amayer1983/docksentry v2.16.1

v2.16.1 — the audit stops flagging the baseline

on GitHub

/audit stops reporting what Docker does to every container

The first real-world run of yesterday's audit rework — against a stock ollama — returned four findings. All four were values Docker writes into every container unasked: CgroupnsMode "private", ConsoleSize [0,0], and the standard MaskedPaths / ReadonlyPaths lists. Measured against a plain nginx: the same four.

An audit that flags the baseline is an audit people learn to ignore, which is precisely the defect the section was built to fix. One release earlier.

It turned out three different truths were tangled together:

• MaskedPaths and ReadonlyPaths are derived. Docker computes them from --privileged and --security-opt, both of which the recreate already carries — so the recreated container gets the same values recomputed. They were never lost, and saying they would be was wrong.
• ConsoleSize [0,0] and CgroupnsMode "private" are defaults, and defaults are not findings.
• An explicit --cgroupns host was genuinely dropped on recreate. Nobody had noticed; the audit rework surfaced it by accident. It is carried now.

And the "please open an issue" plea appears only under genuinely unknown fields. The deliberately-skipped section is a statement of policy, not a coverage gap — inviting issues about it invites reports that would be closed as intended.