Worph
39f82e1f96
23 apps (MetaCore, the library/network/client tiers and 13 MetaFeeder*) move out of the general-purpose Worph/AppStore into their own store so the MetaMesh family releases on its own cadence. - asset URLs repointed to cdn.jsdelivr.net/gh/Worph/MetaAppStore@main - store scaffolding added (category/recommend/featured lists, licence, contributing, gitattributes) - psd-source/meta-icons-v2 icon generator follows the apps MetaMCP stays in Worph/AppStore: it is third-party metatool-ai software, not part of MetaMesh.
34 lines
1.5 KiB
Markdown
34 lines
1.5 KiB
Markdown
# MetaFeeder · arXiv — Rationale
|
|
|
|
## What deviation / exception is being requested
|
|
|
|
`metafeederarxiv-feeder` runs `user: 0:0`.
|
|
|
|
## Why it is necessary
|
|
|
|
Carried over unchanged from the listing this app was split out of (MetaFeeder · Papers), so the
|
|
feeder behaves exactly as it did there. The MetaFeeder images write their state and
|
|
redb cache as the container user and some reach MetaCore's root-owned tree; a uid-1000
|
|
process is refused.
|
|
|
|
## Security mitigations in place
|
|
|
|
- Public ingress terminates at the AppShield sidecar (`ghcr.io/yundera/appshield:2.0.9`),
|
|
which gates every path behind the PCS's Authelia SSO over OIDC. The feeder carries no
|
|
Caddy labels and publishes no host port, so it is reachable only from the `pcs` Docker
|
|
network.
|
|
- The container mounts **no user directories** — not `/DATA/Documents`, `/DATA/Downloads`,
|
|
`/DATA/Media` or `/DATA/Gallery`. Its only bind is its own state under
|
|
`/DATA/AppData/metafeederarxiv/`, declared in `x-compose-app.folders` and owned `$PUID:$PGID`.
|
|
- `cpu_shares` set on every service; image tags pinned; no `:latest`.
|
|
|
|
## Alternatives considered and rejected
|
|
|
|
- **Run as `$PUID:$PGID`.** Not validated for this image; switching the runtime user in
|
|
the same change as the split would mix a behaviour change into a packaging change.
|
|
|
|
## Data protection
|
|
|
|
The feeder holds no user media. Its entire state lives under `/DATA/AppData/metafeederarxiv/`, which
|
|
is the unit Maison archives on uninstall and restores from backup.
|