4 Commits

Author	SHA1	Message	Date
Dan Guido	74d87a53da	Minor cleanups: default TZ to UTC, shellcheck directive, comment clarity (#21) ... - Default timezone to UTC instead of America/New_York - Add shellcheck shell=bash directive to .zshrc - Extract docker filter label into local variable in cmd_down - Clarify mount filter comment (target paths immune to project name changes) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-10 06:49:08 -05:00
Dan Guido	a1f3994cda	Harden devcontainer: pin digests, guard SYS_ADMIN, fix mount filters (#20) ... Address review feedback from #14–#19: - Pin base image and uv with SHA256 digests (#15) - Install fzf from GitHub releases instead of apt (#14) - Add SYS_ADMIN capability guard to prevent remount attacks (#16) - Fix mount filter to use target paths instead of source prefixes (#17) - Fix temp file leak in extract_mounts_to_file (#17) - Sort apt packages alphabetically (#18) - Remove unused Tailscale feature (#19) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-10 06:35:35 -05:00
Dan Guido	90e3280503	Mount .devcontainer/ read-only to prevent container escape on rebuild (#13) ... A process inside the container could modify .devcontainer/devcontainer.json to inject malicious mounts or initializeCommand entries that execute on the host during the next rebuild. Bind-mounting .devcontainer/ as read-only blocks this privilege escalation vector. Uses startswith() for the jq filter to be precise and consistent with other mount filters, and documents the SYS_ADMIN guard requirement. Based on PR #12 with review feedback from @dguido addressed. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-10 03:20:33 -05:00
Dan Guido	91ff6f7c0c	Initial commit	2026-01-29 20:13:16 -05:00