDomainEmpty
 	}
-	if !domain.IsValidRouteDomain(domainName) {
+	canonicalDomain, ok := domain.CanonicalRouteDomain(domainName)
+	if !ok {
 		return domain.ErrRouteDomainInvalid
 	}
+	domainName = canonicalDomain
 	// Store previous value for rollback
 	s.mu.Lock()
 	currentConfig := s.config
-	_, ok := currentConfig.Routes[domainName]
+	_, ok = currentConfig.Routes[domainName]
 	if !ok {
 		s.mu.Unlock()
 		return domain.ErrRouteNotFound
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	result := make(map[string]string)
+	result := make(map[string]string, len(s.config.ExternalRoutes))
 	for k, v := range s.config.ExternalRoutes {
 		result[k] = v
 	}

M internal/usecase/config/service_test.go +87 -1


@@ -458,6 +458,92 @@ func TestService_GetRoute(t *testing.T) {
458		})	458		})
459		}	459		}
460			460
			461	+	func TestLoadCanonicalRoutes_RejectsDuplicateCanonicalRouteKeys(t *testing.T) {
			462	+	_, err := loadCanonicalRoutes(map[string]any{
			463	+	"App.Example.com": "app:v1",
			464	+	"app.example.com": "app:v2",
			465	+	})
			466	+
			467	+	require.Error(t, err)
			468	+	assert.Contains(t, err.Error(), "duplicate route key")
			469	+	}
			470	+
			471	+	func TestService_Load_RejectsExternalRouteConflictingWithRoute(t *testing.T) {
			472	+	v := viper.New()
			473	+	v.Set("routes", map[string]any{
			474	+	"App.Example.com": "app:latest",
			475	+	})
			476	+	v.Set("external_routes", map[string]any{
			477	+	"app.example.com": "203.0.113.10:5000",
			478	+	})
			479	+
			480	+	svc := NewService(v, mocks.NewMockEventPublisher(t))
			481	+	err := svc.Load(testContext())
			482	+
			483	+	require.Error(t, err)
			484	+	assert.Contains(t, err.Error(), "conflicts with configured route")
			485	+	}
			486	+
			487	+	func TestLoadExternalRoutes_RejectsInvalidAndDuplicateKeys(t *testing.T) {
			488	+	t.Run("invalid", func(t *testing.T) {
			489	+	_, err := loadExternalRoutes(map[string]any{
			490	+	"bad.example.com:8080": "203.0.113.10:5000",
			491	+	})
			492	+
			493	+	require.Error(t, err)
			494	+	assert.Contains(t, err.Error(), "invalid external route key")
			495	+	})
			496	+
			497	+	t.Run("duplicate canonical", func(t *testing.T) {
			498	+	_, err := loadExternalRoutes(map[string]any{
			499	+	"Reg.Example.com": "203.0.113.10:5000",
			500	+	"reg.example.com": "203.0.113.11:5000",
			501	+	})
			502	+
			503	+	require.Error(t, err)
			504	+	assert.Contains(t, err.Error(), "duplicate external route key")
			505	+	})
			506	+	}
			507	+
			508	+	func TestService_AddRoute_RejectsExternalRouteConflict(t *testing.T) {
			509	+	v := viper.New()
			510	+	v.Set("external_routes", map[string]any{
			511	+	"app.example.com": "203.0.113.10:5000",
			512	+	})
			513	+
			514	+	svc := NewService(v, mocks.NewMockEventPublisher(t))
			515	+	ctx := testContext()
			516	+	require.NoError(t, svc.Load(ctx))
			517	+
			518	+	err := svc.AddRoute(ctx, domain.Route{Domain: "App.Example.com", Image: "app:latest"})
			519	+
			520	+	require.Error(t, err)
			521	+	assert.ErrorIs(t, err, domain.ErrRouteConflict)
			522	+	assert.Contains(t, err.Error(), "conflicts with external route")
			523	+	}
			524	+
			525	+	func TestService_AddRoute_CanonicalizesDomainCaseAndRejectsInvalidAuthority(t *testing.T) {
			526	+	configFile := filepath.Join(t.TempDir(), "gordon.toml")
			527	+	require.NoError(t, os.WriteFile(configFile, []byte("[routes]\n"), 0600))
			528	+	v := viper.New()
			529	+	v.SetConfigFile(configFile)
			530	+	svc := NewService(v, mocks.NewMockEventPublisher(t))
			531	+	ctx := testContext()
			532	+	require.NoError(t, svc.Load(ctx))
			533	+
			534	+	require.NoError(t, svc.AddRoute(ctx, domain.Route{Domain: "App.Example.com", Image: "app:latest", HTTPS: true}))
			535	+	route, err := svc.GetRoute(ctx, "app.example.com")
			536	+	require.NoError(t, err)
			537	+	assert.Equal(t, "app.example.com", route.Domain)
			538	+	_, err = svc.GetRoute(ctx, "APP.EXAMPLE.COM")
			539	+	require.NoError(t, err)
			540	+
			541	+	err = svc.AddRoute(ctx, domain.Route{Domain: "bad.example.com:8080", Image: "app:latest"})
			542	+	assert.ErrorIs(t, err, domain.ErrRouteDomainInvalid)
			543	+	err = svc.AddRoute(ctx, domain.Route{Domain: "bad.example.com.", Image: "app:latest"})
			544	+	assert.ErrorIs(t, err, domain.ErrRouteDomainInvalid)
			545	+	}
			546	+
461		func TestService_AddRoute(t *testing.T) {	547		func TestService_AddRoute(t *testing.T) {
462		t.Run("success", func(t *testing.T) {	548		t.Run("success", func(t *testing.T) {
463		// Create temp config file for Save() to work	549		// Create temp config file for Save() to work

@@ -1556,7 +1642,7 @@ func TestService_AutoRouteAllowedDomains(t *testing.T) {
1556		func TestService_GetExternalRoutes(t *testing.T) {	1642		func TestService_GetExternalRoutes(t *testing.T) {
1557		v := viper.New()	1643		v := viper.New()
1558		v.Set("external_routes", map[string]interface{}{	1644		v.Set("external_routes", map[string]interface{}{
1559	-	"reg.example.com": "localhost:5000",	1645	+	"Reg.Example.com": "localhost:5000",
1560		"cache.example.com": "127.0.0.1:6379",	1646		"cache.example.com": "127.0.0.1:6379",
1561		})	1647		})
1562			1648

M internal/usecase/container/autoroute.go +59 -8


@@ -174,6 +174,13 @@ func (h *AutoRouteHandler) processRoutes(ctx context.Context, domains []string,
174		continue	174		continue
175		}	175		}
176			176
			177	+	canonicalDomain, ok := domain.CanonicalRouteDomain(routeDomain)
			178	+	if !ok {
			179	+	log.Warn().Str("domain", routeDomain).Msg("auto-route rejected invalid domain")
			180	+	continue
			181	+	}
			182	+	routeDomain = canonicalDomain
			183	+
177		created := h.createOrUpdateRoute(ctx, routeDomain, imageName, allowedDomains)	184		created := h.createOrUpdateRoute(ctx, routeDomain, imageName, allowedDomains)
178			185
179		if created && labels.EnvFile != "" && h.extractor != nil && h.envDir != "" {	186		if created && labels.EnvFile != "" && h.extractor != nil && h.envDir != "" {

@@ -259,6 +266,38 @@ func (h *AutoRouteHandler) triggerDeploy(ctx context.Context, route domain.Route
259		}	266		}
260		}	267		}
261			268
			269	+	func allowedAbsoluteEnvFileRoots() []string {
			270	+	return []string{"/app", "/workspace", "/usr/src/app"}
			271	+	}
			272	+
			273	+	func validateAutoRouteEnvFilePath(envFilePath string) (string, error) {
			274	+	envFilePath = strings.TrimSpace(envFilePath)
			275	+	if envFilePath == "" {
			276	+	return "", fmt.Errorf("env file path cannot be empty")
			277	+	}
			278	+	if strings.Contains(envFilePath, "\x00") {
			279	+	return "", fmt.Errorf("env file path contains NUL byte")
			280	+	}
			281	+
			282	+	cleaned := filepath.Clean(envFilePath)
			283	+	if cleaned == "." \|\| cleaned == string(filepath.Separator) \|\| cleaned == ".." \|\| strings.HasPrefix(cleaned, ".."+string(filepath.Separator)) {
			284	+	return "", fmt.Errorf("unsafe env file path: %s", envFilePath)
			285	+	}
			286	+	if filepath.IsAbs(cleaned) && !pathHasAllowedRoot(cleaned, allowedAbsoluteEnvFileRoots()) {
			287	+	return "", fmt.Errorf("unsafe env file path: %s", envFilePath)
			288	+	}
			289	+	return cleaned, nil
			290	+	}
			291	+
			292	+	func pathHasAllowedRoot(path string, roots []string) bool {
			293	+	for _, root := range roots {
			294	+	if path == root \|\| strings.HasPrefix(path, root+string(filepath.Separator)) {
			295	+	return true
			296	+	}
			297	+	}
			298	+	return false
			299	+	}
			300	+
262		// extractAndMergeEnvFile extracts an env file from the image and merges it with existing secrets.	301		// extractAndMergeEnvFile extracts an env file from the image and merges it with existing secrets.
263		func (h *AutoRouteHandler) extractAndMergeEnvFile(ctx context.Context, imageRef, routeDomain, envFilePath string) error {	302		func (h *AutoRouteHandler) extractAndMergeEnvFile(ctx context.Context, imageRef, routeDomain, envFilePath string) error {
264		log := zerowrap.FromCtx(ctx)	303		log := zerowrap.FromCtx(ctx)

