# Security

> How the dashboard is isolated, and what to know about exposed ports.

Source: https://quasar.achaverot.fr/docs/reference/security/

## Docker access

The dashboard never mounts the Docker socket. It talks to Docker through a **socket proxy** that only exposes the API sections Quasar needs: containers, images, networks, build, volumes, system information and exec.

Two of these can be turned off in `/opt/quasar/docker-compose.yml`:

| Setting | Needed by | If removed |
| --- | --- | --- |
| `EXEC: 1` | The web terminal and tasks. | Those two features stop working. |
| `SESSION: 1` and `GRPC: 1` | Builds through Docker's own BuildKit. | `docker compose build` starts a **privileged** BuildKit container for each build. Keep them. |

## Accounts and sessions

- Passwords are hashed with bcrypt.
- Session cookies are HTTP-only, Secure and SameSite=Lax.
- Two-factor authentication is available for every account. See [users](/server/users/).
- An address that fails too many sign-ins is refused for a while. See [sign-in protection](/server/users/#sign-in-protection).

## Secrets

- Environment variables, compose files and Git tokens are encrypted in the database.
- The encryption key is kept outside backups. See [the master key](/server/backups/#the-master-key).
- API tokens are stored as hashes.

## Host file system

The host's `/` is mounted **read-only** in the dashboard, for disk metrics, certificates and the storage explorer.

The storage explorer can't leave the folder it was opened on:

- paths are normalised before use, so `..` can't climb out;
- symbolic links are resolved and checked, so a link written by an application can't lead elsewhere;
- files are downloaded as attachments, except a fixed list of image types (SVG is not on it).

When writing files:

- an uploaded file's name is reduced to its last part;
- writes go through a temporary file that replaces the target, so a symbolic link is replaced, not followed;
- only regular files can be written.

Named volumes are only writable if you mount `/var/lib/docker/volumes` read-write yourself. See [editing files](/applications/storage/#editing-files).

## Ports published by compose stacks

Quasar removes host bindings on ports 80 and 443 from compose files, but **keeps other published ports**: a stack may need to expose a database or a game server.

:::warning
Those ports bypass Traefik: no TLS, no password protection, no rate limit, no address list. The **Routing** section of the application lists them. Remove them from the compose file unless you need them.
:::

A compose file with its own `traefik.*` labels is run as written, without any change.

## Cloudflare

A server on the internet gets sign-in attempts from strangers within hours. Putting Cloudflare's proxy in front of it is a simple extra layer: it hides the server's address, and absorbs floods and known bad traffic before they reach it. Quasar works behind it without any setting.

To set it up, with your domain on Cloudflare:

1. Create the DNS records for `<DOMAIN>` and `*.<DOMAIN>` as **DNS only** (grey cloud) first, and let Quasar get its certificates.
2. Switch both records to **Proxied** (orange cloud).
3. In **SSL/TLS**, choose **Full (strict)**: Cloudflare then only talks to your server over HTTPS, with the certificate Quasar got.

Behind the proxy, Quasar reads each visitor's own address from the `CF-Connecting-IP` header — for the audit log, the dashboard log and [sign-in protection](/server/users/#sign-in-protection). It only trusts that header on connections that really come from [Cloudflare's addresses](https://www.cloudflare.com/ips/), so it can't be forged by calling the server directly.

:::warning
- The proxy only carries web traffic. Ports published by a stack, such as a game server, need a **DNS only** record, which shows the server's address.
- The proxy doesn't stop anyone who already knows that address. To close that gap, allow ports 80 and 443 only from Cloudflare's addresses in your server's firewall.
- On the free plan, Cloudflare refuses uploads over 100 MB, including through the storage explorer.
:::

## Stations

Stations run third-party code under a dedicated security model. See [stations security](/stations/security/).