Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: run cli command widget #2385

Open
jackwellerreal opened this issue Feb 21, 2025 · 2 comments
Open

feat: run cli command widget #2385

jackwellerreal opened this issue Feb 21, 2025 · 2 comments
Labels
decision A decision needs to be taken integration New integration needs triage

Comments

@jackwellerreal
Copy link
Contributor

jackwellerreal commented Feb 21, 2025

Describe the feature you'd like to request

A widget that will run a bash command when clicked.

Additional information

Could be used for stuff like powering off the machine, turning a machine on with wakeonlan or restarting docker containers.

Originally posted ajnart/homarr#1113

@manuel-rw
Copy link
Member

manuel-rw commented Feb 21, 2025

I dislike doing this for several reasons:

  • it is an easy target for privilege escalation. Bad actors could easily use this to elevate permissions or harm otherwise protected systems
  • the behavior of scripts will be different on your deployment method. On Docker, you'll have a different file system than when you host using bare metal or Kubernetes.
  • we try to run Homarr with a low permissions as possible, reducing possible attack vectors. It may not have enough permissions to run certain command or scripts
  • changes in our base image could lead to broken scripts, since there are minor differences between distros and the binaries that are included with each base image

If we decide to implement this, I strongly recommend that it must be manually activated using an environment variable to explicitly warn users of the risk.
As a side note, you can already trigger Wake on LAN if you use HomeAssistant and the WOL integration.

@manuel-rw manuel-rw added decision A decision needs to be taken integration New integration labels Feb 21, 2025
@jackwellerreal
Copy link
Contributor Author

I agree. It must be very secure if implemented. But it would be a feature more advanced users, like if they want to use homarr as like a dashboard which shows them all of their stats of their server and buttons to run quick acitons.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
decision A decision needs to be taken integration New integration needs triage
Projects
None yet
Development

No branches or pull requests

2 participants