Description
Two related defects found by SKT-0014 while designing the chart exposure model. The first is fixed; the second is recorded and left.
FIXED — .env.example was factually wrong on a security-relevant variable. It described SYNTHKIT_BIND as “Compose-only (the app ignores it)”, then two sentences later described startup failing on it. The app very much reads it: internal/config/config.go:159 loads it into HostBind, and cmd/synthkit/exposure.go:32-39 validates THAT value as the container exposure gate and can refuse to start. An operator reasoning about their exposure posture from that comment would have concluded the variable was inert. Corrected by the wiring pass.
OPEN — inContainer() only detects Docker. cmd/synthkit/main.go:710 keys on the presence of /.dockerenv, which containerd, CRI-O and podman do not create. So under Kubernetes the container branch of the exposure check does not engage on its own.
It is not exploitable as written — it fails closed, and the Helm chart works around it by mirroring SYNTHKIT_BIND to the JSON_HTTP_ADDR host so both branches reach the same verdict rather than depending on detection. But .env.example still advertises “auto-detected via /.dockerenv when unset”, which over-promises on every non-Docker runtime, and a future caller may reasonably trust the detection.
Worth fixing properly rather than leaving the chart to compensate: cgroup inspection, or the KUBERNETES_SERVICE_HOST variable every Kubernetes pod receives, would cover the runtimes that matter. Whatever is chosen, .env.example must describe what it actually detects.
Acceptance Criteria
- #1 Container detection works on the runtimes Kubernetes actually uses, not only Docker
- #2 .env.example describes what is actually detected, with no claim the app ignores a variable it validates
- #3 The Helm chart no longer needs to compensate for detection failing, or the compensation is documented as deliberate belt-and-braces
Definition of Done
- #1 make gate (build vet test race rw-proto-check spdx-check forbidden-words)
- #2 make blueprint-schema (only if a blueprint field or construct/workload config struct changed)
- #3 DRY_RUN=true go run ./cmd/synthkit -once -dump — inventory diffed against signals/
Implementation Plan
2026-09-06 execution: extend container detection to Kubernetes runtimes, document the exact behavior in the root-owned .env.example hunk, and validate whether the Helm compensation remains deliberately belt-and-braces.
Implementation Notes
2026-09-06 implementation: inContainer now recognises Kubernetes through KUBERNETES_SERVICE_HOST in addition to Docker and the explicit hint. .env and .env.example describe the exact contract. The Helm SYNTHKIT_BIND mirror remains documented as deliberate belt-and-braces exposure validation, not compensation for failed detection. Focused container-detection, environment alignment, Helm render, full local, dump, and e2e checks passed.
Final Summary
2026-09-06: Done. Kubernetes container detection now covers containerd and CRI-O Pods, the environment contract is truthful, and the chart documents its independent mirrored-bind safety check.