daemon-ipc

Overview ¶

daemon-ipc is a minimal privilege-isolated binary for communicating with the Maestro daemon from inside containers. It is the ONLY process allowed to reach host.docker.internal (enforced via iptables uid-owner matching).

Security properties:

• Hardcoded to connect only to "host.docker.internal" (no arbitrary hosts)
• Port read from daemon-ipc.json (not user-controlled)
• Token read from daemon-ipc.json (not passed as argument)
• Runs as dedicated "maestro-ipc" user via sudo