Inspector

Cloudron community app transparency reports

Inspect a Cloudron community app `CloudronVersions.json` feed. Repository analysis is derived from the package metadata in that feed, and the report stays intentionally conservative: it surfaces what the package appears to do, but it does not certify safety.

What this checks

CHECKS EXPLAINED

Checks Explained

Metadata links and missing fields

Reads the Cloudron feed metadata, checks whether important links are valid, and notes when required fields are missing.

Dockerfile command patterns

Scans Docker build steps for risky commands such as destructive deletes, world-writable permissions, or remote scripts piped into a shell.

Runtime shell network calls

Looks through startup shell scripts for commands like curl, wget, nc, or ssh that may contact remote systems during runtime.

Privilege escalation and credential leakage

Flags startup-script patterns that touch privileged system paths, invoke sudo, or combine secrets with outbound commands.

Feed vs repo version drift

Compares the version published in CloudronVersions.json with the version found in the package repository when that repository can be identified reliably.

Metadata links and missing fields
Dockerfile command patterns
Runtime shell network calls
Privilege escalation and credential leakage
Feed vs repo version drift

Example inputs

https://communityapps.appx.uk/cloudron-notediscovery/CloudronVersions.json

https://raw.githubusercontent.com/BrutalBirdie/cloudron-tachyon-app/refs/heads/master/CloudronVersions.json

https://communityapps.appx.uk/cloudron-ocular/CloudronVersions.json

Generated Report

Laminar

Open-source observability for LLM apps and AI agents

Score

53/100

53 reached47 still requires deeper inspection

Automated checks can score at most 70/100. The remaining 30 points require deep inspection.

This tool is for informational purposes only. Use at your own risk.

Safety Flags

Fail

Unsure

Pass

Master Info

Install feed

https://raw.githubusercontent.com/OrcVole/laminar-cloudron/main/CloudronVersions.json

packageUrl

Not available

Website link

https://www.lmnr.ai

Repository

Not available

Packager

OrcVole

packagerUrl

https://github.com/OrcVole/laminar-cloudron

minBox

9.1.0

Version

0.2.0

Tags

observabilitytracingaianalytics

Detailed Checklist

packageUrl link is present and well formed when required (7/7)

pass

No `packageUrl` declared. This is valid for packages targeting minBoxVersion below 10.

Website link is present and well formed (7/7)

pass

https://www.lmnr.ai

Metadata and README links avoid insecure HTTP (7/7)

pass

No HTTP links found.

Metadata and README links avoid URL shorteners (7/7)

pass

No shortener links found.

Cloudron feed version matches the repository manifest (7/7)

pass

Feed and repo both report 0.2.0.

Repository content was fetched for static analysis (7/7)

pass

https://github.com/OrcVole/laminar-cloudron @ e1a49105946c37b524a39123a54f7266c0b444cb

Dockerfile scan did not detect clearly suspicious commands (0/7)

fail

Dockerfile:35 System package installation found. Review whether all packages are justified. Dockerfile:41 Remote script piped directly into a shell in Dockerfile. Dockerfile:65 System package installation found. Review whether all packages are justified.

Runtime shell scripts avoid suspicious outbound network calls (4/7)

unsure

test/secret-scan.sh:227 Network-capable command found in a runtime shell script. test/secret-scan.sh:228 Network-capable command found in a runtime shell script. test/secret-scan.sh:229 Network-capable command found in a runtime shell script. test/secret-scan.sh:232 Network-capable command found in a runtime shell script. test/secret-scan.sh:243 Network-capable command found in a runtime shell script. test/secret-scan.sh:248 Network-capable command found in a runtime shell script. test/smoke.sh:40 Network-capable command found in a runtime shell script. test/smoke.sh:68 Network-capable command found in a runtime shell script. test/smoke.sh:72 Network-capable command found in a runtime shell script. conf/restore-clickhouse.sh:58 Network-capable command found in a runtime shell script. conf/run-app-server.sh:21 Network-capable command found in a runtime shell script. conf/run-app-server.sh:30 Network-capable command found in a runtime shell script. conf/run-frontend.sh:23 Network-capable command found in a runtime shell script.

