longline 0.11.0

# Docker: read-only commands and destructive operations

allowlists:
  commands:
    # ── Docker: read-only operations ─────────────────────────────
    - { command: "docker ps", trust: minimal }
    - { command: "docker images", trust: minimal }
    - { command: "docker logs", trust: minimal }
    - { command: "docker inspect", trust: minimal }
    - { command: "docker stats", trust: minimal }
    - { command: "docker top", trust: minimal }
    - { command: "docker port", trust: minimal }
    - { command: "docker version", trust: minimal }
    - { command: "docker info", trust: minimal }
    # ── Docker network: read-only ────────────────────────────────
    - { command: "docker network ls", trust: minimal }
    - { command: "docker network inspect", trust: minimal }
    # ── Docker volume: read-only ─────────────────────────────────
    - { command: "docker volume ls", trust: minimal }
    - { command: "docker volume inspect", trust: minimal }
    # ── Docker compose (new plugin): safe operations ─────────────
    - { command: "docker compose ps", trust: minimal }
    - { command: "docker compose logs", trust: minimal }
    - { command: "docker compose config", trust: minimal }
    - { command: "docker compose images", trust: minimal }
    - { command: "docker compose top", trust: minimal }
    - { command: "docker compose version", trust: minimal }
    # ── Docker-compose (legacy): safe operations ─────────────────
    - { command: "docker-compose ps", trust: minimal }
    - { command: "docker-compose logs", trust: minimal }
    - { command: "docker-compose config", trust: minimal }
    - { command: "docker-compose images", trust: minimal }
    - { command: "docker-compose top", trust: minimal }
    - { command: "docker-compose version", trust: minimal }
    # ── Docker compose: standard operations ──────────────────────
    - { command: "docker compose down", trust: standard, reason: "Stops and removes Docker Compose containers" }
    - { command: "docker-compose down", trust: standard, reason: "Stops and removes Docker Compose containers" }

rules:
  # ============================================================
  # HIGH: Docker compose destructive
  # ============================================================
  # docker compose down -v / docker compose down --volumes
  - id: docker-compose-down-volumes
    level: high
    match:
      command: docker
      args:
        any_of: ["compose"]
      flags:
        all_of: ["down"]
        any_of: ["--volumes", "-v"]
    decision: ask
    reason: "Docker compose down with volume removal"

  # docker-compose down -v / docker-compose down --volumes (legacy)
  - id: docker-compose-legacy-down-volumes
    level: high
    match:
      command: docker-compose
      args:
        any_of: ["down"]
      flags:
        any_of: ["--volumes", "-v"]
    decision: ask
    reason: "Docker compose down with volume removal"

  # docker compose down --rmi
  - id: docker-compose-down-rmi
    level: high
    match:
      command: docker
      args:
        any_of: ["compose"]
      flags:
        all_of: ["down"]
        any_of: ["--rmi"]
    decision: ask
    reason: "Docker compose down with image removal"

  # docker-compose down --rmi (legacy)
  - id: docker-compose-legacy-down-rmi
    level: high
    match:
      command: docker-compose
      args:
        any_of: ["down"]
      flags:
        any_of: ["--rmi"]
    decision: ask
    reason: "Docker compose down with image removal"

  # docker compose down --remove-orphans
  - id: docker-compose-down-remove-orphans
    level: high
    match:
      command: docker
      args:
        any_of: ["compose"]
      flags:
        all_of: ["down"]
        any_of: ["--remove-orphans"]
    decision: ask
    reason: "Docker compose down removing orphan containers"

  # docker-compose down --remove-orphans (legacy)
  - id: docker-compose-legacy-down-remove-orphans
    level: high
    match:
      command: docker-compose
      args:
        any_of: ["down"]
      flags:
        any_of: ["--remove-orphans"]
    decision: ask
    reason: "Docker compose down removing orphan containers"

  # docker compose rm
  - id: docker-compose-rm
    level: high
    match:
      command: docker
      args:
        any_of: ["compose"]
      flags:
        any_of: ["rm"]
    decision: ask
    reason: "Docker compose rm removes containers"

  # docker-compose rm (legacy)
  - id: docker-compose-legacy-rm
    level: high
    match:
      command: docker-compose
      args:
        any_of: ["rm"]
    decision: ask
    reason: "Docker compose rm removes containers"

  # ============================================================
  # HIGH: Docker volume destructive
  # ============================================================
  - id: docker-volume-rm
    level: high
    match:
      command: docker
      args:
        any_of: ["volume"]
      flags:
        any_of: ["rm", "prune"]
    decision: ask
    reason: "Docker volume removal"

  # ============================================================
  # HIGH: Docker container destructive
  # ============================================================
  # docker container rm / docker container remove
  - id: docker-container-rm
    level: high
    match:
      command: docker
      args:
        any_of: ["container"]
      flags:
        any_of: ["rm", "remove"]
    decision: ask
    reason: "Removing Docker container"

  # docker container prune
  - id: docker-container-prune
    level: high
    match:
      command: docker
      args:
        any_of: ["container"]
      flags:
        any_of: ["prune"]
    decision: ask
    reason: "Pruning stopped Docker containers"

  # docker rm / docker remove (shorthand) - must exclude subcommand forms
  - id: docker-rm-container
    level: high
    match:
      command: docker
      args:
        any_of: ["rm", "remove"]
      flags:
        none_of: ["volume", "container", "network", "image", "compose"]
    decision: ask
    reason: "Removing Docker container"

  # docker kill
  - id: docker-kill
    level: high
    match:
      command: docker
      args:
        any_of: ["kill"]
    decision: ask
    reason: "Killing Docker container"

  # ============================================================
  # HIGH: Docker image destructive
  # ============================================================
  # docker image rm / docker image remove
  - id: docker-image-rm
    level: high
    match:
      command: docker
      args:
        any_of: ["image"]
      flags:
        any_of: ["rm", "remove"]
    decision: ask
    reason: "Removing Docker image"

  # docker image prune
  - id: docker-image-prune
    level: high
    match:
      command: docker
      args:
        any_of: ["image"]
      flags:
        any_of: ["prune"]
    decision: ask
    reason: "Pruning unused Docker images"

  # docker rmi (shorthand)
  - id: docker-rmi
    level: high
    match:
      command: docker
      args:
        any_of: ["rmi"]
    decision: ask
    reason: "Removing Docker image"

  # ============================================================
  # HIGH: Docker network destructive
  # ============================================================
  # docker network rm / docker network remove
  - id: docker-network-rm
    level: high
    match:
      command: docker
      args:
        any_of: ["network"]
      flags:
        any_of: ["rm", "remove"]
    decision: ask
    reason: "Removing Docker network"

  # docker network prune
  - id: docker-network-prune
    level: high
    match:
      command: docker
      args:
        any_of: ["network"]
      flags:
        any_of: ["prune"]
    decision: ask
    reason: "Pruning unused Docker networks"

  # ============================================================
  # HIGH: Docker system destructive
  # ============================================================
  - id: docker-system-prune
    level: high
    match:
      command: docker
      args:
        any_of: ["system"]
      flags:
        any_of: ["prune"]
    decision: ask
    reason: "Docker system prune"