PodHull
GitHub

Security

Isolation is the default,
not a setting.

PodHull is designed so that one compromised application cannot read another's data, reach its network or touch the host, and so that the panel itself holds as little power as possible.

Applications

Sealed compartments

  • A separate Linux user and subordinate ID range per application
  • Rootless Podman with user namespaces
  • Read-only root filesystem, no new privileges, dropped capabilities
  • Memory and process limits on every service
  • A private network per application; internal services get no internet at all

Host

The operating system stays in charge

  • SELinux remains enforcing; the installer refuses a host without it
  • firewalld and an nftables table guard traffic between users
  • Proxy and panel run as their own unprivileged users
  • Only the agent runs as root, started on demand by its socket
  • Every unit is checked against strict allow-lists before it is written

People

Access you can account for

  • Sign-in with Ed25519 key files; there are no passwords to steal
  • Revoking a key ends its sessions at once
  • Sensitive actions ask for a fresh signature
  • CSRF tokens, strict cookies and a strict Content Security Policy
  • Every change recorded with its author and source address

Sign-in

A key file instead of a password.

During setup your browser creates an Ed25519 key pair and you download the private key. To sign in, the panel sends a challenge and your browser signs it locally. The private key never leaves your machine, and the server only ever stores public keys.

  • One key per person or device, each with its own label
  • Revoke a lost laptop's key without touching anyone else

Accountability

Know what changed, and trust what you install.

Hash-chained audit log

Each entry carries the hash of the one before it, and the panel can verify the whole chain. It shows any edit to the file; keep the latest hash elsewhere to detect a full rewrite too.

Signed releases

Every release ships SHA256SUMS and a signature made with ssh-keygen -Y sign. Verify both before you install.

Verified webhooks

Deliveries are checked against each forge's own signature or token in constant time, and a delivery seen before is refused.

Reporting

Found a vulnerability?

Please report it privately through GitHub's security advisories on the affected repository instead of opening a public issue, so it can be fixed before it is disclosed.

Report privately →