Skip to content

Commit 901921b

Browse files
h4x3rotabclaude
andcommitted
Merge main and fix CodeQL security findings
- Resolve merge conflict in README.md nav links - Fix information exposure via exceptions in agent.py (return generic error messages instead of str(e) in / and /chat endpoints) - Remove unused imports (json, sys) in verify.py Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2 parents 122bf4d + 43da63b commit 901921b

23 files changed

Lines changed: 1769 additions & 460 deletions

README.md

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
**Example applications for [dstack](https://github.com/Dstack-TEE/dstack) - Deploy containerized apps to TEEs with end-to-end security in minutes**
1111

12-
[Getting Started](#getting-started)[Confidential AI](#confidential-ai)[Tutorials](#tutorials)[Use Cases](#use-cases)[Core Patterns](#core-patterns)[Dev Tools](#dev-scaffolding)[Starter Packs](#starter-packs)
12+
[Getting Started](#getting-started)[Confidential AI](#confidential-ai)[Tutorials](#tutorials)[Use Cases](#use-cases)[Core Patterns](#core-patterns)[Infrastructure](#infrastructure)[Dev Tools](#dev-scaffolding)[Starter Packs](#starter-packs)[Other Use Cases](#other-use-cases)
1313

1414
</div>
1515

@@ -159,6 +159,16 @@ Development and debugging tools. **Not for production.**
159159
160160
---
161161
162+
## Infrastructure
163+
164+
Run infrastructure services inside TEEs.
165+
166+
| Example | Description |
167+
|---------|-------------|
168+
| [k3s](./k3s) | Single-node k3s cluster in a TEE with wildcard HTTPS and remote kubectl |
169+
170+
---
171+
162172
## Tech Demos
163173
164174
Interesting demonstrations.

confidential-ai/agents/agent.py

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -140,8 +140,8 @@ def index():
140140
"app_id": info.app_id,
141141
}
142142
)
143-
except Exception as e:
144-
return jsonify({"status": "running", "error": str(e)})
143+
except Exception:
144+
return jsonify({"status": "running", "error": "Failed to retrieve agent info"})
145145

146146

147147
@app.route("/attestation")
@@ -169,8 +169,8 @@ def chat():
169169
"wallet": get_account().address,
170170
}
171171
)
172-
except Exception as e:
173-
return jsonify({"error": str(e)}), 500
172+
except Exception:
173+
return jsonify({"error": "Failed to process chat request"}), 500
174174

175175

176176
@app.route("/sign", methods=["POST"])

confidential-ai/inference/verify.py

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,6 @@
1010

1111
import argparse
1212
import hashlib
13-
import json
14-
import sys
1513

1614
import requests
1715

custom-domain/dstack-ingress/Dockerfile

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1-
FROM nginx@sha256:b6653fca400812e81569f9be762ae315db685bc30b12ddcdc8616c63a227d3ca
1+
FROM haproxy@sha256:49a0a0d6f0b8b7e59c233b06eefab1564f2c8d64f673554d368fd7d2ab4b2c2d
2+
3+
# haproxy image runs as non-root (uid 99) by default; we need root for
4+
# certbot, DNS management, and writing to /etc/haproxy/certs.
5+
USER root
26

37
RUN --mount=type=bind,source=pinned-packages.txt,target=/tmp/pinned-packages.txt,ro \
48
set -e; \
@@ -26,15 +30,17 @@ RUN --mount=type=bind,source=pinned-packages.txt,target=/tmp/pinned-packages.txt
2630
python3.11-venv \
2731
curl \
2832
jq \
29-
coreutils && \
33+
coreutils \
34+
mini-httpd && \
3035
rm -rf /var/lib/apt/lists/* /var/log/* /var/cache/ldconfig/aux-cache
3136

3237
RUN mkdir -p \
3338
/etc/letsencrypt \
3439
/var/www/certbot \
35-
/usr/share/nginx/html \
36-
/etc/nginx/conf.d \
37-
/var/log/nginx
40+
/etc/haproxy/certs \
41+
/var/run/haproxy \
42+
/var/lib/haproxy \
43+
/evidences
3844

3945
# Install scripts with deterministic permissions via bind mount
4046
RUN --mount=type=bind,source=scripts,target=/tmp/scripts,ro \
@@ -58,7 +64,8 @@ RUN --mount=type=bind,source=scripts,target=/tmp/scripts,ro \
5864

5965
ENV PATH="/scripts:$PATH"
6066
ENV PYTHONPATH="/scripts"
67+
ENV PYTHONUNBUFFERED=1
6168
COPY --chmod=666 .GIT_REV /etc/
6269

6370
ENTRYPOINT ["/scripts/entrypoint.sh"]
64-
CMD ["nginx", "-g", "daemon off;"]
71+
CMD ["haproxy", "-W", "-f", "/etc/haproxy/haproxy.cfg"]

0 commit comments

Comments
 (0)