Add authentication to computerd endpoints

[aron-cf]

The daemon inside the container served its whole HTTP surface to anything that could reach the port. Any code running in the container could point the session somewhere else.

Now:

• The host generates a secret per workspace, passes it to the container as RPC_CLIENT_SECRET at launch, and sends it as a bearer token on /connect.
• The daemon requires that token on every route and on the websocket upgrade. /health stays open, because the host polls it before it has a session.
• Not providing RPC_CLIENT_SECRET disables the checks, which is how the test harnesses and local runs work.
• The secret is stored in the durable object storage. A durable object can be restarted while its container keeps running. It must maintain the same value that container was launched with.
• A command run by the workspace no longer inherits the daemon's whole environment, so the secret cannot leak into it.
• The environment and the internet flag are recorded at launch. A container already running is reused only if it matches, and replaced otherwise.
• If a container answers an unauthenticated request, the host says so in its logs.

Turning it on is one variable. Without it nothing changes:

# open, as before
computerd

# every route but /health now needs the token
RPC_CLIENT_SECRET=$(openssl rand -hex 16) computerd

curl -i localhost:8080/health                  # 200, always reachable
curl -i localhost:8080/__computerd/info        # 401
curl -i -H "Authorization: Bearer $SECRET" \
  localhost:8080/__computerd/info              # 200

A command started by the workspace now receives PATH, HOME, TMPDIR, TZ, LANG, TERM and the LC_ variables, and nothing else from the container. To pass your own, prefix it with COMPUTER_VAR_; the prefix is removed on the way through:

docker run -e COMPUTER_VAR_NODE_ENV=production ... computerd

const handle = await workspace.runtime.exec("echo $NODE_ENV", { encoding: "utf8" });
const { stdout } = await handle.result();   // "production\n"

Any other environment variable will not be reachable from the exec process.

If you start containers yourself, for example from a warm pool, the launch settings travel together and start() reports what it did:

const { outcome } = await api.start({
  env: { PORT: "8080", MOUNT_POINT: "/workspace" },
  enableInternet: false,
});
// "launched"   — nothing was running
// "adopted"    — one was running with these settings, so it was reused
// "relaunched" — one was running with different settings, so it was replaced

Settings cannot be changed on a live container, so a mismatch replaces it. A container started without going through start() has no record of its settings and is replaced for the same reason, so a pool that has not been updated still leaves the workspace with a container it can trust.

Tests cover a token accepted and refused, a token of the wrong length refused, /health staying open, no checks when the variable is unset, the secret being absent from a command's environment, and each of the three launch outcomes. The daemon also reads the secret once and drops it from its own environment, so a later code path that copies the environment cannot reintroduce the leak.

[changeset-bot]

🦋 Changeset detected

Latest commit: bd8a96d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@cloudflare/computer	Minor
@cloudflare/dofs	Minor
@cloudflare/computer-rpc	Minor
@cloudflare/computerd	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@cloudflare/computer@110

commit: bd8a96d