@@ -269,8 +308,13 @@ func (h *AutoRouteHandler) extractAndMergeEnvFile(ctx context.Context, imageRef,
269		Str("env_file", envFilePath).	308		Str("env_file", envFilePath).
270		Msg("extracting env file from image")	309		Msg("extracting env file from image")
271			310
			311	+	safeEnvFilePath, err := validateAutoRouteEnvFilePath(envFilePath)
			312	+	if err != nil {
			313	+	return err
			314	+	}
			315	+
272		// Extract env file from image	316		// Extract env file from image
273	-	envData, err := h.extractor.ExtractEnvFileFromImage(ctx, imageRef, envFilePath)	317	+	envData, err := h.extractor.ExtractEnvFileFromImage(ctx, imageRef, safeEnvFilePath)
274		if err != nil {	318		if err != nil {
275		return fmt.Errorf("failed to extract env file: %w", err)	319		return fmt.Errorf("failed to extract env file: %w", err)
276		}	320		}

@@ -291,13 +335,8 @@ func (h *AutoRouteHandler) extractAndMergeEnvFile(ctx context.Context, imageRef,
291		return nil	335		return nil
292		}	336		}
293			337
294	-	// Security check: reject imported env files containing secret references	338	+	if err := rejectSecretReferences(imageEnv); err != nil {
295	-	// to prevent attacker-controlled images from persisting ${provider:path}	339	+	return err
296	-	// syntax that would later resolve against host secret providers.
297	-	for key, value := range imageEnv {
298	-	if domain.ContainsSecretReference(value) {
299	-	return fmt.Errorf("env key %q contains secret reference: %w", key, domain.ErrEnvContainsSecretRef)
300	-	}
301		}	340		}
302			341
303		// Load existing env file for this domain	342		// Load existing env file for this domain

@@ -379,6 +418,18 @@ func domainToEnvFileName(domainName string) (string, error) {
379		return storageKey.FileName(), nil	418		return storageKey.FileName(), nil
380		}	419		}
381			420
			421	+	func rejectSecretReferences(env map[string]string) error {
			422	+	// Security check: reject imported env files containing secret references
			423	+	// to prevent attacker-controlled images from persisting ${provider:path}
			424	+	// syntax that would later resolve against host secret providers.
			425	+	for key, value := range env {
			426	+	if domain.ContainsSecretReference(value) {
			427	+	return fmt.Errorf("env key %q contains secret reference: %w", key, domain.ErrEnvContainsSecretRef)
			428	+	}
			429	+	}
			430	+	return nil
			431	+	}
			432	+
382		// writeEnvFile writes environment variables to a file.	433		// writeEnvFile writes environment variables to a file.
383		func writeEnvFile(path string, env map[string]string) error {	434		func writeEnvFile(path string, env map[string]string) error {
384		var buf bytes.Buffer	435		var buf bytes.Buffer

M internal/usecase/container/autoroute_test.go +47 -0


@@ -910,6 +910,53 @@ func (e *testEnvExtractor) ExtractEnvFileFromImage(_ context.Context, imageRef,
910		910
911	// collectDomains tests	911		// collectDomains tests
912		912
		913	+	func TestValidateAutoRouteEnvFilePath(t *testing.T) {
		914	+	tests := []struct {
		915	+	name string
		916	+	path string
		917	+	want string
		918	+	wantErr bool
		919	+	}{
		920	+	{name: "relative path", path: ".env", want: ".env"},
		921	+	{name: "absolute app path", path: "/app/.env", want: "/app/.env"},
		922	+	{name: "absolute workspace path", path: "/workspace/.env", want: "/workspace/.env"},
		923	+	{name: "cleans safe path", path: "/app/config/../.env", want: "/app/.env"},
		924	+	{name: "absolute traversal escapes app root", path: "/app/../../etc/passwd", wantErr: true},
		925	+	{name: "absolute non app path", path: "/etc/passwd", wantErr: true},
		926	+	{name: "empty", path: "", wantErr: true},
		927	+	{name: "root", path: "/", wantErr: true},
		928	+	{name: "traversal", path: "../.env", wantErr: true},
		929	+	{name: "proc", path: "/proc/self/environ", wantErr: true},
		930	+	{name: "sys", path: "/sys/kernel", wantErr: true},
		931	+	{name: "dev", path: "/dev/null", wantErr: true},
		932	+	{name: "run", path: "/run/secrets", wantErr: true},
		933	+	{name: "var run", path: "/var/run/docker.sock", wantErr: true},
		934	+	}
		935	+
		936	+	for _, tt := range tests {
		937	+	t.Run(tt.name, func(t *testing.T) {
		938	+	got, err := validateAutoRouteEnvFilePath(tt.path)
		939	+	if tt.wantErr {
		940	+	assert.Error(t, err)
		941	+	return
		942	+	}
		943	+	require.NoError(t, err)
		944	+	assert.Equal(t, tt.want, got)
		945	+	})
		946	+	}
		947	+	}
		948	+
		949	+	func TestAutoRouteHandler_ExtractAndMergeEnvFile_UsesCleanSafeEnvFilePath(t *testing.T) {
		950	+	ctx := zerowrap.WithCtx(context.Background(), zerowrap.Default())
		951	+	extractor := &testEnvExtractor{data: []byte("FOO=bar\n")}
		952	+	handler := NewAutoRouteHandler(ctx, inmocks.NewMockConfigService(t), inmocks.NewMockContainerService(t), mocks.NewMockBlobStorage(t), "registry.example.com").
		953	+	WithEnvExtractor(extractor, t.TempDir())
		954	+
		955	+	err := handler.extractAndMergeEnvFile(ctx, "myapp:latest", "app.example.com", "/app/config/../.env")
		956	+	require.NoError(t, err)
		957	+	assert.Equal(t, "/app/.env", extractor.lastPath)
		958	+	}
		959	+
913	func TestAutoRouteHandler_ExtractAndMergeEnvFile_RejectsSecretReferences(t *testing.T) {	960		func TestAutoRouteHandler_ExtractAndMergeEnvFile_RejectsSecretReferences(t *testing.T) {
914	tests := []struct {	961		tests := []struct {
915	name string	962		name string

M internal/usecase/container/service.go +211 -21


@@ -5,10 +5,12 @@ import (
5		"bufio"	5		"bufio"
6		"context"	6		"context"
7		"encoding/binary"	7		"encoding/binary"
			8	+	"encoding/hex"
8		"errors"	9		"errors"
9		"fmt"	10		"fmt"
10		"io"	11		"io"
11		"maps"	12		"maps"
			13	+	"net"
12		"slices"	14		"slices"
13		"strconv"	15		"strconv"
14		"strings"	16		"strings"

@@ -43,7 +45,11 @@ type Config struct {
43		NetworkIsolation bool	45		NetworkIsolation bool
44		NetworkPrefix string	46		NetworkPrefix string
45		NetworkGroups map[string][]string	47		NetworkGroups map[string][]string
			48	+	NetworkInternal bool
46		Attachments map[string][]string	49		Attachments map[string][]string
			50	+	AllowedRegistries []string
			51	+	RequireImageDigest bool
			52	+	SecurityProfile string
47		ReadinessDelay time.Duration // Delay after container starts before considering it ready	53		ReadinessDelay time.Duration // Delay after container starts before considering it ready
48		ReadinessMode string // Readiness strategy: auto, docker-health, delay	54		ReadinessMode string // Readiness strategy: auto, docker-health, delay
49		HealthTimeout time.Duration // Max wait for health-based readiness	55		HealthTimeout time.Duration // Max wait for health-based readiness

@@ -268,7 +274,7 @@ func (s Service) buildContainerConfig(in containerConfigInput) domain.Containe
268		}	274		}
269		}	275		}
270			276
271	-	return &domain.ContainerConfig{	277	+	containerConfig := &domain.ContainerConfig{
272		Image: in.ImageRef,	278		Image: in.ImageRef,
273		Name: containerName,	279		Name: containerName,
274		Ports: ports,	280		Ports: ports,

@@ -282,6 +288,8 @@ func (s Service) buildContainerConfig(in containerConfigInput) domain.Containe
282		NanoCPUs: cfg.DefaultNanoCPUs,	288		NanoCPUs: cfg.DefaultNanoCPUs,
283		PidsLimit: cfg.DefaultPidsLimit,	289		PidsLimit: cfg.DefaultPidsLimit,
284		}	290		}
			291	+	applySecurityProfile(containerConfig, cfg)
			292	+	return containerConfig
285		}	293		}
286			294
287		// Deploy creates and starts a container for the given route.	295		// Deploy creates and starts a container for the given route.

