📝 docs(portwing): document edge exec protocol, trigger limits, and sockguard pairing - #638
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughUpdated Portwing Edge documentation with an implementer-focused WebSocket exec session protocol, including frame types and per-connection concurrency limits. Added sockguard guidance for exec authorization and raw Docker socket isolation. Clarified that Edge Mode does not proxy Docker update triggers. Added FAQ guidance for unsupported update actions and edge-agent key rotation or revocation. 🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@content/docs/current/configuration/agents/index.mdx`:
- Line 56: The Docker socket warning should explicitly state that the :ro mount
protects only the socket file, not Docker Engine API operations. Update the
Callout near the raw socket example to include this warning, and present the
sockguard-fronted compose stack as the primary production recommendation rather
than a secondary reference.
In `@content/docs/current/guides/security/index.mdx`:
- Around line 96-97: Update the security guide’s exec preset documentation to
instruct operators to replace or merge the mounted sockguard configuration with
portwing-with-exec.yaml, using the actual configuration contract and paths.
State that the default configuration denies exec and that the preset’s rules
must be enabled for remote exec, while preserving the existing distinction that
sockguard enforces exec authorization.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: e1ffcb49-0123-4be9-b239-3737bc81a5ee
📒 Files selected for processing (4)
content/docs/current/api/portwing.mdxcontent/docs/current/configuration/agents/index.mdxcontent/docs/current/faq/index.mdxcontent/docs/current/guides/security/index.mdx
1 participant
Docs-only. Closes the drydock-side gaps from the 2026-07-28 tri-tool docs audit:
Related issues found in the same audit: #635, #636, #637.
✨ Added:
exec_start,exec_ready,exec_output,exec_input,exec_resize, andexec_end(including termination/reason handling) plus the per-edge-connections concurrency cap (MAX_EXEC_SESSIONS=100) and “implementers only” scope.🔧 Changed:
docker/dockercomposeupdate triggers (and that related UI/action behavior may be missing or a no-op in v1.6), with guidance to configure update triggers on standard inbound HTTP agents instead.🔒 Security:
Added security guidance for
portwing-with-exec.yamland emphasized that exec authorization (privilege/root escalation and per-command allowlisting) is enforced by Sockguard’s exec policy, not Drydock.Warned that
:roon the Docker socket bind-mount is not an API boundary.Verify the documented exec protocol details (frame shapes,
exec_endreasons) andMAX_EXEC_SESSIONS=100match the implementation.Confirm exec-preset activation behavior is accurately documented and aligns with the shipped presets/config.
Confirm the Ed25519 key rotation/revocation steps and referenced API workflow are correct.
Ensure Edge update-trigger limitations are consistent across all affected docs and examples.
Re-check Sockguard/tri-tool bundle compose guidance and that the
:ro“not an API boundary” warning is unambiguous.