Elliot SluskyandGitHub 5bc8d3a2f6 Harden Docker and systemd deployment configs (#581) ...

Pin all base images and ollama to fixed versions + @sha256 digests (no floating :latest), run Docker images as an unprivileged openjarvis user (uid 10001), replace the curl|bash NodeSource install with a digest-pinned multi-stage copy, install from the committed uv.lock via uv export --frozen --no-dev (hash-verified, --no-deps), and add systemd sandboxing (NoNewPrivileges, ProtectSystem=strict, PrivateTmp, kernel/SUID protections). Closes #228, #563, #564, #565, #566, #567.

2026-06-22 19:12:07 -07:00

..

docker

Harden Docker and systemd deployment configs (#581)

2026-06-22 19:12:07 -07:00

launchd

security(deploy): stop default deployments shipping an open, unauthenticated server (#221)

2026-05-25 23:56:55 +00:00

posthog

[FEAT] Telemetry (#351)

2026-05-17 13:07:05 -07:00

systemd

Harden Docker and systemd deployment configs (#581)

2026-06-22 19:12:07 -07:00

windows

Fix desktop speech dependency setup (#574)

2026-06-20 17:08:24 -07:00