@@ -561,7 +569,10 @@ func (s *Service) prepareDeployResources(ctx context.Context, route domain.Route
561		log.WrapErr(err, "failed to cleanup orphaned containers")	569		log.WrapErr(err, "failed to cleanup orphaned containers")
562		}	570		}
563			571
564	-	imageRef := s.buildImageRef(route.Image)	572	+	imageRef, err := s.buildValidatedImageRef(ctx, route.Image)
			573	+	if err != nil {
			574	+	return nil, err
			575	+	}
565		actualImageRef, err := s.ensureImage(ctx, imageRef)	576		actualImageRef, err := s.ensureImage(ctx, imageRef)
566		if err != nil {	577		if err != nil {
567		return nil, err	578		return nil, err

@@ -1668,6 +1679,14 @@ func (s *Service) startLogCollection(ctx context.Context, containerID, domainNam
1668		}	1679		}
1669		}	1680		}
1670			1681
			1682	+	func (s *Service) buildValidatedImageRef(ctx context.Context, image string) (string, error) {
			1683	+	imageRef := s.buildImageRef(image)
			1684	+	if err := s.validateImageRef(ctx, imageRef); err != nil {
			1685	+	return "", err
			1686	+	}
			1687	+	return imageRef, nil
			1688	+	}
			1689	+
1671		func (s *Service) buildImageRef(image string) string {	1690		func (s *Service) buildImageRef(image string) string {
1672		s.mu.RLock()	1691		s.mu.RLock()
1673		cfg := s.config	1692		cfg := s.config

@@ -1743,6 +1762,135 @@ func hasExplicitRegistry(image string) bool {
1743		return false	1762		return false
1744		}	1763		}
1745			1764
			1765	+	func (s *Service) validateImageRef(ctx context.Context, imageRef string) error {
			1766	+	if !hasExplicitRegistry(imageRef) {
			1767	+	return nil
			1768	+	}
			1769	+	return s.validateExternalImageRef(ctx, imageRef, imageRegistry(imageRef))
			1770	+	}
			1771	+
			1772	+	func (s *Service) validateImagePullRef(ctx context.Context, imageRef string) error {
			1773	+	return s.validateExternalImageRef(ctx, imageRef, imageRegistryForPolicy(imageRef))
			1774	+	}
			1775	+
			1776	+	func (s *Service) validateExternalImageRef(ctx context.Context, imageRef, registry string) error {
			1777	+	s.mu.RLock()
			1778	+	cfg := s.config
			1779	+	s.mu.RUnlock()
			1780	+
			1781	+	if registry == "" {
			1782	+	return fmt.Errorf("image %q rejected: invalid image reference", imageRef)
			1783	+	}
			1784	+
			1785	+	if sameRegistry(registry, cfg.RegistryDomain) {
			1786	+	return nil
			1787	+	}
			1788	+	dangerous, err := isDangerousRegistryHost(ctx, imageRegistryHost(registry))
			1789	+	if err != nil {
			1790	+	return fmt.Errorf("image %q rejected: registry %q could not be verified: %w", imageRef, registry, err)
			1791	+	}
			1792	+	if dangerous {
			1793	+	return fmt.Errorf("image %q rejected: registry %q is not allowed", imageRef, registry)
			1794	+	}
			1795	+	if len(cfg.AllowedRegistries) == 0 {
			1796	+	return fmt.Errorf("image %q rejected: registry %q is not in images.allowed_registries", imageRef, registry)
			1797	+	}
			1798	+	for _, allowed := range cfg.AllowedRegistries {
			1799	+	if sameRegistry(registry, allowed) {
			1800	+	if cfg.RequireImageDigest && !isValidSha256DigestRef(imageRef) {
			1801	+	return fmt.Errorf("image %q rejected: digest reference required", imageRef)
			1802	+	}
			1803	+	return nil
			1804	+	}
			1805	+	}
			1806	+	return fmt.Errorf("image %q rejected: registry %q is not in images.allowed_registries", imageRef, registry)
			1807	+	}
			1808	+
			1809	+	func imageRegistry(imageRef string) string {
			1810	+	slashIdx := strings.Index(imageRef, "/")
			1811	+	if slashIdx == -1 {
			1812	+	return ""
			1813	+	}
			1814	+	return normalizeRegistry(imageRef[:slashIdx])
			1815	+	}
			1816	+
			1817	+	func imageRegistryForPolicy(imageRef string) string {
			1818	+	if hasExplicitRegistry(imageRef) {
			1819	+	return imageRegistry(imageRef)
			1820	+	}
			1821	+	return "docker.io"
			1822	+	}
			1823	+
			1824	+	// normalizeRegistry normalizes a registry string for comparison purposes only.
			1825	+	// This function is used by sameRegistry to determine if two registry strings
			1826	+	// refer to the same registry. The output intentionally strips IPv6 brackets
			1827	+	// (e.g., "[fd00::1]:5000" -> "fd00::1:5000") which is acceptable for equality
			1828	+	// checks but the result MUST NOT be used to construct or emit valid registry URLs.
			1829	+	func normalizeRegistry(registry string) string {
			1830	+	registry = strings.ToLower(strings.TrimSuffix(strings.TrimSpace(registry), "."))
			1831	+	registry = strings.TrimSuffix(registry, "/")
			1832	+	if strings.HasPrefix(registry, "[") {
			1833	+	if end := strings.Index(registry, "]"); end != -1 {
			1834	+	host := strings.Trim(registry[:end+1], "[]")
			1835	+	port := registry[end+1:]
			1836	+	return host + port
			1837	+	}
			1838	+	}
			1839	+	return registry
			1840	+	}
			1841	+
			1842	+	func imageRegistryHost(registry string) string {
			1843	+	if ip := net.ParseIP(registry); ip != nil {
			1844	+	return registry
			1845	+	}
			1846	+	if h, _, err := net.SplitHostPort(registry); err == nil {
			1847	+	return strings.Trim(h, "[]")
			1848	+	}
			1849	+	if strings.HasPrefix(registry, "[") && strings.Contains(registry, "]") {
			1850	+	return strings.TrimPrefix(strings.Split(registry, "]")[0], "[")
			1851	+	}
			1852	+	if colon := strings.LastIndex(registry, ":"); colon != -1 && isNumeric(registry[colon+1:]) {
			1853	+	return registry[:colon]
			1854	+	}
			1855	+	return registry
			1856	+	}
			1857	+
			1858	+	func sameRegistry(a, b string) bool {
			1859	+	return normalizeRegistry(a) == normalizeRegistry(b)
			1860	+	}
			1861	+
			1862	+	func isDangerousRegistryHost(ctx context.Context, host string) (bool, error) {
			1863	+	host = strings.ToLower(strings.TrimSuffix(host, "."))
			1864	+	if host == "localhost" \|\| host == "metadata.google.internal" {
			1865	+	return true, nil
			1866	+	}
			1867	+	if ip := net.ParseIP(host); ip != nil {
			1868	+	return isDangerousRegistryIP(ip), nil
			1869	+	}
			1870	+	addrs, err := net.DefaultResolver.LookupIPAddr(ctx, host)
			1871	+	if err != nil {
			1872	+	return false, err
			1873	+	}
			1874	+	for _, addr := range addrs {
			1875	+	if isDangerousRegistryIP(addr.IP) {
			1876	+	return true, nil
			1877	+	}
			1878	+	}
			1879	+	return false, nil
			1880	+	}
			1881	+
			1882	+	func isDangerousRegistryIP(ip net.IP) bool {
			1883	+	return ip.IsLoopback() \|\| ip.IsPrivate() \|\| ip.IsLinkLocalUnicast() \|\| ip.IsLinkLocalMulticast() \|\| ip.IsUnspecified()
			1884	+	}
			1885	+
			1886	+	func applySecurityProfile(config *domain.ContainerConfig, cfg Config) {
			1887	+	if strings.EqualFold(cfg.SecurityProfile, "strict") {
			1888	+	config.ReadOnlyRootFS = true
			1889	+	config.CapDrop = []string{"ALL"}
			1890	+	config.CapAdd = []string{"NET_BIND_SERVICE"}
			1891	+	}
			1892	+	}
			1893	+
1746		// isNumeric checks if a string contains only digits.	1894		// isNumeric checks if a string contains only digits.
1747		func isNumeric(s string) bool {	1895		func isNumeric(s string) bool {
1748		for _, c := range s {	1896		for _, c := range s {

