F02 left privileged: true as a warning — two catalog apps need it and nothing can grant it

[pofallon]

What

F02 (#512, merged 20cf425) defined the supported Compose subset and rejects privilege-bearing keys outside an explicit grant — pid, ipc, devices, cap_add, env_file, extends, volumes_from, file-backed secrets, and more.

privileged: true is the one exception. It emits a warning and installs.

Why it was left

Two shipped catalog apps set it, and both set it because Hola denies them the Docker socket:

• gitea's Actions runner (gitea-runner)
• running-man's dind sidecar (running-man-dind)

No manifest can declare a privileged grant today, so there is nothing to gate an exception on. A flat refusal, or a grant-gated one, makes both apps uninstallable. Verified during F02: every one of the 18 catalog apps validates with 0 errors and exactly those 2 PRIVILEGED_SERVICE warnings — the only behavioural change to the real catalog.

Why it still matters

A privileged container is a host escape regardless of every other rule F02 added. It carries all capabilities, all host devices, and can mount — so the containment checks, the namespace refusals and the security_opt allowlist are all bypassable from inside one. no-new-privileges does not undo privileges already granted.

So F02's tracker entry is marked verified, and it is — for everything except the largest item in its own category. That asymmetry should be visible rather than buried in a PR body.

What closing it needs

It is a try-hola/apps change first, then a one-line flip here:

1. Add a privileged value to the manifest's elevated-permission vocabulary (ElevatedPermissionType or equivalent), so an app can declare it with a stated reason the operator sees at install.
2. Declare it in gitea and running-man, each with its reason (both are "needs a container runtime and Hola withholds the socket").
3. Publish those, then change PRIVILEGED_SERVICE in packages/shared/src/compose-validate.ts from a warning to an error gated on the declaration.

Order matters: flipping to an error before the catalog declares it breaks both apps on the next validate.

Worth deciding alongside

Whether privileged should be grant-consented (an install-time row the operator accepts, like apps-data) rather than merely manifest-declared. Given what it grants, consent seems more appropriate than disclosure — and the machinery exists, since #496/#516 now freeze consented privileges per install.

Related

• fix(security): constrain the Compose configuration Docker executes (F02) #512 (F02), the security tracker's F02 entry, and Constitution Principle V ("privileged primitives MUST default to least privilege").
• build: is also unconstrained — build.context can reach ../.. and the image-pinning rules are not applied. No catalog app uses it. Separate hole, noted in fix(security): constrain the Compose configuration Docker executes (F02) #512's review, not filed.