lucullus

You can get the image SHA. If you then provide the corresponsig tag, that you used, an application could check if a new image is available. Or maybe if you use docker compose, the app could get the tag from the compose file, and even check for new tagged versions based on a specific pattern.

Wow, thats one kind of a project. I'm impressed. Though it doesn't really fit my problem. It has to be something webbased, where everyone of us can use it without an app, without seeing each others information. From the github page it looks like a local tool. And also focused trading similar items. The presents in our secret santa are highly individualized, so randomly trading does not make much sense. And if the interface is too clunky, my non-tech siblings will just reject using it. I want to keep them from deciding for some free privacy nightmare app.

But I thank you for the suggestion. Its an interesting project

Security noob here. Would it be sufficient (in addition to only local authorized access) to directly put the file in an unprivileged container, watching its log output? And of course limiting resource use and execution time of the container (don't know if common container tools like docker or podman have a way to limit resources out of the box)

So lets say a simple interface for the file upload behind an authentication service, based on lets say python cgi, ramping up an unprivileged nonroot docker container, killing the container after a fixed time (a few seconds).

That looks promising. And I can contribute with a translation for another language

I will try it, when I'm home again. The commit history starts and ends about 5 months ago, so yeah, probably not fully finished. Thanks for the suggestion

I run headscale on my VPS. The tailscale clients are already open source, though by default they connect to the companies servers for coordinating the net. Headscale is open source and replaces the companies servers with your own. Best to not rely on some corporate service, which could cease to exist or be enshittiefied.