@@ -1767,7 +1915,16 @@ func normalizePullPolicy(policy string) string {
1767		}	1915		}
1768			1916
1769		func isDigestRef(imageRef string) bool {	1917		func isDigestRef(imageRef string) bool {
1770	-	return strings.Contains(imageRef, "@sha256:")	1918	+	return isValidSha256DigestRef(imageRef)
			1919	+	}
			1920	+
			1921	+	func isValidSha256DigestRef(imageRef string) bool {
			1922	+	_, digest, ok := strings.Cut(imageRef, "@sha256:")
			1923	+	if !ok \|\| len(digest) != 64 {
			1924	+	return false
			1925	+	}
			1926	+	_, err := hex.DecodeString(digest)
			1927	+	return err == nil
1771		}	1928		}
1772			1929
1773		func (s *Service) pullRefForDeploy(ctx context.Context, imageRef string) (string, bool) {	1930		func (s *Service) pullRefForDeploy(ctx context.Context, imageRef string) (string, bool) {

@@ -1794,6 +1951,9 @@ func (s *Service) ensureImage(ctx context.Context, imageRef string) (string, err
1794			1951
1795		// Determine if this is an internal deploy and what reference to use for pulls.	1952		// Determine if this is an internal deploy and what reference to use for pulls.
1796		pullRef, isInternal := s.pullRefForDeploy(ctx, imageRef)	1953		pullRef, isInternal := s.pullRefForDeploy(ctx, imageRef)
			1954	+	if err := s.validateImagePullRef(ctx, imageRef); err != nil {
			1955	+	return "", err
			1956	+	}
1797		if pullRef != imageRef {	1957		if pullRef != imageRef {
1798		log.Info().	1958		log.Info().
1799		Str("original_ref", imageRef).	1959		Str("original_ref", imageRef).

@@ -2101,7 +2261,10 @@ func (s *Service) createNetworkIfNeeded(ctx context.Context, networkName string)
2101		}	2261		}
2102			2262
2103		if !exists {	2263		if !exists {
2104	-	if err := s.runtime.CreateNetwork(ctx, networkName, map[string]string{"driver": "bridge"}); err != nil {	2264	+	s.mu.RLock()
			2265	+	internal := s.config.NetworkInternal
			2266	+	s.mu.RUnlock()
			2267	+	if err := s.runtime.CreateNetwork(ctx, networkName, domain.NetworkConfig{Driver: "bridge", Internal: internal}); err != nil {
2105		return log.WrapErr(err, "failed to create network")	2268		return log.WrapErr(err, "failed to create network")
2106		}	2269		}
2107		log.Info().Msg("created network for app isolation")	2270		log.Info().Msg("created network for app isolation")

@@ -2415,31 +2578,23 @@ func (s *Service) deployAttachedService(ctx context.Context, ownerDomain, servic
2415		log.Info().Str(zerowrap.FieldService, serviceImage).Msg("deploying attached service")	2578		log.Info().Str(zerowrap.FieldService, serviceImage).Msg("deploying attached service")
2416			2579
2417		// Ensure image (canonical ref is returned; internal pulls may use the local registry).	2580		// Ensure image (canonical ref is returned; internal pulls may use the local registry).
2418	-	imageRef := s.buildImageRef(serviceImage)	2581	+	imageRef, err := s.buildValidatedImageRef(ctx, serviceImage)
2419	-	actualImageRef, err := s.ensureImage(ctx, imageRef)
2420		if err != nil {	2582		if err != nil {
2421		return err	2583		return err
2422		}	2584		}
2423	-		2585	+	actualImageRef, err := s.ensureImage(ctx, imageRef)
2424	-	// Get image metadata
2425	-	exposedPorts, err := s.runtime.GetImageExposedPorts(ctx, actualImageRef)
2426		if err != nil {	2586		if err != nil {
2427	-	log.WrapErr(err, "failed to get exposed ports for attachment, using defaults")	2587	+	return err
2428	-	exposedPorts = []int{}
2429		}	2588		}
2430			2589
2431	-	// Setup volumes (attachments need persistent data)	2590	+	exposedPorts := s.attachmentExposedPorts(ctx, actualImageRef)
2432	-	volumes, err := s.setupVolumes(ctx, containerName, actualImageRef)	2591	+	volumes, err := s.attachmentVolumes(ctx, containerName, actualImageRef)
2433		if err != nil {	2592		if err != nil {
2434	-	log.WrapErr(err, "failed to setup volumes for attachment")	2593	+	return err
2435	-	volumes = make(map[string]string)
2436		}	2594		}
2437	-		2595	+	envVars, err := s.attachmentEnv(ctx, containerName, actualImageRef)
2438	-	// Load environment (attachment-specific env file)
2439	-	envVars, err := s.loadEnvironment(ctx, nil, containerName, actualImageRef)
2440		if err != nil {	2596		if err != nil {
2441	-	log.WrapErr(err, "failed to load environment for attachment")	2597	+	return err
2442	-	envVars = []string{}
2443		}	2598		}
2444		envHash := hashEnvironment(envVars)	2599		envHash := hashEnvironment(envVars)
2445			2600

@@ -2468,6 +2623,7 @@ func (s *Service) deployAttachedService(ctx context.Context, ownerDomain, servic
2468		NanoCPUs: cfg.DefaultNanoCPUs,	2623		NanoCPUs: cfg.DefaultNanoCPUs,
2469		PidsLimit: cfg.DefaultPidsLimit,	2624		PidsLimit: cfg.DefaultPidsLimit,
2470		}	2625		}
			2626	+	applySecurityProfile(config, cfg)
2471			2627
2472		container, err := s.runtime.CreateContainer(ctx, config)	2628		container, err := s.runtime.CreateContainer(ctx, config)
2473		if err != nil {	2629		if err != nil {

@@ -2502,8 +2658,38 @@ func (s *Service) deployAttachedService(ctx context.Context, ownerDomain, servic
2502		return nil	2658		return nil
2503		}	2659		}
2504			2660
			2661	+	func (s *Service) attachmentExposedPorts(ctx context.Context, imageRef string) []int {
			2662	+	log := zerowrap.FromCtx(ctx)
			2663	+	exposedPorts, err := s.runtime.GetImageExposedPorts(ctx, imageRef)
			2664	+	if err != nil {
			2665	+	log.WrapErr(err, "failed to get exposed ports for attachment, using defaults")
			2666	+	return []int{}
			2667	+	}
			2668	+	return exposedPorts
			2669	+	}
			2670	+
			2671	+	func (s *Service) attachmentVolumes(ctx context.Context, containerName, imageRef string) (map[string]string, error) {
			2672	+	volumes, err := s.setupVolumes(ctx, containerName, imageRef)
			2673	+	if err != nil {
			2674	+	return nil, fmt.Errorf("failed to setup volumes for attachment %s with image %s: %w", containerName, imageRef, err)
			2675	+	}
			2676	+	return volumes, nil
			2677	+	}
			2678	+
			2679	+	func (s *Service) attachmentEnv(ctx context.Context, containerName, imageRef string) ([]string, error) {
			2680	+	envVars, err := s.loadEnvironment(ctx, nil, containerName, imageRef)
			2681	+	if err != nil {
			2682	+	return nil, fmt.Errorf("failed to load environment for attachment %s with image %s: %w", containerName, imageRef, err)
			2683	+	}
			2684	+	return envVars, nil
			2685	+	}
			2686	+
2505		func (s Service) attachmentEnvDrifted(ctx context.Context, existing domain.Container, containerName, serviceImage string) (bool, error) {	2687		func (s Service) attachmentEnvDrifted(ctx context.Context, existing domain.Container, containerName, serviceImage string) (bool, error) {
2506	-	currentEnv, err := s.loadEnvironment(ctx, nil, containerName, s.buildImageRef(serviceImage))	2688	+	imageRef, err := s.buildValidatedImageRef(ctx, serviceImage)
			2689	+	if err != nil {
			2690	+	return false, err
			2691	+	}
			2692	+	currentEnv, err := s.loadEnvironment(ctx, nil, containerName, imageRef)
2507		if err != nil {	2693		if err != nil {
2508		return false, err	2694		return false, err
2509		}	2695		}