Runtime shell scripts avoid privilege escalation patterns (0/7)

fail

start.sh:20 Privileged command or direct system-path modification detected in startup script. start.sh:21 Privileged command or direct system-path modification detected in startup script. start.sh:135 Privileged command or direct system-path modification detected in startup script. test/secret-scan.sh:156 Privileged command or direct system-path modification detected in startup script. test/secret-scan.sh:227 Privileged command or direct system-path modification detected in startup script. test/secret-scan.sh:228 Privileged command or direct system-path modification detected in startup script. test/secret-scan.sh:229 Privileged command or direct system-path modification detected in startup script. test/secret-scan.sh:232 Privileged command or direct system-path modification detected in startup script. test/secret-scan.sh:257 Privileged command or direct system-path modification detected in startup script. test/smoke.sh:47 Privileged command or direct system-path modification detected in startup script. conf/backup-clickhouse.sh:17 Privileged command or direct system-path modification detected in startup script. conf/backup-clickhouse.sh:18 Privileged command or direct system-path modification detected in startup script. conf/backup-clickhouse.sh:22 Privileged command or direct system-path modification detected in startup script. conf/restore-clickhouse.sh:13 Privileged command or direct system-path modification detected in startup script. conf/restore-clickhouse.sh:14 Privileged command or direct system-path modification detected in startup script. conf/restore-clickhouse.sh:51 Privileged command or direct system-path modification detected in startup script.

Runtime shell scripts avoid credential leakage patterns (7/7)

pass

No credential leakage patterns found in scanned shell scripts.

Raw Findings

Flagged lines are highlighted directly in the code snippet.

32 findings

Dockerfile:35

low

System package installation found. Review whether all packages are justified.

33ARG RUST_VERSION
34ENV DEBIAN_FRONTEND=noninteractive
35RUN apt-get update && apt-get install -y --no-install-recommends \
36      build-essential pkg-config libssl-dev protobuf-compiler libfontconfig1-dev libclang-dev \
37      git curl ca-certificates \

Dockerfile:41

high

Remote script piped directly into a shell in Dockerfile.

39# Rust via rustup (the base ships no Rust). Pin the toolchain to the upstream version.
40ENV RUSTUP_HOME=/opt/rust/rustup CARGO_HOME=/opt/rust/cargo PATH=/opt/rust/cargo/bin:$PATH
41RUN curl -fsSL https://sh.rustup.rs | sh -s -- -y --no-modify-path --default-toolchain ${RUST_VERSION} --profile minimal
42# Pinned source at the release tag.
43RUN git clone --depth 1 --branch v${LAMINAR_VERSION} https://github.com/lmnr-ai/lmnr.git /src

Dockerfile:65

low

System package installation found. Review whether all packages are justified.

63# Runtime libs for the bundled glibc binaries (app-server: reqwest native-tls -> libssl3; fontconfig for
64# the name/avatar generator. quickwit/clickhouse link libssl3 too). base already ships curl + ca-certificates.
65RUN apt-get update && apt-get install -y --no-install-recommends \
66      libssl3 libfontconfig1 \
67    && rm -rf /var/lib/apt/lists/*

start.sh:20

high

Privileged command or direct system-path modification detected in startup script.

18# /app/data/{quickwit,clickhouse}-backup, which ride the backup near-atomically (Quickwit captured before CH
19# so its residual lag is the benign direction: search <= ch_spans).
20CH_STORE=/var/lib/clickhouse
21QW_STORE=/var/lib/quickwit
22mkdir -p \

start.sh:21

high

Privileged command or direct system-path modification detected in startup script.

19# so its residual lag is the benign direction: search <= ch_spans).
20CH_STORE=/var/lib/clickhouse
21QW_STORE=/var/lib/quickwit
22mkdir -p \
23  "${CH_STORE}/logs" "${CH_STORE}/tmp" "${CH_STORE}/access" \

start.sh:135

high

Privileged command or direct system-path modification detected in startup script.

133#    readiness so the frontend's on-boot PG + ClickHouse migrations run against ready stores).
134# ------------------------------------------------------------------------------------------------
135exec supervisord -c /etc/supervisor/supervisord.conf
136

test/secret-scan.sh:156

high

Privileged command or direct system-path modification detected in startup script.

