starred/komodo
1
0
Fork 0
mirror of https://github.com/moghtech/komodo.git synced 2026-09-11 00:01:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix permissions list

Browse Source
This commit is contained in:
mbecker20
2025-05-30 16:49:27 -04:00
parent d22000331e
commit 6d6acdbc0b
1 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docsite/docs/permissioning.md
+10 -10
View File
@@ -28,18 +28,18 @@ There are 4 permission levels a user / group can be given on a Resource:
Permission levels alone are not quite enough to provide granular access control.
Some features are additionally gated behind a specific permission for that feature.
- `Terminal`: User can access the associated resource's terminal.
- If given on a `Server`, this allows server level terminal access.
- If given on a `Stack` or `Deployment`, this allows container exec terminal (even without `Terminal` on `Server`)
- `Attach`: User can "attach" *other resources* to the resource.
- If given on a `Server`, allows users to attach `Stacks` and `Deployments`
- If given on a `Builder`, allows users to attach `Builds`
- `DockerInspect`: User can "inspect" docker resources (like containers) on the `Server`
- Access to this api will expose all container environments on the given server, and can easily lead to secrets being leaked to unintended users if not protected.
- `DockerLogs`: User can retrieve docker / docker compose logs on the associated resource.
- **`Logs`**: User can retrieve docker / docker compose logs on the associated resource.
- Valid on `Server`, `Stack`, `Deployment`
- For admins wanting this permission by default for all users with read permissions, see below on default user groups.
- `ProcessList`: User can retrieve the full running process list on the `Server`
- **`Inspect`**: User can "inspect" docker resources (like containers) on the `Server`
- Access to this api will expose all container environments on the given server, and can easily lead to secrets being leaked to unintended users if not protected.
- **`Terminal`**: User can access the associated resource's terminal.
- If given on a `Server`, this allows server level terminal access.
- If given on a `Stack` or `Deployment`, this allows container exec terminal (even without `Terminal` on `Server`)
- **`Attach`**: User can "attach" *other resources* to the resource.
- If given on a `Server`, allows users to attach `Stacks` and `Deployments`
- If given on a `Builder`, allows users to attach `Builds`
- **`Processes`**: User can retrieve the full running process list on the `Server`
## Permissioning by Resource Type