AppsMonitor - monitoring for your Cloudron

[girish]

@necrevistonnezr said:

Just out of curiosity (and little technical knowledge): Shouldn't a system that isolates apps via docker not be taken down completely by a malformed configuration file of one app?

Yeah, absolutely. This is a good conversation to have

Cloudron was written primarily for pre-packaged apps written by us and not as a sandboxing environment to run arbitrary applications. When packages were written by us, we could "trust" the input in the manifest file, description, post install etc. When we made custom apps possible, the worst case was that a user sabotages himself with a poorly written manifest. But now with community apps, there is a new vector that malicious apps can do unknown things. For example, what if the description has some clickjacking or scam link? So, you can hit problems even without installing or running an app (so we don't hit run time isolation). This is also why we don't want to integrate community listing straight into the main dashboard, this would give too many good feelings of trust.

We are fixing issues (like this) as and when they come, but one should only run 3rd party packages they trust. Cloudron company's primary focus is still to runs the apps from the main app store and not to make a general trusted environment to run random stuff (FWIW, I don't think such a product exists out there).

[timconsidine]

Sounds like “CommunityAppChecker” "AppInspector" utility is needed. Put a CloudronVersions link in input box, utility checks whatever is needed/possible, generate alerts for sus content.
Conceptually best to come from Cloudron team but that drags Cloudron towards approving apps, which is probably a v.bad direction. Maybe I will give some thought to it.

I really understand and support the official stance - it is simply not viable otherwise.

Some other simple defences :

• have registered app packager scheme : no fees, basic metadata, probably already publicly known, enough to know legit packager and no more
• ca.cloudron.io only takes submissions from registered packagers (currently must have a Cloudron account)
• Cloudron will hate (understandably) any form of stars or likes on ca.cloudron.io, but maybe a simple more neutral voluntary “I installed this” counter

[timconsidine]

Could not resist it - AppInspector available :
https://forum.cloudron.io/post/129539

Needs more and deeper tests, and nothing will ever be a guarantee.
But it's a start.

[nichu42]

@timconsidine Fresh install fails with
An error occurred during the install operation: Nginx Error: Error reloading nginx: /usr/bin/sudo exited with code 1 signal null

[timconsidine]

@nichu42 just checking : is that AppsMonitor ? or AppInspector ?
(sequence of messages leaves me unclear)

EDIT : I did a fresh install of AppsMonitor and did not meet any errors.
Is that message from the app's Logs panel ? or where did it show up ?

[nichu42]

@timconsidine It is AppsMonitor and it appears during the installation after it failed.

[timconsidine]

@nichu42 strange : not showing in my live or test instances.
I've done 5 test installs of AppsMonitor today

So probably need to start some basic 'differences' test :
I'm running cloudron 9.2
Are you the same or are you upgraded to 10 ?

Any logs showing what was happening before the crash ?

[nichu42]

@timconsidine I am on 10.0.5
I didn't spot anything useful in the log. But I am on vacation and only have my mini screen Fairphone with me do I might have missed something.

[timconsidine]

@nichu42 no problem, enjoy the holiday, let me know if you get further information afterwards

[timconsidine]

AppsMonitor has been updated to support better disk usage reporting, free space monitoring, velocity detection/flagging and alerting. Probably best explained with screenshots.

Disk usage general :

Disk usage beakdown + growth / velocity checks :

Settings including alerting and disk usage report parameters :

Note : settings shown are for testing. Setting frequency too fast can impact system performance.

This is tested on my Cloudron, and I only have one. But there's such a wide usage of deployments, disk sizes, apps deployed and how are they used, it is impossible for me to test fully. Feedback welcome.

Alerts are email and Telegram. I can look at adding a webhook sender, so it can be received in other systems. I don't want to create excessive number of channels (more maintenance and breaking).

[timconsidine]

Sample Telegram message :

AppsMonitor [HIGH]

/ is filling up
Free space down 1.0% in 4 min
Usage: 63.0%
Projected to fill in ~3h

[robi]

Brilliant!

Looks mighty useful.

Well done.