Skip to content
Wharfbase

Host scan

By default Wharfbase looks at Docker only. The host scan also finds databases installed on the server itself: PostgreSQL, MySQL, MariaDB, MongoDB and Redis from apt or systemd, and SQLite files in the usual places.

Turning it on

Section titled “Turning it on”
Terminal window
curl -fsSL https://fleeq.net/wharfbase/get | sh -s -- --host-scan

On an existing install, run the installer again with --host-scan (or --no-host-scan to turn it off again): it keeps your data and settings. By hand, add deploy/docker-compose.host-scan.yml to your compose files, which sets WB_HOST_SCAN=true.

What it can see

Section titled “What it can see”

The override gives the Wharfbase container:

  • the host’s root filesystem, mounted read-only at /host;
  • the host’s process table (pid: host), to find database processes, their command lines and listening ports;
  • one capability to read files only root can read (CAP_DAC_READ_SEARCH), such as data directories and pg_hba.conf. The server process still runs as uid 10001, and it can’t write anywhere on the host.

It then reads:

  • Processes of known databases (postgres, mysqld, mariadbd, mongod, redis-server, …). Processes inside containers are skipped: the Docker scan covers them.
  • Their config files (postgresql.conf, my.cnf, mongod.conf, redis.conf), for the port, the data directory and the listen address.
  • SQLite files under /srv, /opt, /home and /var/lib, 6 levels deep (WB_SQLITE_SCAN_PATHS, WB_SQLITE_SCAN_MAX_DEPTH). Only the first 100 bytes of a candidate file are read, to check its header. Container storage (/var/lib/docker, containerd, kubelet, snap) is never walked.

Host databases are scanned at startup and on full scans; they don’t send events like containers do. A database listening on 127.0.0.1 only shows host config needed, with the line to change: see Networks.

Wharfbase’s own data folder is never offered as a database, even when the scan walks past it.

Live SQLite files: a SQLite file on the host opens live, not as a snapshot. Writes need the connection to allow them, and file permissions that let uid 10001 write the file and its directory.

The full list of what the scan reads is in What Wharfbase reads and sends.

© Fleeqfleeq.netStatusPrivacyTerms[email protected]