From 54bf798765d3d529978dd04e3bfc95d93d6504eb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=91=D1=80=D0=B0=D0=B3=D0=B0=D1=80=D0=BD=D0=B8=D0=BA=20?= =?UTF-8?q?=D0=94=D0=BC=D0=B8=D1=82=D1=80=D0=BE?= Date: Fri, 29 May 2026 06:26:54 +0300 Subject: [PATCH] approval: add docker restart/stop/kill to DANGEROUS_PATTERNS (#33438) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When docker.sock is mounted (common Docker Compose pattern), the agent can restart/stop/kill containers without user approval. hermes gateway restart is already protected, but docker restart, docker stop, docker kill, and their docker compose equivalents were not. This caused repeated self-termination: the agent ran docker restart hermes, killed its own container, Docker restarted it (restart policy), and the agent resumed the same session — creating a restart loop. Added patterns mirror the existing gateway lifecycle protection: - docker compose restart/stop/kill/down - docker restart/stop/kill Co-authored-by: Sarbai --- tools/approval.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tools/approval.py b/tools/approval.py index 6e282c98d59..cc5aedc9e02 100644 --- a/tools/approval.py +++ b/tools/approval.py @@ -367,6 +367,13 @@ DANGEROUS_PATTERNS = [ # terminates all running agents mid-work. (r'\bhermes\s+gateway\s+(stop|restart)\b', "stop/restart hermes gateway (kills running agents)"), (r'\bhermes\s+update\b', "hermes update (restarts gateway, kills running agents)"), + # Docker container lifecycle — any user with docker.sock mounted (a common + # Docker Compose pattern) gives the agent the ability to restart/stop/kill + # containers without approval. These are agent-initiated lifecycle operations + # that should always require user consent, just like `hermes gateway restart` + # already does for the gateway process. + (r'\bdocker\s+compose\s+(restart|stop|kill|down)\b', "docker compose restart/stop/kill/down (container lifecycle)"), + (r'\bdocker\s+(restart|stop|kill)\b', "docker restart/stop/kill (container lifecycle)"), # Gateway protection: never start gateway outside systemd management (r'gateway\s+run\b.*(&\s*$|&\s*;|\bdisown\b|\bsetsid\b)', "start gateway outside systemd (use 'systemctl --user restart hermes-gateway')"), (r'\bnohup\b.*gateway\s+run\b', "start gateway outside systemd (use 'systemctl --user restart hermes-gateway')"),