@@ -2598,6 +2784,10 @@ func (s *Service) resolveExistingAttachment(ctx context.Context, ownerDomain, se
2598		// Utility functions	2784		// Utility functions
2599			2785
2600		func normalizeImageRef(image string) string {	2786		func normalizeImageRef(image string) string {
			2787	+	if isDigestRef(image) {
			2788	+	return image
			2789	+	}
			2790	+
2601		// Extract repository from image reference, handling port numbers correctly.	2791		// Extract repository from image reference, handling port numbers correctly.
2602		// Examples:	2792		// Examples:
2603		// nginx:latest -> docker.io/library/nginx	2793		// nginx:latest -> docker.io/library/nginx

M internal/usecase/container/service_test.go +155 -6

 // suitable for unit tests that don't want to wait for real timeouts.
 func testMinDelayConfig() Config {
 	return Config{
+		AllowedRegistries:    []string{"docker.io"},
 		ReadinessDelay:       time.Millisecond,
 		DrainDelay:           time.Millisecond,
 		DrainDelayConfigured: true,
 	eventBus := mocks.NewMockEventPublisher(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		NetworkIsolation:     false,
 		VolumeAutoCreate:     false,
 		ReadinessDelay:       time.Millisecond, // Minimal delay for tests
 	eventBus := mocks.NewMockEventPublisher(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		NetworkIsolation:     false,
 		VolumeAutoCreate:     false,
 		ReadinessDelay:       time.Millisecond,
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
-	config := Config{}
+	config := Config{AllowedRegistries: []string{"docker.io"}}
 	svc := NewService(runtime, envLoader, eventBus, nil, config, nil)
 	ctx := testContext()
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
-	svc := NewService(runtime, envLoader, eventBus, nil, Config{}, nil)
+	svc := NewService(runtime, envLoader, eventBus, nil, Config{AllowedRegistries: []string{"docker.io"}}, nil)
 	ctx := testContext()
 	route := domain.Route{
 	eventBus := mocks.NewMockEventPublisher(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		ReadinessMode:        "docker-health",
 		HealthTimeout:        10 * time.Millisecond,
 		ReadinessDelay:       time.Millisecond,
 	eventBus := mocks.NewMockEventPublisher(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		ReadinessMode:        "docker-health",
 		ReadinessDelay:       time.Millisecond,
 		DrainDelay:           time.Millisecond,
 	runtime := mocks.NewMockContainerRuntime(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		RegistryAuthEnabled:  true,
 		ServiceTokenUsername: "gordon-service",
 		ServiceToken:         "service-token",
 	runtime := mocks.NewMockContainerRuntime(t)
 	config := Config{
+		AllowedRegistries:   []string{"docker.io"},
 		RegistryAuthEnabled: true,
 	}
 	runtime := mocks.NewMockContainerRuntime(t)
 	config := Config{
+		AllowedRegistries:        []string{"docker.io"},
 		RegistryAuthEnabled:      true,
 		InternalRegistryUsername: "internal",
 		InternalRegistryPassword: "secret",
 	cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		ReadinessDelay:       time.Millisecond, // Minimal delay for tests
 		DrainDelay:           time.Millisecond,
 		DrainDelayConfigured: true,
 	eventBus := mocks.NewMockEventPublisher(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		NetworkIsolation:     true,
 		NetworkPrefix:        "gordon",
 		ReadinessDelay:       time.Millisecond, // Minimal delay for tests
 	// Network isolation - should check and create network
 	runtime.EXPECT().NetworkExists(mock.Anything, "gordon-test-example-com").Return(false, nil)
-	runtime.EXPECT().CreateNetwork(mock.Anything, "gordon-test-example-com", map[string]string{"driver": "bridge"}).Return(nil)
+	runtime.EXPECT().CreateNetwork(mock.Anything, "gordon-test-example-com", domain.NetworkConfig{Driver: "bridge"}).Return(nil)
 	container := &domain.Container{ID: "container-123", Status: "created"}
 	runtime.EXPECT().CreateContainer(mock.Anything, mock.MatchedBy(func(cfg *domain.ContainerConfig) bool {
 	eventBus := mocks.NewMockEventPublisher(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		VolumeAutoCreate:     true,
 		VolumePrefix:         "gordon",
 		ReadinessDelay:       time.Millisecond, // Minimal delay for tests
 	eventBus := mocks.NewMockEventPublisher(t)
 	config := Config{
-		NetworkIsolation: true,
+		AllowedRegistries: []string{"docker.io"},
-		NetworkPrefix:    "gordon",
+		NetworkIsolation:  true,
+		NetworkPrefix:     "gordon",
 	}
 	svc := NewService(runtime, envLoader, eventBus, nil, config, nil)
 	ctx := testContext()
 			input:    "registry.example.com:5000/image:v1.0",
 			expected: "registry.example.com:5000/image",
 		},
+		{
+			name:     "digest ref preserves digest",
+			input:    "registry.example.com/image@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+			expected: "registry.example.com/image@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+		},
+		{
+			name:     "docker hub digest ref preserves digest",
+			input:    "nginx@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+			expected: "nginx@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+		},
 	}
 	for _, tt := range tests {
 	eventBus := mocks.NewMockEventPublisher(t)
 	config := Config{
+		AllowedRegistries:        []string{"docker.io"},
 		RegistryAuthEnabled:      true,
 		RegistryDomain:           "registry.example.com",
 		RegistryPort:             5000,
 	eventBus := mocks.NewMockEventPublisher(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		ReadinessDelay:       time.Millisecond,
 		DrainDelay:           time.Millisecond,
 		DrainDelayConfigured: true,
 	eventBus := mocks.NewMockEventPublisher(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		ReadinessDelay:       time.Millisecond,
 		DrainDelay:           time.Millisecond,
 		DrainDelayConfigured: true,
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
-	config := Config{}
+	config := Config{AllowedRegistries: []string{"docker.io"}}
 	svc := NewService(runtime, envLoader, eventBus, nil, config, nil)
 	ctx := testContext()
 	cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		ReadinessDelay:       time.Millisecond, // Minimal delay for tests
 		DrainDelay:           time.Millisecond,
 		DrainDelayConfigured: true,
 	eventBus := mocks.NewMockEventPublisher(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		ReadinessDelay:       time.Millisecond, // Minimal delay for tests
 		DrainDelay:           time.Millisecond,
 		DrainDelayConfigured: true,
 	eventBus := mocks.NewMockEventPublisher(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		ReadinessDelay:       time.Millisecond,
 		DrainDelay:           time.Millisecond,
 		DrainDelayConfigured: true,
 	eventBus := mocks.NewMockEventPublisher(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		ReadinessDelay:       time.Millisecond,
 		DrainDelay:           time.Millisecond,
 		DrainDelayConfigured: true,
 	eventBus := mocks.NewMockEventPublisher(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		ReadinessDelay:       time.Millisecond,
 		DrainDelay:           time.Millisecond,
 		DrainDelayConfigured: true,
 	cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		ReadinessDelay:       time.Millisecond,
 		DrainDelay:           time.Millisecond,
 		DrainDelayConfigured: true,
 	cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		ReadinessDelay:       time.Millisecond,
 		DrainDelay:           time.Millisecond,
 		DrainDelayConfigured: true,
 	cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		ReadinessDelay:       time.Millisecond,
 		DrainDelay:           time.Millisecond,
 		DrainDelayConfigured: true,
 	eventBus := mocks.NewMockEventPublisher(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		ReadinessDelay:       time.Millisecond,
 		DrainDelay:           time.Millisecond,
 		DrainDelayConfigured: true,
 	eventBus := mocks.NewMockEventPublisher(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		ReadinessDelay:       time.Millisecond,
 		DrainDelay:           time.Millisecond,
 		DrainDelayConfigured: true,
 	eventBus := mocks.NewMockEventPublisher(t)
 	config := Config{
+		AllowedRegistries:    []string{"docker.io"},
 		NetworkIsolation:     false,
 		VolumeAutoCreate:     false,
 		ReadinessDelay:       time.Millisecond,
 	require.Len(t, attachIDs, 1)
 	assert.Equal(t, "pg-container-1", attachIDs[0])
 }
+func TestService_BuildValidatedImageRef_RegistryPolicy(t *testing.T) {
+	svc := NewService(nil, nil, nil, nil, Config{
+		RegistryAuthEnabled: true,
+		RegistryDomain:      "registry.example.com",
+		AllowedRegistries:   []string{"docker.io"},
+	}, nil)
+	ref, err := svc.buildValidatedImageRef(context.Background(), "myapp:latest")
+	require.NoError(t, err)
+	assert.Equal(t, "registry.example.com/myapp:latest", ref)
+	ref, err = svc.buildValidatedImageRef(context.Background(), "registry.example.com/myapp:latest")
+	require.NoError(t, err)
+	assert.Equal(t, "registry.example.com/myapp:latest", ref)
+	ref, err = svc.buildValidatedImageRef(context.Background(), "docker.io/library/nginx:latest")
+	require.NoError(t, err)
+	assert.Equal(t, "docker.io/library/nginx:latest", ref)
+	for _, image := range []string{
+		"ghcr.io/acme/app:latest",
+		"localhost:5000/app:latest",
+		"127.0.0.1:5000/app:latest",
+		"10.0.0.2:5000/app:latest",
+		"169.254.169.254/app:latest",
+	} {
+		t.Run(image, func(t *testing.T) {
+			_, err := svc.buildValidatedImageRef(context.Background(), image)
+			require.Error(t, err)
+		})
+	}
+}
+func TestService_BuildValidatedImageRef_RejectsExternalRegistryWhenAllowlistEmpty(t *testing.T) {
+	svc := NewService(nil, nil, nil, nil, Config{}, nil)
+	_, err := svc.buildValidatedImageRef(context.Background(), "ghcr.io/acme/app:latest")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "images.allowed_registries")
+	err = svc.validateImagePullRef(context.Background(), "nginx:latest")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "docker.io")
+}
+func TestService_BuildValidatedImageRef_RequireDigestOnlyForExternalAllowedRegistries(t *testing.T) {
+	svc := NewService(nil, nil, nil, nil, Config{
+		RegistryAuthEnabled: true,
+		RegistryDomain:      "registry.example.com",
+		RequireImageDigest:  true,
+		AllowedRegistries:   []string{"docker.io"},
+	}, nil)
+	_, err := svc.buildValidatedImageRef(context.Background(), "docker.io/library/nginx:latest")
+	require.Error(t, err)
+	err = svc.validateImagePullRef(context.Background(), "nginx:latest")
+	require.Error(t, err)
+	_, err = svc.buildValidatedImageRef(context.Background(), "docker.io/library/nginx@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
+	require.NoError(t, err)
+	_, err = svc.buildValidatedImageRef(context.Background(), "docker.io/library/nginx@sha256:not-a-digest")
+	require.Error(t, err)
+	ref, err := svc.buildValidatedImageRef(context.Background(), "myapp:latest")
+	require.NoError(t, err)
+	assert.Equal(t, "registry.example.com/myapp:latest", ref)
+	_, err = svc.buildValidatedImageRef(context.Background(), "registry.example.com/myapp:latest")
+	require.NoError(t, err)
+}
+func TestService_BuildValidatedImageRef_AllowedRegistryMatchesPort(t *testing.T) {
+	svc := NewService(nil, nil, nil, nil, Config{AllowedRegistries: []string{"docker.io:5000"}}, nil)
+	_, err := svc.buildValidatedImageRef(context.Background(), "docker.io:5000/app:latest")
+	require.NoError(t, err)
+	_, err = svc.buildValidatedImageRef(context.Background(), "docker.io:5001/app:latest")
+	require.Error(t, err)
+}
+func TestService_CreateNetworkIfNeeded_UsesInternalOptionWhenConfigured(t *testing.T) {
+	runtime := mocks.NewMockContainerRuntime(t)
+	svc := NewService(runtime, nil, nil, nil, Config{NetworkInternal: true}, nil)
+	runtime.EXPECT().NetworkExists(mock.Anything, "gordon-app").Return(false, nil)
+	runtime.EXPECT().CreateNetwork(mock.Anything, "gordon-app", domain.NetworkConfig{Driver: "bridge", Internal: true}).Return(nil)
+	require.NoError(t, svc.createNetworkIfNeeded(testContext(), "gordon-app"))
+}
+func TestService_BuildContainerConfig_StrictSecurityProfile(t *testing.T) {
+	svc := NewService(nil, nil, nil, nil, Config{SecurityProfile: "strict"}, nil)
+	cfg := svc.buildContainerConfig(containerConfigInput{Domain: "app.example.com", Image: "app:latest", ImageRef: "app:latest"})
+	assert.True(t, cfg.ReadOnlyRootFS)
+	assert.Equal(t, []string{"ALL"}, cfg.CapDrop)
+	assert.Equal(t, []string{"NET_BIND_SERVICE"}, cfg.CapAdd)
+}
+func TestService_BuildContainerConfig_CompatSecurityProfileDefault(t *testing.T) {
+	svc := NewService(nil, nil, nil, nil, Config{}, nil)
+	cfg := svc.buildContainerConfig(containerConfigInput{Domain: "app.example.com", Image: "app:latest", ImageRef: "app:latest"})
+	assert.False(t, cfg.ReadOnlyRootFS)
+	assert.Nil(t, cfg.CapDrop)
+	assert.Nil(t, cfg.CapAdd)
+}

