Security

The dashboard never mounts the Docker socket. It talks to Docker through a socket proxy that only exposes the API sections Quasar needs: containers, images, networks, build, volumes, system information and exec.

Two of these can be turned off in /opt/quasar/docker-compose.yml:

Setting	Needed by	If removed
EXEC: 1	The web terminal and tasks.	Those two features stop working.
SESSION: 1 and GRPC: 1	Builds through Docker’s own BuildKit.	docker compose build starts a privileged BuildKit container for each build. Keep them.

• Passwords are hashed with bcrypt.
• Session cookies are HTTP-only, Secure and SameSite=Lax.
• Two-factor authentication is available for every account. See users.
• An address that fails too many sign-ins is refused for a while. See sign-in protection.

• Environment variables, compose files and Git tokens are encrypted in the database.
• The encryption key is kept outside backups. See the master key.
• API tokens are stored as hashes.

The host’s / is mounted read-only in the dashboard, for disk metrics, certificates and the storage explorer.

The storage explorer can’t leave the folder it was opened on:

• paths are normalised before use, so .. can’t climb out;
• symbolic links are resolved and checked, so a link written by an application can’t lead elsewhere;
• files are downloaded as attachments, except a fixed list of image types (SVG is not on it).

When writing files:

• an uploaded file’s name is reduced to its last part;
• writes go through a temporary file that replaces the target, so a symbolic link is replaced, not followed;
• only regular files can be written.

Named volumes are only writable if you mount /var/lib/docker/volumes read-write yourself. See editing files.

Quasar removes host bindings on ports 80 and 443 from compose files, but keeps other published ports: a stack may need to expose a database or a game server.

A compose file with its own traefik.* labels is run as written, without any change.

A server on the internet gets sign-in attempts from strangers within hours. Putting Cloudflare’s proxy in front of it is a simple extra layer: it hides the server’s address, and absorbs floods and known bad traffic before they reach it. Quasar works behind it without any setting.

To set it up, with your domain on Cloudflare:

1. Create the DNS records for <DOMAIN> and *.<DOMAIN> as DNS only (grey cloud) first, and let Quasar get its certificates.
2. Switch both records to Proxied (orange cloud).
3. In SSL/TLS, choose Full (strict): Cloudflare then only talks to your server over HTTPS, with the certificate Quasar got.

Behind the proxy, Quasar reads each visitor’s own address from the CF-Connecting-IP header — for the audit log, the dashboard log and sign-in protection. It only trusts that header on connections that really come from Cloudflare’s addresses, so it can’t be forged by calling the server directly.

Stations run third-party code under a dedicated security model. See stations security.