[Flosk6]

The low findings of the 2026-10-08 review on the installer, the image and the data directory. The code's findings come in a separate pull request.

The installer

• No bootstrap token unless SPAWNER_BOOTSTRAP_TOKEN is given: it had every scope, no user and no expiry. Installations that have one keep it.
• A version older than the installed one is refused, since its database only migrates forward, unless --allow-downgrade after restoring a backup.
• A SPAWNER_DATA_DIR other than the installation's is refused. So are relative paths, .., and the directories of the system, for both the data and the installation directories, which --purge deletes.
• An installation whose .env lost SPAWNER_SECRET or POSTGRES_PASSWORD stops the installer, instead of getting new ones that would lock the data out.
• .env and dns.env are written in one move, and read back with the = their values end with (IFS='=' read dropped it).
• An upgrade never goes on without a backup: Postgres is started for it.
• --purge says it deletes the backups too, the DNS credentials typed are not shown, and --tls off warns that it serves plain HTTP on every interface.

The stack and the image

• Traefik runs without capabilities except NET_BIND_SERVICE, with no-new-privileges. Postgres (1g) and Traefik (512m) have memory limits.
• The image's code belongs to root, so Spawner, which runs as node, cannot change it. pnpm stays in the build stage, and Prisma's telemetry is off (CHECKPOINT_DISABLE).
• The data directory is mode 700:
  • rendered compose files (which hold the secret variables), job logs and archived logs are written 0600;
  • route files (no secrets) are written 0644, so Traefik can read them without capabilities, and the entrypoint makes older route files readable.
• Spawner still runs as uid 1000, which most cloud images give their first user (ubuntu). Changing it would break the sources that containers running as uid 1000 write into. security.md says to treat that account as an admin.
• The development stack listens on 127.0.0.1, unless SPAWNER_HTTP_BIND says otherwise.

Git

• GitHub, GitLab and Bitbucket are reached with the host keys they publish, shipped in apps/api/known_hosts and checked against their published fingerprints, even on the first connection; a different key is refused. Other hosts are still trusted on first use.

Upgrading

• To turn off an existing bootstrap token, empty its line in /opt/spawner/.env.
• Going back to an older version needs --allow-downgrade, after restoring its backup.

Tests

• scripts/e2e-engine.sh passes. It reads the data directory through a container, since the directory is now 700, and listens on 0.0.0.0 for its firewall check.
• scripts/e2e-installer.sh (CI only) now also checks the refused downgrade and data directory, the 700 / 600 / 644 modes, Traefik's capabilities, the code's owner, and the HTTP warning.
• I checked by hand that ssh reaches github.com with the shipped key without writing to known_hosts, and refuses a different key.
• shellcheck passes, with two expected notes about redirects under sudo.