154  # it does not ship is simply absent. Only then are the container-side hits for these exact paths
155  # dropped, and only for these exact paths, in the same spirit as the pinned SSH keys below.
156  RUNTIME_PATHS=(/etc/hosts /etc/resolv.conf /etc/hostname)
157  RUNFLAGS=(--network=none)                       # no DNS/hosts wiring either engine can avoid
158  [[ "$CRI" == *podman* ]] && RUNFLAGS+=(--no-hosts)   # podman only; docker always injects

test/secret-scan.sh:227

high

Privileged command or direct system-path modification detected in startup script.

225  # hashes whenever the base image digest changes.
226  declare -A PINNED_SSH=(
227    [/etc/ssh/ssh_host_ecdsa_key]=677458f83d985da3fd7cdd208e90e4eac09da5be205425a5f96a6242dc985c33
228    [/etc/ssh/ssh_host_ed25519_key]=0c575ce8d9ba487b05cc473fad4b0650fb950181028e6ac19796f86f56f22a7a
229    [/etc/ssh/ssh_host_rsa_key]=ae0ea8087e90baf138d277ca52b6cf47b5010adc0e5bd84236713eee1b85de85

test/secret-scan.sh:227

medium

Network-capable command found in a runtime shell script.

225  # hashes whenever the base image digest changes.
226  declare -A PINNED_SSH=(
227    [/etc/ssh/ssh_host_ecdsa_key]=677458f83d985da3fd7cdd208e90e4eac09da5be205425a5f96a6242dc985c33
228    [/etc/ssh/ssh_host_ed25519_key]=0c575ce8d9ba487b05cc473fad4b0650fb950181028e6ac19796f86f56f22a7a
229    [/etc/ssh/ssh_host_rsa_key]=ae0ea8087e90baf138d277ca52b6cf47b5010adc0e5bd84236713eee1b85de85

test/secret-scan.sh:228

high

Privileged command or direct system-path modification detected in startup script.

226  declare -A PINNED_SSH=(
227    [/etc/ssh/ssh_host_ecdsa_key]=677458f83d985da3fd7cdd208e90e4eac09da5be205425a5f96a6242dc985c33
228    [/etc/ssh/ssh_host_ed25519_key]=0c575ce8d9ba487b05cc473fad4b0650fb950181028e6ac19796f86f56f22a7a
229    [/etc/ssh/ssh_host_rsa_key]=ae0ea8087e90baf138d277ca52b6cf47b5010adc0e5bd84236713eee1b85de85
230  )

test/secret-scan.sh:228

medium

Network-capable command found in a runtime shell script.

226  declare -A PINNED_SSH=(
227    [/etc/ssh/ssh_host_ecdsa_key]=677458f83d985da3fd7cdd208e90e4eac09da5be205425a5f96a6242dc985c33
228    [/etc/ssh/ssh_host_ed25519_key]=0c575ce8d9ba487b05cc473fad4b0650fb950181028e6ac19796f86f56f22a7a
229    [/etc/ssh/ssh_host_rsa_key]=ae0ea8087e90baf138d277ca52b6cf47b5010adc0e5bd84236713eee1b85de85
230  )

test/secret-scan.sh:229

high

Privileged command or direct system-path modification detected in startup script.

227    [/etc/ssh/ssh_host_ecdsa_key]=677458f83d985da3fd7cdd208e90e4eac09da5be205425a5f96a6242dc985c33
228    [/etc/ssh/ssh_host_ed25519_key]=0c575ce8d9ba487b05cc473fad4b0650fb950181028e6ac19796f86f56f22a7a
229    [/etc/ssh/ssh_host_rsa_key]=ae0ea8087e90baf138d277ca52b6cf47b5010adc0e5bd84236713eee1b85de85
230  )
231  ssh_listing="$("$CRI" run --rm --user 0 "${RUNFLAGS[@]}" --entrypoint /bin/bash "$IMAGE" \

test/secret-scan.sh:229

medium

Network-capable command found in a runtime shell script.

227    [/etc/ssh/ssh_host_ecdsa_key]=677458f83d985da3fd7cdd208e90e4eac09da5be205425a5f96a6242dc985c33
228    [/etc/ssh/ssh_host_ed25519_key]=0c575ce8d9ba487b05cc473fad4b0650fb950181028e6ac19796f86f56f22a7a
229    [/etc/ssh/ssh_host_rsa_key]=ae0ea8087e90baf138d277ca52b6cf47b5010adc0e5bd84236713eee1b85de85
230  )
231  ssh_listing="$("$CRI" run --rm --user 0 "${RUNFLAGS[@]}" --entrypoint /bin/bash "$IMAGE" \

test/secret-scan.sh:232

high

Privileged command or direct system-path modification detected in startup script.

