argus-workload-bridge (0~dev20260918144138+f0c4032-1)

Published 2026-09-18 14:43:40 +00:00 by tech

Set up this registry from the command line:

sudo curl https://git-cloud.weboria.eu/api/packages/Weboria/debian/repository.key -o /etc/apt/keyrings/gitea-Weboria.asc
echo "deb [signed-by=/etc/apt/keyrings/gitea-Weboria.asc] https://git-cloud.weboria.eu/api/packages/Weboria/debian $distribution $component" | sudo tee -a /etc/apt/sources.list.d/gitea.list
sudo apt update

Choose $distribution and $component from the list below.

To install the package, run the following command:

sudo apt install argus-workload-bridge=0~dev20260918144138+f0c4032-1

For more information on the Debian registry, see the documentation.

Distributions	develop, staging
Components	main
Architectures	amd64

ARGUS Security Platform -- isolated Docker socket bridge (optional) The ONLY process on a native ARGUS appliance allowed to touch /var/run/docker.sock, per ADR-0038 Sec.1.8. Runs as its own unprivileged system user (argus-workload), the sole account with docker-group membership, and exposes a hard allowlist of 8 read-only Docker API verbs (list/inspect containers, container stats, daemon info, image list, disk usage, volume list -- nothing that starts, stops, creates, or deletes anything) over a unix socket that argus-api connects to instead. argus-api's own OS user never has docker-group membership, so a bug in the much larger control-plane binary structurally cannot reach the real socket. . Implemented in Rust as of ADR-0058 Phase 1 / ADR-0057 Sec.2 (this repo's first shipped Rust component) -- memory safety as a second, structural layer on top of the process/OS-user isolation above, which is unchanged. The prior Go implementation is kept installed alongside, at /usr/lib/argus-workload-bridge/legacy/argus-workload-bridge-go, as an instant rollback for one release cycle (swap the systemd unit's ExecStart=) -- see argus-workload-bridge.service. . Not installed by default and NOT pulled in by the argus metapackage -- install this explicitly only if this appliance also runs Docker workloads you want ARGUS's proxy-host container picker and Network Map to observe. Without it, container-backed features show the same clean "no runtime detected" state as a native appliance with no Docker installed at all (ADR-0040 M3) -- not an error, a supported state.

systemd | systemd-standalone-sysusers | systemd-sysusers

argus-common

Details

Debian

2026-09-18 14:43:40 +00:00

ARGUS Packaging

Project Site

5.0 MiB

Assets (2)

argus-workload-bridge_0~dev20260918144138+f0c4032-1_amd64.deb 2.5 MiB

Versions (34) View all

0~dev20260918144138+f0c4032-1