Weboria

argus-workload-bridge (0~dev20260826004118+9593c9e-1)

Published 2026-08-26 00:42:18 +00:00 by tech

Installation

sudo curl https://git-cloud.weboria.eu/api/packages/Weboria/debian/repository.key -o /etc/apt/keyrings/gitea-Weboria.asc
echo "deb [signed-by=/etc/apt/keyrings/gitea-Weboria.asc] https://git-cloud.weboria.eu/api/packages/Weboria/debian $distribution $component" | sudo tee -a /etc/apt/sources.list.d/gitea.list
sudo apt update

Choose $distribution and $component from the list below.

sudo apt install argus-workload-bridge=0~dev20260826004118+9593c9e-1

Repository Info

Distributions
develop, staging
Components
main
Architectures
amd64

About this package

ARGUS Security Platform -- isolated Docker socket bridge (optional) The ONLY process on a native ARGUS appliance allowed to touch /var/run/docker.sock, per ADR-0038 Sec.1.8. Runs as its own unprivileged system user (argus-workload), the sole account with docker-group membership, and exposes a hard allowlist of 8 read-only Docker API verbs (list/inspect containers, container stats, daemon info, image list, disk usage, volume list -- nothing that starts, stops, creates, or deletes anything) over a unix socket that argus-api connects to instead. argus-api's own OS user never has docker-group membership, so a bug in the much larger control-plane binary structurally cannot reach the real socket. . Not installed by default and NOT pulled in by the argus metapackage -- install this explicitly only if this appliance also runs Docker workloads you want ARGUS's proxy-host container picker and Network Map to observe. Without it, container-backed features show the same clean "no runtime detected" state as a native appliance with no Docker installed at all (ADR-0040 M3) -- not an error, a supported state.

Dependencies

systemd | systemd-standalone-sysusers | systemd-sysusers
argus-common