Verified once, invalidated monthly
stacks/sensitive/README.md on Home Assistant's hardened configuration — read-only root, every capability dropped, two tmpfs mounts: "That was one boot of one digest. Dependabot moves the digest monthly; nothing here re-runs the boot."
The proof that the container starts and stays healthy under that configuration was taken once, on the monitoring host, against a digest that has since been bumped twice (#465, and the 2026.9 line). CI validates the compose file's shape; it does not start the container. So every merged bump silently re-opens the question the hardening answered, and the first time the answer is "no" will be on trinity, after the deploy.
The same is true in principle of every service in the tier; Home Assistant is the one the README calls out because it has the most surface (an integration loader that writes where it likes) and the tightest configuration.
Options
- A scratch-compose boot in CI on the changed service,
--wait with the healthcheck, then down -v — the mechanism scratch-compose-boot already describes for measuring images, pointed at Dependabot PRs.
- A
make smoke STACK=sensitive target run by hand before merging a bump, written into the Dependabot PR checklist.
- Accept it, and say so in the README in place of the sentence above.
Done when
A digest bump to Home Assistant either boots the hardened container somewhere before it merges, or the README records the decision not to.
Refs #134, #404.
Verified once, invalidated monthly
stacks/sensitive/README.mdon Home Assistant's hardened configuration — read-only root, every capability dropped, two tmpfs mounts: "That was one boot of one digest. Dependabot moves the digest monthly; nothing here re-runs the boot."The proof that the container starts and stays healthy under that configuration was taken once, on the monitoring host, against a digest that has since been bumped twice (#465, and the 2026.9 line). CI validates the compose file's shape; it does not start the container. So every merged bump silently re-opens the question the hardening answered, and the first time the answer is "no" will be on
trinity, after the deploy.The same is true in principle of every service in the tier; Home Assistant is the one the README calls out because it has the most surface (an integration loader that writes where it likes) and the tightest configuration.
Options
--waitwith the healthcheck, thendown -v— the mechanismscratch-compose-bootalready describes for measuring images, pointed at Dependabot PRs.make smoke STACK=sensitivetarget run by hand before merging a bump, written into the Dependabot PR checklist.Done when
A digest bump to Home Assistant either boots the hardened container somewhere before it merges, or the README records the decision not to.
Refs #134, #404.