Skip to content

Actions: google/nsjail

Actions

Docker

Actions

Loading...
Loading

Show workflow options

Create status badge

Loading
dockerpush.yml
175 workflow runs
175 workflow runs

Filter by Event

⌥ + click/return to exclude

Filter by Status

⌥ + click/return to exclude

Filter by Branch

⌥ + click/return to exclude

Filter by Actor

⌥ + click/return to exclude
Reject mount destination path traversal Docker #454: Pull request #298 opened by AliAltivate
Action required AliAltivate:agent/mount-destination-traversal
AliAltivate:agent/mount-destination-traversal
Action required
net: seal inherited fds before executing pasta Docker #453: Pull request #297 opened by soul-sol
Action required soul-sol:harden-pasta-fd-inheritance
soul-sol:harden-pasta-fd-inheritance
Action required
Harden jail mounts, capabilities, and nstun networking defaults Docker #452: Pull request #296 opened by M0nd0R
Action required M0nd0R:harden-sandbox-nstun-defaults
M0nd0R:harden-sandbox-nstun-defaults
Action required
contain: retain proc fd directory for descriptor sealing Docker #451: Pull request #294 opened by soul-sol
Action required soul-sol:harden-inherited-fd-sealing
soul-sol:harden-inherited-fd-sealing
Action required
Reject path traversal in mount destinations during jail staging Docker #450: Pull request #292 synchronize by M0nd0R
Action required M0nd0R:fix/mount-dst-path-traversal
M0nd0R:fix/mount-dst-path-traversal
Action required
unotify: write reports privately and atomically Docker #449: Pull request #293 opened by carrerasdarren-cell
Action required carrerasdarren-cell:security/unotify-private-atomic-report
carrerasdarren-cell:security/unotify-private-atomic-report
Action required
Reject path traversal in mount destinations during jail staging Docker #448: Pull request #292 opened by M0nd0R
Action required M0nd0R:fix/mount-dst-path-traversal
M0nd0R:fix/mount-dst-path-traversal
Action required
Merge pull request #291 from yexinw-ctrl/statx-unotify-trace Docker #447: Commit 5ebcc30 pushed by robertswiecki
2m 47s master
master
2m 47s
user: fail closed when supplementary groups cannot be set Docker #445: Pull request #288 synchronize by carrerasdarren-cell
Action required carrerasdarren-cell:fix/fail-closed-setgroups
carrerasdarren-cell:fix/fail-closed-setgroups
Action required
unotify: bound retained syscall statistics Docker #444: Pull request #290 opened by rndaom
Action required rndaom:harden/bound-unotify-stats
rndaom:harden/bound-unotify-stats
Action required
nstun: fail closed on invalid policy rule fields Docker #443: Pull request #289 opened by carrerasdarren-cell
Action required carrerasdarren-cell:fix/nstun-reject-invalid-rules
carrerasdarren-cell:fix/nstun-reject-invalid-rules
Action required
user: fail closed when supplementary groups cannot be set Docker #442: Pull request #288 opened by carrerasdarren-cell
Action required carrerasdarren-cell:fix/fail-closed-setgroups
carrerasdarren-cell:fix/fail-closed-setgroups
Action required
mnt: descriptor-confine mount destination resolution Docker #441: Pull request #287 opened by deprrous
Action required deprrous:agent/mount-destination-confinement-v8
deprrous:agent/mount-destination-confinement-v8
Action required
contain: stop setup if PR_SET_NO_NEW_PRIVS fails Docker #440: Pull request #286 opened by srkyn
Action required srkyn:harden-no-new-privs-failure
srkyn:harden-no-new-privs-failure
Action required
sandbox: fail loudly when seccomp_unotify is requested but unusable Docker #439: Pull request #285 opened by h1-mrz
Action required h1-mrz:fail-loud-seccomp-unotify
h1-mrz:fail-loud-seccomp-unotify
Action required
mnt: apply per-mount nosuid/nodev/noexec recursively to recursive binds Docker #438: Pull request #284 opened by h1-mrz
Action required h1-mrz:harden-recursive-bind-flags
h1-mrz:harden-recursive-bind-flags
Action required
mnt: mount the auto-provisioned /proc nosuid,nodev,noexec Docker #437: Pull request #283 opened by h1-mrz
Action required h1-mrz:harden-proc-mount-flags
h1-mrz:harden-proc-mount-flags
Action required
nstun: block cloud-local service destinations Docker #436: Pull request #282 opened by carrerasdarren-cell
Action required carrerasdarren-cell:security/block-cloud-local-services-20260716
carrerasdarren-cell:security/block-cloud-local-services-20260716
Action required
Reject invalid integer command-line arguments Docker #435: Pull request #281 opened by attaboy11
Action required attaboy11:fix/strict-cli-integers-273
attaboy11:fix/strict-cli-integers-273
Action required
nstun/tcp: validate guest ACK numbers against the send window Docker #434: Pull request #280 opened by g0w6y
-1s g0w6y:nstun_tcp_ack_window_validation
g0w6y:nstun_tcp_ack_window_validation
-1s
nstun: validate TCP acknowledgments before processing payload Docker #433: Pull request #279 opened by Alearner12
Action required Alearner12:fix-nstun-tcp-ack-validation
Alearner12:fix-nstun-tcp-ack-validation
Action required
cgroup: clean up swap-only memory cgroups Docker #432: Pull request #278 opened by sravan27
Action required sravan27:harden-cgroup-memory-cleanup
sravan27:harden-cgroup-memory-cleanup
Action required
mnt: make recursive read-only binds truly recursive Docker #431: Pull request #277 opened by Alb3e3
Action required Alb3e3:alb3e3/recursive-bindmount-hardening
Alb3e3:alb3e3/recursive-bindmount-hardening
Action required
Harden numeric parsing and command overrides Docker #430: Pull request #276 opened by M0nd0R
Action required M0nd0R:security/strict-numeric-parsing
M0nd0R:security/strict-numeric-parsing
Action required
Harden pasta helper execution Docker #429: Pull request #275 opened by M0nd0R
Action required M0nd0R:security/pasta-helper-env
M0nd0R:security/pasta-helper-env
Action required