4.5 KiB
Security and threat model
Assets
- Host control through the Docker socket.
- Player worlds, configuration, mods and backups.
- User accounts, sessions and instance permissions.
- Game API, SMTP and webhook credentials.
- Catalog/template/module integrity.
- Availability of game servers and the management plane.
Actors and assumptions
- Internet users and authenticated non-admin users may be malicious.
- Managers are trusted only for assigned permissions, not host administration.
- Templates, modules, archives, artwork, webhooks and game responses are untrusted.
- The host administrator controls Compose, secret files and bind roots.
- A fully compromised Docker daemon or host is outside DoGaMa's containment guarantee.
Principal threats and controls
| Threat | Required controls |
|---|---|
| Main-app compromise reaches Docker | No socket mount; private authenticated restricted agent; typed operations; registered-instance binding |
| Targeting unrelated containers | No list-all API; database + agent registry + labels + plan digest agreement; opaque IDs |
| Host path escape | Canonical allowlisted roots; symlink-aware validation; no arbitrary template mounts; create-new filesystem operations |
| Malicious archive | Separate staging; traversal/link/device rejection; size/count/depth/time limits; no execution; safe swap |
| Malicious WASM module | No ambient WASI; fuel/memory/time limits; capability/ABI validation; instance-only host networking; circuit breaker |
| SSRF | Scheme/port allowlists, IP classification, redirect revalidation, DNS pinning/rebinding defense for artwork, webhooks and downloads |
| Secret disclosure | Authenticated encryption; external key; write-only API; redaction; no normal export/audit/log inclusion |
| Broken object authorization | Backend instance-scoped checks; deny overrides; object lookup under principal; endpoint denial tests |
| CSRF/session theft | Secure HttpOnly SameSite cookies, CSRF token, TLS guidance, session rotation/revocation and idle/absolute expiry |
| Password attack | Modern password hashing, rate limits, backoff, generic errors, repeated-failure audit/notification |
| Supply-chain substitution | Immutable version snapshots, checksums, optional signatures/trust labels, digest-pinned images, controlled activation |
| Destructive mistake | Preview, recent authentication, typed-name confirmation, pre-restore/update backups and recoverable workflows |
| Resource exhaustion | Upload/extraction limits, job concurrency, per-instance locks, Docker limits, disk checks, notification/module bounds |
| Replay/race | Signed nonce/timestamp agent calls, idempotency keys, optimistic revisions and durable operation phases |
Authentication baseline
V1 local accounts use a current password-hashing algorithm with calibrated parameters. Bootstrap accepts the first administrator only through a one-time local setup state. Sessions rotate at login/privilege change, can be revoked, and never appear in URLs. Critical actions require recent password confirmation.
The deployment documentation must recommend TLS through a trusted reverse proxy and restrictive permissions on secrets/, data and backup paths.
Template and module trust
Display source as official, verified community, local, locally modified or unverified. Trust is informative but never bypasses validation/sandboxing. Catalog updates cannot overwrite local copies or silently update live instances.
Artwork downloads accept bounded raster formats, verify decoded content, convert locally and reject SVG in V1. Preserve source attribution metadata without loading remote assets on every page.
Security headers and API limits
Use a restrictive Content Security Policy, frame denial, MIME sniffing protection and explicit referrer policy. Bound request bodies, pagination and expensive query rates. CORS is disabled by default for cross-origin browser clients. Error responses expose stable codes and safe messages, not stack traces.
Backup security
Game backups are not assumed encrypted in V1; filesystem permissions and host backup policy protect them. They contain no DoGaMa secrets. Restore never follows archive links or writes outside declared destinations. Database/system disaster recovery is documented separately from player-data backups.
Residual risk
The agent still holds Docker-equivalent host power. Its restriction reduces exposed functionality and mistakes but is not a sandbox for a fully compromised agent. Keep it small, non-public, dependency-light, fuzz path/plan parsers and treat agent changes as high-risk reviews.