* Create frigate and go2rtc runtime users in the image
* Add single fix-ownership helper for volume permission migration
* Add init-usermod oneshot for PUID and PGID remapping
* Chown newly created runtime directories to the frigate user
* Run sentinel-guarded ownership sweep during prepare
* Add host-side volume permission migration script
* Guard log directory ownership for user-mode startup
* Fall back to plain s6-log when running without root
* Assert PUID remapping and sweep sentinel in CI smoke test
* Skip the ownership sweep in the devcontainer
* Pin FRIGATE_RUN_AS_ROOT in ownership tests
* Do not record the sweep as complete when a chown failed
* Validate PUID and PGID in the migration script
* Treat a failed ownership scan as an incomplete sweep
* Reject PUID and PGID of 0 during remapping
* Handle symlinks, dry runs, and sentinel write failures in the sweep
* Treat an absent sweep root as an incomplete sweep
* Verify s6-overlay downloads against pinned checksums
* Verify go2rtc download against pinned checksums
The v1.9.14 release publishes no checksums file, just the bare per-platform binaries, so these digests come from a one-time fetch rather than upstream. That pins the artifact against later substitution, which is the realistic threat for a version we stay on for months, but it does not verify the original download. The stage moves from `ADD --link` to a script because `ADD --checksum` can't express an architecture-dependent URL.
* Verify main image downloads against pinned checksums
Covers everything the main image downloads on the default path: tempio, the hailort runtime tarball and wheel, the six ffmpeg builds, the libedgetpu deb, and the thirteen Intel driver debs. The hailort tarball was streamed straight into `tar`, which can't be verified before extraction, so it downloads to `/tmp` first. The three ffmpeg blocks per arch collapse into one `install_ffmpeg` helper since they only differed by URL and install dir, and the Intel debs go through a `fetch_intel_deb` helper for the same reason.
The Intel debs are the ones that mattered most here. They're installed as root with `dpkg` on the default amd64 path and had no verification at all. compute-runtime publishes a `ww<week>.sum` asset with every release and npu-driver published `checksum.sha256` on v1.19.0, so those eight digests came from upstream rather than from us. intel-graphics-compiler and level-zero publish none, so those five and everything else here come from a one-time fetch, which pins the artifact against later substitution but doesn't verify the original download. The comment above the map says which is which and how to refresh them, since npu-driver has stopped publishing sums since v1.19.0 and that provenance won't survive the next bump.
Still unpinned: `get-pip.py`, which is a rolling URL where a digest would just break the build on pypa's next edit, and the per-variant artifacts for Axera, Synaptics, and Jetson. apt repositories are out of scope since apt already verifies signatures.
* Restrict generated TLS key permissions
OpenSSL 3.x already writes the key at 600 on its own, so this pins the guarantee rather than fixing an observed leak: the mode no longer depends on the openssl version or the umask the service happens to start with. Only the generated pair is touched. User-mounted certs take the other branch and are never chmod'd, which matters when they're mounted read-only.
* Add security headers and server_tokens off
Adds `X-Content-Type-Options: nosniff` and `Referrer-Policy: strict-origin-when-cross-origin`, and turns off nginx version disclosure.
No `X-Frame-Options` and no CSP `frame-ancestors`. HA's Webpage card and iframe panels frame Frigate's own address cross-origin, and either header would break them silently with nothing in Frigate's logs to explain it. Ingress is same-origin and would survive `SAMEORIGIN`, but Frigate can't tell the two apart from inside the container. `security_headers.conf` is a plain file in the image rather than a generated one, so anyone who does want framing restrictions can bind-mount it.
`add_header` doesn't inherit into a block that declares its own, so the include goes in per block, all nine of them, including the four nested static-asset locations that serve the JS bundles. Those are the ones nosniff actually matters for.
The run script now reads `get_nginx_settings.py` once into a variable instead of shelling out per template. That script imports the frigate config machinery, which is noticeable on an SBC.
Not fixed here: `listen.conf` is included at server level and carries `Strict-Transport-Security`, so those same nine blocks already drop HSTS under TLS today. Folding it into this file would change existing TLS behavior on nine paths, so it needs its own PR.
* Restrict go2rtc config file permissions
* Log failed login attempts with source address
Failed logins returned a bare 401 and left nothing behind, so credential stuffing was invisible unless you were already watching nginx access logs. Both failure branches now log a warning with the attempted username and the client address.
The address comes from `get_remote_addr()`, the same helper the login rate limiter keys on, so the two agree on who the client is and the trusted-proxy handling is consistent. Logging a raw `x-forwarded-for` instead would let an attacker forge the source address in the very log line meant to catch them.
The response is unchanged and identical either way. Which factor failed is only visible in the log, never to the client, and the password is never logged.
* Recommend least-privilege container options in install docs
The compose generator pushed `privileged: true` into every file it produced, no matter what hardware you picked, and it's the default tab on the install page so it's what most people copy. It now emits `security_opt: no-new-privileges:true` instead, and only adds `privileged: true` for hardware that actually needs it, with the reason inline. MemryX is the only one today, since it needs to reach the max-manager. Rockchip and Synaptics only want privileged during initial setup and their documented end state is device mappings, so neither gets it.
`no-new-privileges` merges into the same `security_opt` block as any device-specific entries, so Rockchip still gets its `apparmor=unconfined` and `systempaths=unconfined` without a duplicate key.
The static example now has `privileged` commented out, and there's a short section on the options worth adding, with a note that `cap_drop: ALL` breaks `telemetry.stats.network_bandwidth` since nethogs needs NET_ADMIN/NET_RAW.
* Add amd64 container smoke test to CI
Boots the built amd64 image against a minimal config and asserts the two security headers, that the Server header no longer carries a version, that no frame-ancestors is present, that nginx accepts its own config, and the two file modes. This is also the harness the rest of the hardening work extends.
