# Known-unbounded docker CLI invocations, by file. RATCHET FILE.
#
# Regenerate with: bash scripts/tests/docker-bounds-scan.sh --regen
#
# test-docker-call-bounds.sh FAILS when a file not listed here gains an
# unbounded docker call. Entries are debt: bound the calls, then re-run
# --regen so the line disappears. The list may only shrink.
#
# It is NOT an approval. Every line is a place where a wedged dockerd can
# park the caller indefinitely — see the header of docker-bounds-scan.sh
# for what that cost in production.
#
# format: <count><TAB><path>[<TAB># reason]
#
# The optional third column is WHY an entry is tolerated rather than
# fixed. --regen carries it over for every path that is still listed,
# so a reason written once survives later regenerations. Any entry
# added after 2026-08-23 must carry one.
1	panel/internal/areas/monitoringai/testdata/logreview/stub_env.php	# false positive: a regex in an exec() stub that MATCHES a docker command string; nothing is run
4	panel/internal/areas/serveradmin/serversettings/testdata/gen-ssb-actions.php	# false positive: regex patterns for a stubbed exec(); the oracle never calls docker
7	scripts/apply-coraza-waf-mode.sh
8	scripts/boot-orchestrator.sh
61	scripts/container-manager.sh
7	scripts/customer-container-watchdog.sh
1	scripts/detect-site-framework.php
3	scripts/ensure-docker-port-bindings.sh
10	scripts/ensure-edge-container.sh
1	scripts/ensure-trusted-proxies-conf.sh	# false positive: "docker network" inside a report message; the script only reads `ip addr`
1	scripts/go-port/gen-wp-scrub-vectors.php	# false positive: a string literal in a scrubber test vector, not a call
8	scripts/go-port/seed-fixtures.sh	# DEBT: Go-port test-VM fixture seeding (docker run of Mail-Test may pull); bound per call with sizing
10	scripts/go-port/state-snapshot.sh	# DEBT: Go-port test-VM save/restore; pg_dumpall/psql restore are long-running, need per-call sizing before a bound
14	scripts/haproxy-watchdog.sh
6	scripts/lib-container-tiers.sh
1	scripts/lib-edge-container.sh
1	scripts/lib-ols-validate.sh
2	scripts/powerdns-password-manager.sh
1	scripts/process-log-review.php
1	scripts/pull-container-images.sh
2	scripts/refresh-wp-versions.sh
12	scripts/regenerate-canonical-schema.sh
5	scripts/regenerate-coraza-overrides.sh
2	scripts/setup-haproxy-syslog.sh
5	scripts/setup-powerdns-enhanced.sh
13	scripts/setup-shared-ols.sh
3	scripts/test-container-hardening.php	# dev-box test harness (throwaway containers, run by hand, not on servers); same class as the scripts/test-* entries above
1	scripts/test-db-name.php
4	scripts/test-docker-log-rotate.sh	# dev-box test harness (throwaway containers, run by hand, not on servers); same class as the scripts/test-* entries above
1	scripts/test-edge-container-parity.sh
2	scripts/test-ensure-edge-container.sh
11	scripts/test-escape-mysql-db-grants.sh	# dev-box test harness (throwaway containers, run by hand, not on servers); same class as the scripts/test-* entries above
4	scripts/test-fix-wp-clone-host-site-path.sh	# dev-box test harness (throwaway containers, run by hand, not on servers); same class as the scripts/test-* entries above
3	scripts/test-health-system-containers.php	# dev-box test harness (throwaway containers, run by hand, not on servers); same class as the scripts/test-* entries above
1	scripts/test-log-monitor-selfheal-rule.py	# dev-box test harness (throwaway containers, run by hand, not on servers); same class as the scripts/test-* entries above
