OneDev – Self-hosted Git server with CI/CD, Kanban, and packages • Hacker News Board

Re: OneDev – Self-hosted Git server with CI/CD, Kanban, and packages

#61

Post by franga2000 » Fri, Sep 19, 2025, 4:27 PM UTC

hamdingers wrote: post #60

franga2000 wrote: post #59

Earlier quoted context omitted.

But those containers DON'T have socket access. ONE container has socket access, then it creates other containers WITHOUT socket access. Those containers ARE isolated. Since the untrusted (user provided) code runs in those, the setup is reasonably secure. An RCE in OneDev is an RCE on the host, but that's a completely different threat model. The important part is that user code is isolated, which it is.

> The important part is that user code is isolated, which it is. It isn't for the reasons I stated in previous comments, which you are unable to refute. Your dogged insistence to the contrary is bizarre. I hope you do not work in this area.

I actually don't know who is misunderstanding who here. I work with containers daily and this is how I understand this situation:

The runner (trusted code) is tasked with taking job specifications from the user (untrusted code) and running them in isolated environments. Correct?

The runner is in a container with a mounted docker socket. It sends a /containers/create request to the socket. It passes a base image, some resource limits and maybe a directory mount for the checked out repository (untrusted code). The code could alternatively be copied instead of mounted. Correct?

The new container is created by dockerd without the socket mounted, because that wasn't specified by the runner ("Volumes": [] or maybe ["/whatever/user/repo/:/repo/"]). Correct?

The untrusted code is now executed inside that container. Because the container was created with no special mounts or privileges, it is as isolated as if it was created manually with docker run. Correct?

The job finishes executing, the runner uses the socket to collect the logs and artifacts, then it destroys the container. Correct?

So please tell me how you think untrusted code could get access to the socket here?

Re: OneDev – Self-hosted Git server with CI/CD, Kanban, and packages

#62

Post by odie5533 » Fri, Sep 19, 2025, 5:00 PM UTC

abdullahkhalids wrote: post #31

odie5533 wrote: post #6

Why do people self-host things like this instead of Github or Gitlab? I don't want to maintain more services for my services. Who has time for that.

A better question is why does it take any time to maintain a tool like this? I spend zero time maintaining my open-source browser (Firefox). It just periodically updates itself and everything just works. I maybe spend a bit of time maintaining my IDE by updating settings and installing plugins for it, but nothing onerous. A tool like this is not fundamentally more complex than a browser or a full-fledged IDE.

You ever have a Firefox update where you have to go and change Settings, or adjust your extensions? Never?

Re: OneDev – Self-hosted Git server with CI/CD, Kanban, and packages

#63

Post by [deleted] » Fri, Sep 19, 2025, 11:13 PM UTC

franga2000 wrote: post #61

hamdingers wrote: post #60

Earlier quoted context omitted.

> The important part is that user code is isolated, which it is. It isn't for the reasons I stated in previous comments, which you are unable to refute. Your dogged insistence to the contrary is bizarre. I hope you do not work in this area.

I actually don't know who is misunderstanding who here. I work with containers daily and this is how I understand this situation: The runner (trusted code) is tasked with taking job specifications from the user (untrusted code) and running them in isolated environments. Correct? The runner is in a container with a mounted docker socket. It sends a /containers/create request to the socket. It passes a base image, some…

[deleted]

Re: OneDev – Self-hosted Git server with CI/CD, Kanban, and packages

#64

Post by abdullahkhalids » Sat, Sep 20, 2025, 12:58 AM UTC

odie5533 wrote: post #62

abdullahkhalids wrote: post #31

Earlier quoted context omitted.

A better question is why does it take any time to maintain a tool like this? I spend zero time maintaining my open-source browser (Firefox). It just periodically updates itself and everything just works. I maybe spend a bit of time maintaining my IDE by updating settings and installing plugins for it, but nothing onerous. A tool like this is not fundamentally more complex than a browser or a full-fledged IDE.

You ever have a Firefox update where you have to go and change Settings, or adjust your extensions? Never?

I am using 14 different extensions in Firefox. I don't think any of them have broken due to a Firefox update for at least the past 3 years.

The only maintenance I have had to do was when the "I don't care about cookie's" extension got sold out, so had to switch to a fork [1]. That was 2-3 years ago.

[1] https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies

Re: OneDev – Self-hosted Git server with CI/CD, Kanban, and packages

#65

Post by j1elo » Sun, Sep 21, 2025, 10:18 AM UTC

franga2000 wrote: post #61

hamdingers wrote: post #60

Earlier quoted context omitted.

> The important part is that user code is isolated, which it is. It isn't for the reasons I stated in previous comments, which you are unable to refute. Your dogged insistence to the contrary is bizarre. I hope you do not work in this area.

I actually don't know who is misunderstanding who here. I work with containers daily and this is how I understand this situation: The runner (trusted code) is tasked with taking job specifications from the user (untrusted code) and running them in isolated environments. Correct? The runner is in a container with a mounted docker socket. It sends a /containers/create request to the socket. It passes a base image, some…

I read you both late to say this but you were misunderstanding each other fundamentally because no one stated it clearly (until this last message) what is trusted code. You consider OneDev as trusted, the other user does not. Given the recent track record of vulnerable dependencies in FOSS (and everywhere really), I would also consider that the platform software itself must be considered as untrusted, and user guides should only request for advanced permissions as long as they also instruct to install everything in an isolated VM.

Re: OneDev – Self-hosted Git server with CI/CD, Kanban, and packages

#66

Post by franga2000 » Sun, Sep 21, 2025, 10:30 AM UTC

j1elo wrote: post #65

franga2000 wrote: post #61

Earlier quoted context omitted.

I actually don't know who is misunderstanding who here. I work with containers daily and this is how I understand this situation: The runner (trusted code) is tasked with taking job specifications from the user (untrusted code) and running them in isolated environments. Correct? The runner is in a container with a mounted docker socket. It sends a /containers/create request to the socket. It passes a base image, some…

I read you both late to say this but you were misunderstanding each other fundamentally because no one stated it clearly (until this last message) what is trusted code. You consider OneDev as trusted, the other user does not. Given the recent track record of vulnerable dependencies in FOSS (and everywhere really), I would also consider that the platform software itself must be considered as untrusted, and user guides…

I agree it should be in a VM and it would be great to put that in the documentation, but the reality usually is that your CI/CD tool will already have very elevated access to your infra. The people deploying using docker compose are usually not the kind of people that have tightly scoped deployment credentials. If someone can get into your CD system, they can almost certainly run arbitrary code on your production machines.

Re: OneDev – Self-hosted Git server with CI/CD, Kanban, and packages

#67

Post by rmoriz » Sun, Sep 21, 2025, 7:17 PM UTC

bigfishrunning wrote: post #27

rmoriz wrote: post #24

Earlier quoted context omitted.

Microsoft/GitHub has no model training. How do you think Copilot works? Also if you provide open source, people and companies are gonna use it.

When I publish open source code, I don't mind if people or companies use it, or maybe even learn from it. What I don't like is feeding it into a giant plagiarism machine that is perpetuating the centralization of power on the internet.

to me plagiarism is a 100% copy of intellectual property or maybe a high percentage, like 80%+

LLMs don't store the code, only the probability chains of tokens (words). AFAIK this is not plagiarism.

I remember the later 2000s, when a German company called "Rocket Internet" was copycatting companies like AirBnB, Zappos and others. Many consider this lame and some kind of moral freeloading, it's not prohibited.