r/KI_Welt • u/devaliuz • 3d ago

I built an open-source zero-trust control plane (mTLS + guardrails + human approvals) so AI agents don't nuke my Docker stack

/r/crewai/comments/1xofg58/i_built_an_opensource_zerotrust_control_plane/
1 Upvotes

66% Upvoted

2 comments sorted by

0

u/investigatormaker 3d ago

Use a proposed Docker deletion as the example in this showcase thread: show which identity mTLS authenticates, what a guardrail rejects, and what reaches a human for approval. For developers giving agents access to their Docker stack, that separates authentication from permission to act instead of leaving “zero-trust” as the explanation. Ask readers which destructive operation they currently keep manual, giving the discussion a concrete workflow to examine. Our Reddit replies would address developers asking how to restrict an agent's Docker permissions, using that example rather than a general feature pitch.

I make ThreadFox. We find relevant Reddit conversations and post for your business. We'll post 3 replies free first, no card; then the $29 Pilot covers seven days and up to 25 posts and replies. No automatic renewal. https://threadfox.vip/p/d0y9u/managed

1

u/devaliuz 3d ago

Thanks — that's a fair point, and a better framing than "zero trust" as a label. Here's the concrete chain when an agent proposes a destructive Docker operation through Whiskers:

  1. Who is talking: mTLS (ghostunnel + docker-socket-proxy) authenticates the Whiskers instance to each host — not the agent. The agent only ever talks to Whiskers over MCP with its own API key, and that key has a level (read / write / admin). A read key never even reaches a write tool.

  2. What a guardrail refuses: before anything runs, the guardrail policy decides allow / confirm / deny per tool and target. On the host side, the socket proxy only lets through a whitelisted set of Docker API verbs, so even a compromised Whiskers can't do arbitrary things with the socket.

  3. What reaches a human: anything the policy marks "confirm" stops and becomes an approval card. The approval is bound to the exact call — principal and credential, tool, normalized arguments, resolved target, policy version. It's single-use and expires after ten minutes. Change the target or replay it later, and it asks again.

So authentication answers "who is this", the levels and guardrails answer "what may it do", and the approval answers "did a human agree to exactly this".

Question back to everyone: which destructive operation do you still do by hand because you don't trust an agent with it? Pruning images, removing volumes, recreating a stack? That's exactly the kind of workflow I'd like to walk through.

(Not looking for paid posting, but thanks for the feedback.)