Exposing the hub publicly
Agents on NAT’d boxes dial out to the hub, so a public hub with agents behind home or office NAT is a first-class deployment shape, not a workaround. Here’s what keeps the exposed surface safe.
What protects a public hub
Section titled “What protects a public hub”The single admin password is the whole security boundary, so sign-in and sign-up are rate-limited to slow credential-stuffing, and security headers go out ahead of every route.
HTTPS is fail-closed. In production the hub refuses to boot unless RUNAWAY_HUB_URL is an https://
URL — a missing or plain-HTTP value would leave the session cookie and CSRF posture silently
insecure, so it’s a hard failure instead. See TLS and reverse
proxies.
Single-admin, closed at the request layer
Section titled “Single-admin, closed at the request layer”Runaway is single-admin. Once the first account exists, signup is closed — not just hidden in the
UI, but refused at the request layer, so hitting the sign-up endpoint directly still fails. The
first-signup path is race-safe, which matters on a public hub: a reachable /setup URL is exactly
when someone might try to race the operator to create that first account.
A hub compromise grants no Docker access
Section titled “A hub compromise grants no Docker access”The hub holds no Docker socket. All runner compute lives on agent hosts, which sit behind NAT and dial out to the hub. So even a full hub compromise on the public box grants an attacker no Docker root anywhere — there’s no socket on the exposed surface to take. This one-way trust is also why the hub can never push code to an agent: the exposed surface must never be able to reach into a homelab machine.