230  )
231  ssh_listing="$("$CRI" run --rm --user 0 "${RUNFLAGS[@]}" --entrypoint /bin/bash "$IMAGE" \
232                  -c 'for f in /etc/ssh/ssh_host_*_key; do [ -e "$f" ] && sha256sum "$f"; done' 2>/dev/null)"
233  found=0; pinned_ok=0
234  while IFS= read -r line; do

test/secret-scan.sh:232

medium

Network-capable command found in a runtime shell script.

230  )
231  ssh_listing="$("$CRI" run --rm --user 0 "${RUNFLAGS[@]}" --entrypoint /bin/bash "$IMAGE" \
232                  -c 'for f in /etc/ssh/ssh_host_*_key; do [ -e "$f" ] && sha256sum "$f"; done' 2>/dev/null)"
233  found=0; pinned_ok=0
234  while IFS= read -r line; do

test/secret-scan.sh:243

medium

Network-capable command found in a runtime shell script.

241      shp="$(printf '%s\n' "$shp" | grep -vF "$f:" || true)"   # drop ONLY this verified exact path
242    else
243      emit ssh-key "$f sha256=$h is NOT a pinned base host key (new, changed or extra: treat as a leak)"
244    fi
245  done <<< "$ssh_listing"

test/secret-scan.sh:248

medium

Network-capable command found in a runtime shell script.

246  echo "  host keys: $found found, $pinned_ok pinned-ok, ${#PINNED_SSH[@]} expected"
247  [[ "$found" -eq "${#PINNED_SSH[@]}" && "$pinned_ok" -eq "${#PINNED_SSH[@]}" ]] \
248    || emit ssh-key "host key count mismatch: $found found, $pinned_ok pinned-ok, ${#PINNED_SSH[@]} expected"
249 
250  # DISTRO-GENERATED PLACEHOLDER KEYS. Some Debian packages mint a self-signed key in their

test/secret-scan.sh:257

high

Privileged command or direct system-path modification detected in startup script.

255  # Nothing else is exempt: a key at any other path is still a finding, including a second key in
256  # the same directory. Add a path here only after confirming the package does not reference it.
257  PLACEHOLDER_KEYS=(/etc/ssl/private/ssl-cert-snakeoil.key /etc/prosody/certs/localhost.key)
258  for k in "${PLACEHOLDER_KEYS[@]}"; do
259    if printf '%s' "$shp" | grep -qF "$k:"; then

test/smoke.sh:40

medium

Network-capable command found in a runtime shell script.

38hc=0
39for i in $(seq 1 120); do
40  code=$(curl -s -m 5 -o /dev/null -w '%{http_code}' http://localhost:15667/sign-in 2>/dev/null || echo 000)
41  [ "$code" = "200" ] && { hc=1; ok "/sign-in 200 (health)"; break; }
42  sleep 3

test/smoke.sh:47

high

Privileged command or direct system-path modification detected in startup script.

45 
46# 2. all four services RUNNING
47st=$($ENGINE exec $APP supervisorctl -c /etc/supervisor/supervisord.conf status 2>/dev/null)
48for svc in clickhouse quickwit app-server frontend; do
49  echo "$st" | grep -qE "^${svc}[[:space:]]+RUNNING" && ok "service ${svc} RUNNING" || bad "service ${svc} not RUNNING"

test/smoke.sh:68

medium

Network-capable command found in a runtime shell script.

66 
67# 5. ClickHouse runs in UTC (Laminar's spans views assume it)
68tz=$($ENGINE exec $APP sh -c '. /app/data/.secrets/secrets.env; curl -s "http://localhost:8123/?user=laminar&password=${CLICKHOUSE_PASSWORD}" --data-binary "SELECT timezone()"' 2>/dev/null)
69[ "$tz" = "UTC" ] && ok "ClickHouse timezone is UTC" || bad "ClickHouse timezone='$tz' (want UTC)"
70

test/smoke.sh:72

medium

Network-capable command found in a runtime shell script.

