mirror of
https://github.com/okxlin/appstore.git
synced 2026-09-24 08:01:04 +00:00
okxlin
635357fd11
Pin the official image digest, preserve the upstream data directory, and document the accepted CVE-2026-42533 High-risk exposure.
50 lines
3.1 KiB
Markdown
50 lines
3.1 KiB
Markdown
# PrivateBin
|
||
|
||
## 产品介绍
|
||
|
||
PrivateBin 是零知识加密的临时文本分享服务。文本内容在浏览器中加密和解密，服务端只保存密文。
|
||
|
||
## 主要功能
|
||
|
||
- 浏览器端加密和解密的临时文本分享
|
||
- 文件系统持久化后端，保留服务器盐和限流状态
|
||
- 只读根文件系统与最小临时写入目录
|
||
|
||
## 访问说明
|
||
|
||
安装后通过 `http://<服务器 IP>:<端口>` 访问，实际端口以 `PANEL_APP_PORT_HTTP` 为准。生产环境应通过可信反向代理提供 HTTPS，并限制管理服务器的网络暴露范围。
|
||
|
||
## 数据持久化
|
||
|
||
`APP_DATA_DIR` 挂载到容器的 `/srv/data`，其中保存文本数据、服务器盐和限流状态。该路径必须位于应用版本目录内（默认 `./data`）；安装与升级脚本会拒绝绝对路径及目录外路径，避免误改宿主机文件权限。脚本会将该目录设置为官方镜像要求的 UID `65534`、GID `82`。升级、迁移或卸载前请备份该目录；卸载不会删除绑定目录中的用户数据。
|
||
|
||
## 安全说明
|
||
|
||
- 容器以只读根文件系统运行，仅允许写入 `/srv/data` 以及 `/tmp`、`/run`、`/var/lib/nginx/tmp` 三个临时目录。
|
||
- 上游镜像内部通过 s6 协调 Nginx 与 PHP-FPM；它仍是单个 Compose 服务，但不适合纳入自动升级或自动合并策略。
|
||
- 2026-07-27 的 Trivy 扫描在固定镜像中发现 `0` 个 Critical 和 `1` 个 High：`CVE-2026-42533`（Nginx 对特制 HTTP 请求的代码执行风险）。仅向可信用户开放，保持反向代理与镜像更新；上游修复镜像经验证后应尽快升级。
|
||
|
||
## Introduction
|
||
|
||
PrivateBin is a zero-knowledge encrypted paste service. Data is encrypted and decrypted in the browser, so the server stores ciphertext only.
|
||
|
||
## Features
|
||
|
||
- Browser-side encryption and decryption for shared pastes
|
||
- Filesystem persistence for the server salt and rate-limit state
|
||
- Read-only root filesystem with minimal temporary writable paths
|
||
|
||
## Usage Notes
|
||
|
||
- Access the service at `http://<server-ip>:<port>` after installation. Put a trusted TLS reverse proxy in front of it for production exposure.
|
||
- `APP_DATA_DIR` persists the filesystem backend, server salt, and rate-limit state. It must remain relative to the application version directory (default `./data`); absolute and outside paths are rejected to protect host file ownership. Back it up before upgrades or migrations.
|
||
- The container uses a read-only root filesystem with the upstream-required writable data and temporary paths only.
|
||
- The 2026-07-27 Trivy scan found 0 Critical and 1 High in the pinned image: `CVE-2026-42533` (Nginx code-execution risk for crafted HTTP requests). Expose it only to trusted users, retain a reverse proxy, and update promptly when an upstream-fixed image is verified.
|
||
|
||
## References
|
||
|
||
- Project: <https://github.com/PrivateBin/PrivateBin>
|
||
- Image deployment: <https://github.com/PrivateBin/docker-nginx-fpm-alpine#running-the-image>
|
||
- Website: <https://privatebin.info/>
|
||
- Logo: <https://github.com/PrivateBin/PrivateBin/blob/master/img/logo.svg> (official project asset; Zlib/libpng license)
|