M internal/usecase/proxy/service.go +52 -5

 import (
 	"context"
+	"fmt"
 	"net"
 	"os"
 	"strconv"
 // GetTarget returns the proxy target for a given domain.
 func (s *Service) GetTarget(ctx context.Context, domainName string) (target *domain.ProxyTarget, retErr error) {
+	canonicalDomain, ok := domain.CanonicalRouteDomain(domainName)
+	if !ok {
+		return nil, domain.ErrNoTargetAvailable
+	}
+	domainName = canonicalDomain
 	ctx, span := proxyTracer.Start(ctx, "proxy.get_target",
 		trace.WithAttributes(attribute.String("domain", domainName)))
 	defer func() {
 	if err != nil {
 		return nil, log.WrapErrWithFields(err, "invalid port in external route", map[string]any{"target": targetAddr})
 	}
+	if port < 1 || port > 65535 {
+		return nil, fmt.Errorf("invalid port in external route %q: port must be between 1 and 65535", targetAddr)
+	}
 	// SECURITY: Resolve DNS and validate that the target is not an internal/blocked
 	// network. We use the resolved IP as the proxy target to prevent DNS rebinding
 // RegisterTarget registers a new proxy target for a domain.
 func (s *Service) RegisterTarget(_ context.Context, domainName string, target *domain.ProxyTarget) error {
+	canonicalDomain, ok := domain.CanonicalRouteDomain(domainName)
+	if !ok {
+		return domain.ErrRouteDomainInvalid
+	}
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	s.targets[domainName] = target
+	s.targets[canonicalDomain] = target
 	return nil
 }
 // UnregisterTarget removes a proxy target for a domain.
 func (s *Service) UnregisterTarget(_ context.Context, domainName string) error {
+	canonicalDomain, ok := domain.CanonicalRouteDomain(domainName)
+	if !ok {
+		return domain.ErrRouteDomainInvalid
+	}
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	delete(s.targets, domainName)
+	delete(s.targets, canonicalDomain)
 	return nil
 }
 // InvalidateTarget removes a cached proxy target, forcing re-lookup on next request.
 // This is used during zero-downtime deployments to switch traffic to a new container.
 func (s *Service) InvalidateTarget(_ context.Context, domainName string) {
+	canonicalDomain, ok := domain.CanonicalRouteDomain(domainName)
+	if !ok {
+		return
+	}
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	delete(s.targets, domainName)
+	delete(s.targets, canonicalDomain)
 }
 // WaitForNoInFlight waits until no requests are currently proxied to the
 // IsRegistryDomain returns true if the host matches the configured registry domain.
 func (s *Service) IsRegistryDomain(host string) bool {
+	canonicalHost, ok := domain.CanonicalRouteDomain(host)
+	if !ok {
+		return false
+	}
 	s.mu.RLock()
-	defer s.mu.RUnlock()
+	registryDomain, ok := domain.CanonicalRouteDomain(s.config.RegistryDomain)
-	return s.config.RegistryDomain != "" && host == s.config.RegistryDomain
+	s.mu.RUnlock()
+	return ok && canonicalHost == registryDomain
+}
+// IsKnownHost returns true if host is configured as registry, route, or external route.
+func (s *Service) IsKnownHost(ctx context.Context, host string) bool {
+	canonicalHost, ok := domain.CanonicalRouteDomain(host)
+	if !ok {
+		return false
+	}
+	if s.IsRegistryDomain(canonicalHost) {
+		return true
+	}
+	if _, err := s.configSvc.GetRoute(ctx, canonicalHost); err == nil {
+		return true
+	}
+	_, ok = s.configSvc.GetExternalRoutes()[canonicalHost]
+	return ok
 }
 // TrackInFlight records an in-flight request for a container.