70 
71# 6. app-server OTLP/REST port is up (a POST without an API key is rejected, not connection-refused)
72code=$($ENGINE exec $APP sh -c 'curl -s -m 5 -o /dev/null -w "%{http_code}" -X POST http://localhost:8000/v1/traces' 2>/dev/null || echo 000)
73{ [ -n "$code" ] && [ "$code" != "000" ]; } && ok "app-server :8000 answers OTLP path (HTTP $code)" || bad "app-server :8000 unreachable"
74

conf/backup-clickhouse.sh:17

high

Privileged command or direct system-path modification detected in startup script.

15# via .new -> rename.
16set -euo pipefail
17CH_STORE=/var/lib/clickhouse
18QW_STORE=/var/lib/quickwit
19DUMP=/app/data/clickhouse-backup

conf/backup-clickhouse.sh:18

high

Privileged command or direct system-path modification detected in startup script.

16set -euo pipefail
17CH_STORE=/var/lib/clickhouse
18QW_STORE=/var/lib/quickwit
19DUMP=/app/data/clickhouse-backup
20QDUMP=/app/data/quickwit-backup

conf/backup-clickhouse.sh:22

high

Privileged command or direct system-path modification detected in startup script.

20QDUMP=/app/data/quickwit-backup
21SNAP=/app/data/.clickhouse-snapshot      # transient: built + removed within this command (never archived)
22CONF=/etc/clickhouse-server/backups.xml
23TIMING=/app/data/backup-timing.log
24log() { echo "==> [backup] $*"; }

conf/restore-clickhouse.sh:13

high

Privileged command or direct system-path modification detected in startup script.

11# defs). Quickwit needs no server — it boots from the file copy directly.
12set -euo pipefail
13CH_STORE=/var/lib/clickhouse
14QW_STORE=/var/lib/quickwit
15DUMP=/app/data/clickhouse-backup

conf/restore-clickhouse.sh:14

high

Privileged command or direct system-path modification detected in startup script.

12set -euo pipefail
13CH_STORE=/var/lib/clickhouse
14QW_STORE=/var/lib/quickwit
15DUMP=/app/data/clickhouse-backup
16QDUMP=/app/data/quickwit-backup

conf/restore-clickhouse.sh:51

high

Privileged command or direct system-path modification detected in startup script.

49# authenticate the laminar user. `su` (no dash) preserves this exported env into the child process.
50set -a; . "${SECRETS}"; set +a
51su -s /bin/bash cloudron -c "exec clickhouse-server --config-file=/etc/clickhouse-server/config.xml" \
52  > /tmp/restore-ch.log 2>&1 &
53SVPID=$!

conf/restore-clickhouse.sh:58

medium

Network-capable command found in a runtime shell script.

56 
57i=0
58until curl -sf http://localhost:8123/ping >/dev/null 2>&1; do
59  i=$((i + 1)); [ "$i" -ge 90 ] && { log "FATAL: transient CH not ready after 90s"; tail -20 /tmp/restore-ch.log; exit 1; }
60  sleep 1

conf/run-app-server.sh:21

medium

Network-capable command found in a runtime shell script.

19export PORT=8000 GRPC_PORT=8001 CONSUMER_PORT=8002
20 
21wait_for "clickhouse" curl -sf "http://localhost:8123/ping"
22wait_for "postgres"   pg_isready -h "${DATABASE_HOST}" -p "${DATABASE_PORT}"
23

conf/run-app-server.sh:30

medium

Network-capable command found in a runtime shell script.

28# rather than block forever, so a genuinely broken Quickwit can't wedge the whole app.
29qw=0
30until curl -sf "http://localhost:7280/health/readyz" >/dev/null 2>&1; do
31  qw=$((qw + 1))
32  [ "$qw" -ge 60 ] && { log "WARN: Quickwit not ready after 60s — starting WITHOUT span indexing (search degraded)"; break; }

conf/run-frontend.sh:23

medium

Network-capable command found in a runtime shell script.

21export PORT="5667"
22 
23wait_for "clickhouse" curl -sf "http://localhost:8123/ping"
24wait_for "postgres"   pg_isready -h "${DATABASE_HOST}" -p "${DATABASE_PORT}"
25