Harden security posture with Keychain secrets, image vuln scanning, runtime security visibility, and action audit trail by Copilot · Pull Request #14 · djpfs/Macker

Copilot · 2026-08-14T02:51:12Z

This change addresses four security gaps in the runtime/CLI surface: secret handling, image vulnerability visibility, container privilege/capability visibility, and operation auditing. It adds first-class security primitives without changing the core orchestration model.

Keychain-backed secret management
- Added KeychainSecretStore for secret CRUD.
- Added docker secret ls|create|inspect|rm in the shim.
- Added keychain://<name> env reference resolution in both docker run and compose service config assembly.
Image vulnerability scanning
- Added VulnerabilityScanner (Trivy JSON parser) and ImageService.scan(...).
- Added docker scan <image> with severity filtering and optional JSON output.
Runtime security metadata surfaced end-to-end
- Extended ContainerConfiguration with privileged and securityOptions.
- Wired --privileged, --cap-add, --cap-drop, --security-opt, --read-only, --shm-size, --stop-signal from CLI into runtime config.
- Added compose security_opt support and propagated privilege/security fields into container config.
- Exposed privilege/capability/security option details in ContainerDetailView (Security section).
Action audit trail
- Added persistent AuditLogger writing JSONL to ~/.macker/audit.jsonl.
- Audited key container/network/volume/image operations and secret commands.
- Consolidated to a shared logger instance; avoided duplicate high-level/low-level event emission.
Documentation updates
- Updated command docs to include docker scan and docker secret commands.
- Updated security docs/README with Keychain secret references, scanning, and audit-log behavior.

# store a secret and inject at runtime
docker secret create db_password -
docker run -e DB_PASSWORD=keychain://db_password myapp:latest

# scan image vulnerabilities
docker scan --severity CRITICAL,HIGH myapp:latest

Fixes Reforçar segurança do aplicativo #8

djpfs

finish this pr

…sibility Co-authored-by: djpfs <43576725+djpfs@users.noreply.github.com>

Co-authored-by: djpfs <43576725+djpfs@users.noreply.github.com>

Copilot

Pull request overview

This PR adds end-to-end security features across the CLI shim, compose orchestrator, runtime backend, and UI: Keychain-backed secrets, Trivy-based image scanning, surfaced container privilege/security metadata, and persistent JSONL audit logging.

Changes:

Introduces Keychain-backed secret CRUD (docker secret ...) and keychain://NAME environment resolution for docker run and compose.
Adds image vulnerability scanning (docker scan) backed by a Trivy JSON parser and an ImageService.scan(...) API.
Adds runtime security/audit visibility via new container security fields and a persistent AuditLogger recording key operations.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
Tests/DockerShimTests/DockerShimTests.swift	Adds parser tests for `docker secret create` and `docker scan --severity`.
Tests/ContainerBackendTests/ContainerBackendTests.swift	Adds tests for keychain env resolution, missing-secret error, Trivy JSON parsing, and config defaults.
Tests/ComposeEngineTests/ComposeEngineTests.swift	Adds compose parsing coverage for privileged/capabilities/security options.
Sources/ContainerBackend/VulnerabilityScanner.swift	Implements Trivy-backed scan execution and JSON parsing into structured findings.
Sources/ContainerBackend/Models/ContainerConfiguration.swift	Extends container config model with `privileged` and `securityOptions` with decoding defaults.
Sources/ContainerBackend/KeychainSecretStore.swift	Adds Keychain-backed secret CRUD plus fallback storage and env reference resolver.
Sources/ContainerBackend/ImageService.swift	Wires vulnerability scanning and adds audit events to image operations.
Sources/ContainerBackend/ContainerService.swift	Adds shared audit logging to container/network/volume operations and exposes secret store.
Sources/ContainerBackend/AuditLogger.swift	Adds persistent JSONL audit logger actor (`~/.macker/audit.jsonl`).
Sources/ComposeEngine/Models/ComposeModels.swift	Adds compose `security_opt` model support.
Sources/ComposeEngine/ComposeOrchestrator.swift	Resolves `keychain://` envs and propagates privileged/security options into runtime config.
Sources/AppleDockerCLI/DockerShim/DockerTranslator.swift	Adds `docker scan` and `docker secret` execution paths and wires security flags into run config.
Sources/AppleDockerCLI/DockerShim/DockerCommand.swift	Registers `scan`/`secret` flags and help routing in the parser.
Sources/AppleDockerApp/Views/ContainerDetailView.swift	Surfaces privileged/read-only/capabilities/security options in the UI “Security” section.
README.md	Documents Keychain-backed secret usage.
docs/SECURITY.md	Documents secret handling, scanning, and audit log location/behavior.
docs/COMMANDS.md	Adds `scan` and `secret` commands to the command reference table.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+    private var fallbackURL: URL {
+        FileManager.default.homeDirectoryForCurrentUser
+            .appendingPathComponent(".macker", isDirectory: true)
+            .appendingPathComponent("secrets-\(serviceName).json")
+    }