M internal/usecase/proxy/service_test.go +51 -17


@@ -47,6 +47,28 @@ func TestService_GetTarget_FromCache(t *testing.T) {
47		assert.Equal(t, cachedTarget, result)	47		assert.Equal(t, cachedTarget, result)
48		}	48		}
49			49
			50	+	func TestService_GetTarget_CanonicalizesHostForLookup(t *testing.T) {
			51	+	runtime := outmocks.NewMockContainerRuntime(t)
			52	+	containerSvc := inmocks.NewMockContainerService(t)
			53	+	configSvc := inmocks.NewMockConfigService(t)
			54	+	svc := NewService(runtime, containerSvc, configSvc, Config{})
			55	+	ctx := testContext()
			56	+
			57	+	configSvc.EXPECT().GetExternalRoutes().Return(map[string]string{})
			58	+	containerSvc.EXPECT().Get(mock.Anything, "app.example.com").Return(nil, false)
			59	+
			60	+	result, err := svc.GetTarget(ctx, "App.Example.com")
			61	+	assert.ErrorIs(t, err, domain.ErrNoTargetAvailable)
			62	+	assert.Nil(t, result)
			63	+	}
			64	+
			65	+	func TestService_GetTarget_RejectsInvalidHostAuthority(t *testing.T) {
			66	+	svc := NewService(outmocks.NewMockContainerRuntime(t), inmocks.NewMockContainerService(t), inmocks.NewMockConfigService(t), Config{})
			67	+	result, err := svc.GetTarget(testContext(), "app.example.com:8080")
			68	+	assert.ErrorIs(t, err, domain.ErrNoTargetAvailable)
			69	+	assert.Nil(t, result)
			70	+	}
			71	+
50		func TestService_GetTarget_ContainerNotFound(t *testing.T) {	72		func TestService_GetTarget_ContainerNotFound(t *testing.T) {
51		runtime := outmocks.NewMockContainerRuntime(t)	73		runtime := outmocks.NewMockContainerRuntime(t)
52		containerSvc := inmocks.NewMockContainerService(t)	74		containerSvc := inmocks.NewMockContainerService(t)

@@ -169,22 +191,34 @@ func TestService_GetTarget_ExternalRoute_InvalidTarget(t *testing.T) {
169		}	191		}
170			192
171		func TestService_GetTarget_ExternalRoute_InvalidPort(t *testing.T) {	193		func TestService_GetTarget_ExternalRoute_InvalidPort(t *testing.T) {
172	-	runtime := outmocks.NewMockContainerRuntime(t)	194	+	tests := []struct {
173	-	containerSvc := inmocks.NewMockContainerService(t)	195	+	name string
174	-	configSvc := inmocks.NewMockConfigService(t)	196	+	target string
			197	+	}{
			198	+	{name: "not a number", target: "localhost:abc"},
			199	+	{name: "zero", target: "localhost:0"},
			200	+	{name: "too high", target: "localhost:65536"},
			201	+	}
175			202
176	-	svc := NewService(runtime, containerSvc, configSvc, Config{})	203	+	for _, tt := range tests {
177	-	ctx := testContext()	204	+	t.Run(tt.name, func(t *testing.T) {
			205	+	runtime := outmocks.NewMockContainerRuntime(t)
			206	+	containerSvc := inmocks.NewMockContainerService(t)
			207	+	configSvc := inmocks.NewMockConfigService(t)
178			208
179	-	// Mock external routes with invalid port	209	+	svc := NewService(runtime, containerSvc, configSvc, Config{})
180	-	configSvc.EXPECT().GetExternalRoutes().Return(map[string]string{	210	+	ctx := testContext()
181	-	"invalid.example.com": "localhost:abc",
182	-	})
183			211
184	-	result, err := svc.GetTarget(ctx, "invalid.example.com")	212	+	configSvc.EXPECT().GetExternalRoutes().Return(map[string]string{
			213	+	"invalid.example.com": tt.target,
			214	+	})
185			215
186	-	assert.Error(t, err)	216	+	result, err := svc.GetTarget(ctx, "invalid.example.com")
187	-	assert.Nil(t, result)	217	+
			218	+	assert.Error(t, err)
			219	+	assert.Nil(t, result)
			220	+	})
			221	+	}
188		}	222		}
189			223
190		func TestService_RegisterTarget(t *testing.T) {	224		func TestService_RegisterTarget(t *testing.T) {

@@ -202,11 +236,11 @@ func TestService_RegisterTarget(t *testing.T) {
202		Scheme: "http",	236		Scheme: "http",
203		}	237		}
204			238
205	-	err := svc.RegisterTarget(ctx, "app.example.com", target)	239	+	err := svc.RegisterTarget(ctx, "App.Example.com", target)
206			240
207		assert.NoError(t, err)	241		assert.NoError(t, err)
208			242
209	-	// Verify target is cached	243	+	// Verify target is cached under the canonical domain.
210		svc.mu.RLock()	244		svc.mu.RLock()
211		cached := svc.targets["app.example.com"]	245		cached := svc.targets["app.example.com"]
212		svc.mu.RUnlock()	246		svc.mu.RUnlock()

@@ -228,7 +262,7 @@ func TestService_UnregisterTarget(t *testing.T) {
228		Port: 8080,	262		Port: 8080,
229		}	263		}
230			264
231	-	err := svc.UnregisterTarget(ctx, "app.example.com")	265	+	err := svc.UnregisterTarget(ctx, "App.Example.com")
232			266
233		assert.NoError(t, err)	267		assert.NoError(t, err)
234			268

@@ -313,8 +347,8 @@ func TestService_InvalidateTarget(t *testing.T) {
313		ContainerID: "old-container",	347		ContainerID: "old-container",
314		}	348		}
315			349
316	-	// Invalidate the target	350	+	// Invalidate the target using mixed-case input.
317	-	svc.InvalidateTarget(ctx, "app.example.com")	351	+	svc.InvalidateTarget(ctx, "App.Example.com")
318			352
319		// Verify target is removed from cache	353		// Verify target is removed from cache
320		svc.mu.RLock()	354		svc.mu.RLock()

M internal/usecase/registry/service.go +2 -2


@@ -304,7 +304,7 @@ func (s *Service) StartUpload(ctx context.Context, name string) (string, error)
304		}	304		}
305			305
306		// AppendBlobChunk appends data to an in-progress blob upload.	306		// AppendBlobChunk appends data to an in-progress blob upload.
307	-	func (s *Service) AppendBlobChunk(ctx context.Context, name, uuid string, data io.Reader) (int64, error) {	307	+	func (s *Service) AppendBlobChunk(ctx context.Context, name, uuid string, data io.Reader, contentLength, maxBlobSize int64) (int64, error) {
308		ctx = zerowrap.CtxWithFields(ctx, map[string]any{	308		ctx = zerowrap.CtxWithFields(ctx, map[string]any{
309		zerowrap.FieldLayer: "usecase",	309		zerowrap.FieldLayer: "usecase",
310		zerowrap.FieldUseCase: "AppendBlobChunk",	310		zerowrap.FieldUseCase: "AppendBlobChunk",

@@ -313,7 +313,7 @@ func (s *Service) AppendBlobChunk(ctx context.Context, name, uuid string, data i
313		})	313		})
314		log := zerowrap.FromCtx(ctx)	314		log := zerowrap.FromCtx(ctx)
315			315
316	-	length, err := s.blobStorage.AppendBlobChunk(name, uuid, data)	316	+	length, err := s.blobStorage.AppendBlobChunk(name, uuid, data, contentLength, maxBlobSize)
317		if err != nil {	317		if err != nil {
318		return 0, log.WrapErr(err, "failed to append blob chunk")	318		return 0, log.WrapErr(err, "failed to append blob chunk")
319		}	319		}

