>_
.issue.db
/highway
Dashboard
Issues
Memory
Lessons
Audit Log
New Issue
Edit Issue #914
Update issue details
Title *
Description
EARS SPEC: - If a docker tool call requests privileged, devices, cap_add, a host bind mount, pid/ipc=host, or a network not labelled highway.workflow_run_id of the calling run, then the engine shall refuse it with a policy error before any docker SDK call. - If exec/stop/remove/logs/inspect/connect targets a container whose highway.tenant_id label differs from the caller's tenant, then the engine shall refuse it. - When compose_up receives inline compose_config, the engine shall validate every service against the same rules. - Where a platform admin grants a per-tenant docker exception, the engine shall allow only the named capability for that tenant. - The dsl-compiler service shall have no route to postgres or api (own egress-only network). Parent epic: #913. Synthesis (technical problems / solution domains / alternatives) recorded as a comment when started.
Priority
Low
Medium
High
Critical
Status
Open
In Progress
Closed
Won't Do
Due Date (YYYY-MM-DD)
Tags (comma separated)
Related Issues (IDs)
Enter IDs of issues related to this one. They will be linked as 'related'.
Update Issue
Cancel