        let containers = try await listContainers(filters: .all)
        if let builder = containers.first(where: { $0.id == "buildkit" }) {
            try await deleteContainer(id: builder.id, force: true)
+            await auditLogger.record(action: "cleanup.deleteBuildkitBuilder", target: "buildkit", succeeded: true)
        }


+            default:
+                throw DockerShimError.unsupportedCommand("secret \(command.subSubcommand ?? "")")
+            }
+            await auditLogger.record(action: action, target: command.arguments.first, succeeded: true)


+                let names = command.arguments
+                guard !names.isEmpty else { throw DockerShimError.missingArgument("SECRET_NAME") }
+                let existing = Set(try service.secrets.listSecretNames())
+                for name in names where !existing.contains(name) {
+                    throw BackendError.notFound("secret '\(name)'")
+                }
+                let payload = names.map { ["Name": $0] }
+                let data = try JSONSerialization.data(withJSONObject: payload, options: [.prettyPrinted, .sortedKeys])
+                print(String(decoding: data, as: UTF8.self))


                "image pull failed: \(result.stderr.trimmingCharacters(in: .whitespacesAndNewlines))"
            )
        }
+        await auditLogger.record(action: "image.pull", target: reference, succeeded: true)


Initial plan

fa758b2

Copilot AI assigned Copilot and djpfs Aug 14, 2026

Copilot AI linked an issue Aug 14, 2026 that may be closed by this pull request

Reforçar segurança do aplicativo #8

Closed

Copilot started work on behalf of djpfs August 14, 2026 02:51 View session

djpfs requested changes Aug 14, 2026

View reviewed changes

Copilot AI and others added 2 commits August 14, 2026 03:01

feat: add security hardening with secrets scan audit and privilege vi…

50d35eb

…sibility Co-authored-by: djpfs <43576725+djpfs@users.noreply.github.com>

fix: address security review follow-ups for audit and secret handling

3240cc8

Co-authored-by: djpfs <43576725+djpfs@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add secrets management and vulnerability scanning~~ Harden security posture with Keychain secrets, image vuln scanning, runtime security visibility, and action audit trail Aug 14, 2026

Copilot finished work on behalf of djpfs August 14, 2026 03:08

Copilot AI requested a review from djpfs August 14, 2026 03:08

Copilot started work on behalf of djpfs August 14, 2026 03:08 View session

Copilot finished work on behalf of djpfs August 14, 2026 03:08

djpfs marked this pull request as ready for review August 14, 2026 03:14

djpfs approved these changes Aug 14, 2026

View reviewed changes

Copilot started work on behalf of djpfs August 14, 2026 03:29 View session

Fix macOS build argument order

5984971

Co-authored-by: djpfs <43576725+djpfs@users.noreply.github.com>

Copilot finished work on behalf of djpfs August 14, 2026 03:33

Copilot AI requested a review from djpfs August 14, 2026 03:33

djpfs approved these changes Aug 14, 2026

View reviewed changes

djpfs requested a lite review from Copilot August 14, 2026 03:41

Copilot started reviewing on behalf of djpfs August 14, 2026 03:42 View session

Copilot AI reviewed Aug 14, 2026

View reviewed changes

djpfs merged commit 49634d4 into main Aug 14, 2026
4 of 6 checks passed

Navigation Menu

Harden security posture with Keychain secrets, image vuln scanning, runtime security visibility, and action audit trail - #14

Harden security posture with Keychain secrets, image vuln scanning, runtime security visibility, and action audit trail#14
djpfs merged 4 commits into
mainfrom
copilot/reforcar-seguranca-do-aplicativo

Copilot AI commented Aug 14, 2026 •

edited

Loading

Uh oh!

djpfs left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

djpfs left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Aug 14, 2026 •

edited

Loading