All issues

Search results

sec(dind): handleImagePull passes no authorizer — docker login + private image pull is anonymous

Status: Open.

#139 In ephpm/ephemerd;

· luthermonson opened on Aug 8, 2026

dind: MirrorImageToCache's gc.ref labels appear to pin nothing (cache namespace gets an Image record but no content bucket)

Status: Open.

#138 In ephpm/ephemerd;

· luthermonson opened on Aug 8, 2026

sec(dind): dind containers get no AppArmor profile, and the privileged carve-out's justification does not hold on Linux

Status: Open.

#130 In ephpm/ephemerd;

· luthermonson opened on Aug 2, 2026

Shared module-proxy cache: cleanup config ignored, cache unbounded, traversal untested

Status: Open.

#129 In ephpm/ephemerd;

· luthermonson opened on Aug 2, 2026

sec(runtime): job containers share the host user namespace (container root = host root)

Status: Open.

#126 In ephpm/ephemerd;

· luthermonson opened on Aug 1, 2026

sec(dind): TOCTOU in bind translation allows escape from the runner rootfs

Status: Open.

#125 In ephpm/ephemerd;

· luthermonson opened on Aug 1, 2026

runner: Linux job containers run with NO cgroup limits - oom-killer takes the runner listener and the logs

Status: Open.

#102 In ephpm/ephemerd;

· luthermonson opened on Jul 9, 2026

Security Advisory: Self-Hosted Runner Risk (Skor: 30/100)

Status: Open.

#92 In ephpm/ephemerd;

· Notime02 opened on Jun 22, 2026