The two negative assertions are written as `if grep; then exit 1; fi` rather than `! grep`. Bash exempts a negated command from `set -e`, so the `!` form would have passed even with the version and frame-ancestors both present, which is the opposite of what a regression net is for.
* [Init] Initial commit for Synaptics SL1680 NPU
* add a rough detector which is testing with yolov8 tflite model.
* [Feat] Add dependencies installation in docker build
- Add runtime library and wheels installation in main/Dockerfile
- Add model.synap(default model, transfer from mobilenet_224full80) in docker/synap1680
* [Update] Remove dependencies installation from main Dockerfile
- remove deps installation from Dockerfile
- add dependencies installation and split wheels, deps stage in synap1680 Dockerfile
* Refactor synap detector to more closely match other implementations
* [Update] Add model path configuration check
* [Update] update ModelType to ssd
* [Update] Remove unuse script
- install_deps.sh has already been executing in deps download stage
- Dockerfile.toolchain is for testing to extract runtime libraries from Synaptics toolchain
* [Update] update Synaptics SL1680 setup description
* [Update] remove install_synap1680
- The deps download and installation is existed in synap1680
* [Fix] update document content
* [Update] Update detector from synap1680 to synaptics
This update is in order to make the synaptics SL-series NPU detector more general.
- Fix detector `os` module not import bug
- Update detector type `synap1680` to `synaptics`
- Update document description `SL1680` to `Synaptics` only
- Update docker build content `synap1680` to `synaptics`
* [Fix] Update configuration document
* Update docs/docs/configuration/object_detectors.md
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
* [Update] Update document content and detector default layout
- Update object_detectors document
- Update detector's default layout
- Update default model name
* [Update] Update object detector document content
* [Fix] Fix InputTensorEnum not defined error
- import InputTensorEnum from detector_config
* [Update] Update detector script coding format
* [Update] Update synaptics detector coding format
* [Update] Add synaptics ci workflow
* [Update] update synaptics runtime libs download path
- Fork Synaptics astra sdk repo and put the runtime lib package on it
- Frigate team can update this download path later
---------
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
* Simplify rocm install and update to 6.3.1
* Build out more necessary packages
* Update to 6.3.3
* Set bake version
* Fix typo
* Ensure NHWC is used
* Reset dev changes
* Write to cache
* Fix access
* Reorganize tracked object for imports
* Separate out rockchip build
* Formatting
* Use original ffmpeg build
* Fix build
* Update default search type value
* Implement ROCm detectors
* Cleanup tensor input
* Fixup image creation
* Add support for yolonas in onnx
* Get build working with onnx
* Update docs and simplify config
* Remove unused imports
* Initial support for Hailo-8L
Added file for Hailo-8L detector including dockerfile, h8l.mk, h8l.hcl, hailo8l.py, ci.yml and ssd_mobilenat_v1.hef as the inference network.
Added files to help with the installation of Hailo-8L dependences like generate_wheel_conf.py, requirements-wheel-h8l.txt and modified setup.py to try and work with any hardware.
Updated docs to reflect Initial Hailo-8L support including oject_detectors.md, hardware.md and installation.md.
* Update .github/workflows/ci.yml
typo h8l not arm64
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
* Update docs/docs/configuration/object_detectors.md
Clarity for the end user and correct uses of words
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
* Update docs/docs/frigate/installation.md
typo
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
* update Installation.md to clarify Hailo-8L installation process.
* Update docs/docs/frigate/hardware.md
Co-authored-by: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
* Update hardware.md add Inference time.
* Oops no new line at the end of the file.
* Update docs/docs/frigate/hardware.md typo
Co-authored-by: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
* Update dockerfile to download the ssd_modilenet_v1 model instead of having it in the repo.
* Updated dockerfile so it dose not download the model file.
add function to download it at runtime.
update model path.
* fix formatting according to ruff and removed unnecessary functions.
---------
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
Co-authored-by: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
Setting cache-to=compression=zstd causes the resulting user-pulled image
to have zstd-compressed layers, which are not compatible with docker
prior to 23.0. Ubuntu 20.04 still ships with docker 20.10, which yields
`Error processing tar file` when pulling these images.
Renaming the jetpack cache images is my way of clearing the cache of the
prior zstd layers, and it clarifies the convention I used for the other
cache images in which there is one cache per base image/job, not per
target/step. We don't need to delete the non-jetson cache images because
they haven't been rebuilt since zstd was enabled.
* fixup! Split independent builds into parallel jobs
* Combine caches within steps of same job
* Remove Maintain Cache workflow
Now that we're caching to ghcr instead of gha, we don't have to worry
about gha's cache eviction after 7 days/10 GB.
* Factor out common setup steps
* Re-order
* Split independent builds into parallel jobs
* Cache jetson builds
* Use zstd compression
* Switch from gha cache to registry cache
A CI run (four images cached with mode-max) populates the cache with 295
cache entries totalling 23.44 GB. This exceeds gha's 10GB limit, causing
trashing. Try with a registry instead.
* Enable manual CI runs
* Non-Jetson changes
Required for later commits:
- Allow base image to be overridden (and don't assume its WORKDIR)
- Ensure python3.9
- Map hwaccel decode presets as strings instead of lists
Not required:
- Fix existing documentation
- Simplify hwaccel scale logic
* Prepare for multi-arch tensorrt build
* Add tensorrt images for Jetson boards
* Add Jetson ffmpeg hwaccel
* Update docs
* Add CODEOWNERS
* CI
* Change default model from yolov7-tiny-416 to yolov7-320
In my experience the tiny models perform markedly worse without being
much faster
* fixup! Update docs
