Stefan Agner 84ad6b9446 Reject apps mapping a dynamic ingress port range port (#6989) ...

Dynamic ingress port selection (ingress_port: 0) picks a random port
from the 62000-65500 range and hands it to the app to listen on for
ingress. That port is reached over the internal Docker network only.

If an app also maps a container port from that range to the host, the
dynamically chosen ingress port could coincide with it. The ingress
endpoint would then be reachable directly on the host, bypassing ingress
authentication.

Reject such configs during validation instead: an app using dynamic
ingress port selection must not map a port from the dynamic ingress port
range itself. The range bounds are extracted into INGRESS_DYNAMIC_PORT_MIN
and INGRESS_DYNAMIC_PORT_MAX constants shared between the validator and
the allocator.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-01 11:42:14 +02:00

..

__init__.py

Rename addon/addons to app/apps in filenames and imports (#6837)

2026-05-13 20:55:46 +02:00

test_app.py

Improve port conflict detection and resolution across Core and apps (#6916)

2026-06-23 16:26:56 +02:00

test_build.py

Rename addon/addons to app/apps in filenames and imports (#6837)

2026-05-13 20:55:46 +02:00

test_config.py

Reject apps mapping a dynamic ingress port range port (#6989)

2026-07-01 11:42:14 +02:00

test_manager.py

Derive App state from container state (#6890)

2026-06-01 19:50:06 +02:00

test_options.py

Fix typos repo-wide and add codespell pre-commit hook (#6949)

2026-06-16 14:09:16 +02:00