From 2fee899f52e3e734a66d5ab1615e2ed1fd2338b0 Mon Sep 17 00:00:00 2001 From: Usman Shahid Date: Thu, 3 Sep 2026 19:13:26 +0400 Subject: [PATCH] SECURITY fix(souslet): bind deployed containers to loopback, not 0.0.0.0 cmd/souslet/main.go called engine.New("", *gpuDriver), hardcoding an empty bindHost instead of threading through the already-parsed -bind-host flag (default "127.0.0.1"). engine.Docker's bindHost field is what controls a deployed container's actual PortBindings HostIP - an empty string there makes the Engine API bind 0.0.0.0 (every interface), not "unset, default to loopback". Handlers.BindHost (correctly wired already, one line below) only controls the port-allocation availability PROBE - a separate concern souslet's own port.Allocator uses, not what a container actually publishes on. Consequence, confirmed live: every model deployed through souslet tonight (gemma4-12b on aorus-ubuntu, qwen38-dflash2/dflash2 on asus-gx10) was directly reachable on its node's tailnet IP, bypassing the entire mTLS-gRPC-tunnel-only design this redesign was built around - no API-key gating, no auth, nothing between the tailnet and the raw vLLM server. cmd/sous-api/main.go's equivalent call already does this correctly (engine.New(cfg.Host(), "cdi")); this was souslet-specific, present since souslet's very first version tonight. Co-Authored-By: Claude Sonnet 5 --- cmd/souslet/main.go | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/cmd/souslet/main.go b/cmd/souslet/main.go index ec84d20..5f28b4d 100644 --- a/cmd/souslet/main.go +++ b/cmd/souslet/main.go @@ -100,7 +100,19 @@ func main() { log.Fatalf("build TLS config: %v", err) } - dockerEngine, err := engine.New("", *gpuDriver) + // *bindHost, NOT "". engine.Docker's own bindHost is what actually + // controls a deployed container's PortBindings HostIP - an empty + // string there makes Docker bind 0.0.0.0 (every interface), not + // "unset, so default to loopback". Handlers.BindHost (below) only + // controls the PORT ALLOCATION PROBE, a separate concern from what a + // container actually publishes on - passing "" here left every + // souslet-deployed model reachable directly on the node's tailnet IP, + // bypassing the mTLS-gRPC-tunnel-only design entirely (see stacks/ + // souslet/docker-compose.yml in the fleet repo's own account of why + // that boundary matters). cmd/sous-api/main.go's equivalent call + // already does this correctly (engine.New(cfg.Host(), "cdi")) - this + // was souslet-specific. + dockerEngine, err := engine.New(*bindHost, *gpuDriver) if err != nil { log.Fatalf("connect to local Docker: %v", err) }