M internal/usecase/registry/service_test.go +32 -0


@@ -306,6 +306,38 @@ func TestService_StartUpload_Error(t *testing.T) {
306	assert.Contains(t, err.Error(), "failed to start blob upload")	306		assert.Contains(t, err.Error(), "failed to start blob upload")
307	}	307		}
308		308
		309	+	func TestService_AppendBlobChunk_PassesMaxBlobSize(t *testing.T) {
		310	+	blobStorage := mocks.NewMockBlobStorage(t)
		311	+	manifestStorage := mocks.NewMockManifestStorage(t)
		312	+	eventBus := mocks.NewMockEventPublisher(t)
		313	+
		314	+	svc := NewService(blobStorage, manifestStorage, eventBus)
		315	+	ctx := testContext()
		316	+
		317	+	blobStorage.EXPECT().AppendBlobChunk("myapp", "upload-id", mock.Anything, int64(4), int64(10)).Return(int64(4), nil)
		318	+
		319	+	length, err := svc.AppendBlobChunk(ctx, "myapp", "upload-id", strings.NewReader("data"), 4, 10)
		320	+
		321	+	assert.NoError(t, err)
		322	+	assert.Equal(t, int64(4), length)
		323	+	}
		324	+
		325	+	func TestService_AppendBlobChunk_MaxBlobSizeExceeded(t *testing.T) {
		326	+	blobStorage := mocks.NewMockBlobStorage(t)
		327	+	manifestStorage := mocks.NewMockManifestStorage(t)
		328	+	eventBus := mocks.NewMockEventPublisher(t)
		329	+
		330	+	svc := NewService(blobStorage, manifestStorage, eventBus)
		331	+	ctx := testContext()
		332	+
		333	+	blobStorage.EXPECT().AppendBlobChunk("myapp", "upload-id", mock.Anything, int64(11), int64(10)).Return(int64(0), domain.ErrBlobSizeExceeded)
		334	+
		335	+	_, err := svc.AppendBlobChunk(ctx, "myapp", "upload-id", strings.NewReader("too large"), 11, 10)
		336	+
		337	+	require.Error(t, err)
		338	+	assert.ErrorIs(t, err, domain.ErrBlobSizeExceeded)
		339	+	}
		340	+
309	func TestService_FinishUpload_Success(t *testing.T) {	341		func TestService_FinishUpload_Success(t *testing.T) {
310	blobStorage := mocks.NewMockBlobStorage(t)	342		blobStorage := mocks.NewMockBlobStorage(t)
311	manifestStorage := mocks.NewMockManifestStorage(t)	343		manifestStorage := mocks.NewMockManifestStorage(t)

M internal/usecase/volumes/service.go +8 -1

 	var removed []*domain.VolumeInfo
 	for _, vol := range vols {
-		if vol.InUse {
+		if !isGordonManagedVolume(vol) || vol.InUse {
 			continue
 		}
 	return report, removed, nil
 }
+func isGordonManagedVolume(vol *domain.VolumeInfo) bool {
+	if vol == nil || vol.Labels == nil {
+		return false
+	}
+	return vol.Labels[domain.LabelManaged] == "true"
+}

M internal/usecase/volumes/service_test.go +46 -5


@@ -31,8 +31,8 @@ func TestService_PruneVolumes_RemovesOrphaned(t *testing.T) {
31		runtime := outmocks.NewMockContainerRuntime(t)	31		runtime := outmocks.NewMockContainerRuntime(t)
32			32
33		vols := []*domain.VolumeInfo{	33		vols := []*domain.VolumeInfo{
34	-	{Name: "vol-in-use", InUse: true, Containers: []string{"web"}},	34	+	{Name: "vol-in-use", InUse: true, Containers: []string{"web"}, Labels: map[string]string{domain.LabelManaged: "true"}},
35	-	{Name: "vol-orphaned", InUse: false, Size: 1024},	35	+	{Name: "vol-orphaned", InUse: false, Size: 1024, Labels: map[string]string{domain.LabelManaged: "true"}},
36		}	36		}
37		runtime.EXPECT().ListVolumes(context.Background()).Return(vols, nil)	37		runtime.EXPECT().ListVolumes(context.Background()).Return(vols, nil)
38		runtime.EXPECT().RemoveVolume(context.Background(), "vol-orphaned", false).Return(nil)	38		runtime.EXPECT().RemoveVolume(context.Background(), "vol-orphaned", false).Return(nil)

@@ -50,7 +50,7 @@ func TestService_PruneVolumes_DryRunDoesNotRemove(t *testing.T) {
50		runtime := outmocks.NewMockContainerRuntime(t)	50		runtime := outmocks.NewMockContainerRuntime(t)
51			51
52		vols := []*domain.VolumeInfo{	52		vols := []*domain.VolumeInfo{
53	-	{Name: "vol-orphaned", InUse: false, Size: 2048},	53	+	{Name: "vol-orphaned", InUse: false, Size: 2048, Labels: map[string]string{domain.LabelManaged: "true"}},
54		}	54		}
55		runtime.EXPECT().ListVolumes(context.Background()).Return(vols, nil)	55		runtime.EXPECT().ListVolumes(context.Background()).Return(vols, nil)
56			56

@@ -62,6 +62,47 @@ func TestService_PruneVolumes_DryRunDoesNotRemove(t *testing.T) {
62		assert.Len(t, removed, 1)	62		assert.Len(t, removed, 1)
63		}	63		}
64			64
			65	+	func TestService_PruneVolumes_OnlyRemovesUnusedGordonManagedVolumes(t *testing.T) {
			66	+	runtime := outmocks.NewMockContainerRuntime(t)
			67	+
			68	+	vols := []*domain.VolumeInfo{
			69	+	{Name: "gordon-used", InUse: true, Size: 100, Labels: map[string]string{domain.LabelManaged: "true"}},
			70	+	{Name: "gordon-unused", InUse: false, Size: 200, Labels: map[string]string{domain.LabelManaged: "true"}},
			71	+	{Name: "other-unused", InUse: false, Size: 300},
			72	+	{Name: "other-labelled-false", InUse: false, Size: 400, Labels: map[string]string{domain.LabelManaged: "false"}},
			73	+	{Name: "other-used", InUse: true, Size: 500},
			74	+	}
			75	+	runtime.EXPECT().ListVolumes(context.Background()).Return(vols, nil)
			76	+	runtime.EXPECT().RemoveVolume(context.Background(), "gordon-unused", false).Return(nil)
			77	+
			78	+	svc := NewService(runtime)
			79	+	report, removed, err := svc.PruneVolumes(context.Background(), false)
			80	+	require.NoError(t, err)
			81	+	assert.Equal(t, 1, report.VolumesRemoved)
			82	+	assert.Equal(t, int64(200), report.SpaceReclaimed)
			83	+	require.Len(t, removed, 1)
			84	+	assert.Equal(t, "gordon-unused", removed[0].Name)
			85	+	}
			86	+
			87	+	func TestService_PruneVolumes_DryRunReportsOnlyUnusedGordonManagedVolumes(t *testing.T) {
			88	+	runtime := outmocks.NewMockContainerRuntime(t)
			89	+
			90	+	vols := []*domain.VolumeInfo{
			91	+	{Name: "gordon-used", InUse: true, Size: 100, Labels: map[string]string{domain.LabelManaged: "true"}},
			92	+	{Name: "gordon-unused", InUse: false, Size: 200, Labels: map[string]string{domain.LabelManaged: "true"}},
			93	+	{Name: "other-unused", InUse: false, Size: 300},
			94	+	}
			95	+	runtime.EXPECT().ListVolumes(context.Background()).Return(vols, nil)
			96	+
			97	+	svc := NewService(runtime)
			98	+	report, removed, err := svc.PruneVolumes(context.Background(), true)
			99	+	require.NoError(t, err)
			100	+	assert.Equal(t, 1, report.VolumesRemoved)
			101	+	assert.Equal(t, int64(200), report.SpaceReclaimed)
			102	+	require.Len(t, removed, 1)
			103	+	assert.Equal(t, "gordon-unused", removed[0].Name)
			104	+	}
			105	+
65		func TestService_PruneVolumes_AllInUse(t *testing.T) {	106		func TestService_PruneVolumes_AllInUse(t *testing.T) {
66		runtime := outmocks.NewMockContainerRuntime(t)	107		runtime := outmocks.NewMockContainerRuntime(t)
67			108

@@ -91,8 +132,8 @@ func TestService_PruneVolumes_SkipsFailedRemoval(t *testing.T) {
91		runtime := outmocks.NewMockContainerRuntime(t)	132		runtime := outmocks.NewMockContainerRuntime(t)
92			133
93		vols := []*domain.VolumeInfo{	134		vols := []*domain.VolumeInfo{
94	-	{Name: "vol-fail", InUse: false, Size: 1024},	135	+	{Name: "vol-fail", InUse: false, Size: 1024, Labels: map[string]string{domain.LabelManaged: "true"}},
95	-	{Name: "vol-ok", InUse: false, Size: 2048},	136	+	{Name: "vol-ok", InUse: false, Size: 2048, Labels: map[string]string{domain.LabelManaged: "true"}},
96		}	137		}
97		runtime.EXPECT().ListVolumes(context.Background()).Return(vols, nil)	138		runtime.EXPECT().ListVolumes(context.Background()).Return(vols, nil)
98		runtime.EXPECT().RemoveVolume(context.Background(), "vol-fail", false).Return(fmt.Errorf("volume in use"))	139		runtime.EXPECT().RemoveVolume(context.Background(), "vol-fail", false).Return(fmt.Errorf("volume in use"))