3	scripts/test-mysql-grant-escape.php	# dev-box test harness (throwaway containers, run by hand, not on servers); same class as the scripts/test-* entries above
11	scripts/test-pg-public-lockdown-docker.sh	# dev-box test harness (throwaway containers, run by hand, not on servers); same class as the scripts/test-* entries above
4	scripts/test-pgsql-user-grants-docker.sh	# dev-box test harness (throwaway containers, run by hand, not on servers); same class as the scripts/test-* entries above
2	scripts/test-postgresql-integration.sh
2	scripts/test-shared-vhost-security.php
6	scripts/test-sitesmith-mariadb.sh	# dev-box test harness (throwaway containers, run by hand, not on servers); same class as the scripts/test-* entries above
5	scripts/test-user-preferences-migration.sh	# dev-box test harness (throwaway containers, run by hand, not on servers); same class as the scripts/test-* entries above
6	scripts/test-valkey-integration.sh
2	scripts/test-valkey-isolation.sh
2	scripts/test-valkey-load-probe.sh
5	scripts/test-valkey-snapshot.sh
1	scripts/test-wordpress-hardening.php	# dev-box test harness (throwaway containers, run by hand, not on servers); same class as the scripts/test-* entries above
1	scripts/test-wp-campaign-followup.php
6	scripts/test-wp-inventory-scan.php
2	scripts/test-wp-patch-campaign.php
5	scripts/update-add-postgresql.sh
2	scripts/updates/2026.03.3/setup-haproxy-watchdog.sh
2	scripts/updates/2026.04.32/fix-postgresql-db-permissions.sh
2	scripts/updates/2026.05.102/fix-stock-ssl-conf.sh
5	scripts/updates/2026.05.107/migrate-container-tiers.sh
1	scripts/updates/2026.05.110/seed-customer-state-file.sh
3	scripts/updates/2026.05.121/cleanup-legacy-whp-suspended.sh
1	scripts/updates/2026.05.201/setup-cpanel-importer-sandbox.sh
1	scripts/updates/2026.05.84/ssl-renewal-state-backfill.sh
1	scripts/updates/2026.06.139/enable-http3-quic.sh
3	scripts/updates/2026.06.20/migrate-valkey-host-dir.sh
2	scripts/updates/2026.06.51/set-customer-restart-policy.sh
14	scripts/updates/2026.08.20/apply-dotfile-http-deny.sh
10	scripts/updates/2026.08.32/apply-backup-archive-http-deny.sh
1	scripts/updates/2026.08.32/apply-docker-log-limits.sh
8	scripts/updates/2026.08.33/install-shared-httpd-default-vhost.sh
10	scripts/updates/2026.10.3/apply-site-builder-http-deny.sh	# released versioned update script, frozen once shipped (same class as the other scripts/updates/<ver>/ entries)
1	scripts/updates/2026.10.8/reconcile-orphaned-edge-login-blocks.sh	# released versioned update script, frozen once shipped (same class as the other scripts/updates/<ver>/ entries)
1	scripts/updates/2026.10.9/reconcile-orphaned-service-edge-blocks.sh	# released versioned update script, frozen once shipped (same class as the other scripts/updates/<ver>/ entries)
1	scripts/verify-powerdns.sh
7	scripts/whp-docker-log-rotate.sh
3	scripts/whp-log-monitor-ai.py
9	scripts/whp-monitor-poll.py
4	scripts/wp-campaign-followup.php
21	setup.sh
2	web-files/ajax-status.php
3	web-files/api/external/system.php
11	web-files/api/health.php
6	web-files/api/sites.php
2	web-files/api/terminal.php
1	web-files/libs/container_stats.php
3	web-files/libs/CpanelImportSanitizationContainer.php
2	web-files/libs/disk_cleanup_helpers.php
2	web-files/libs/haproxy_manager.php
4	web-files/libs/shared_ols_manager.php
1	web-files/libs/site_disable.php
6	web-files/libs/ssl_manager.php
14	web-files/libs/WordPressManager.php
5	web-files/libs/WpInventoryScanner.php
4	web-files/pages/ai-monitor.php
17	web-files/pages/server-settings.php
2	web-files/scripts/ensure-shared-ols-vhosts.php
