Security

Upgrade Go to 1.25.7

Fixes three standard library vulnerabilities:

govulncheck now reports no vulnerabilities.

Closes #1

Full Changelog: v1.1.2...v1.1.3

Full Changelog: v1.1.2...v1.1.3

What's Changed

Simplified Docker setup

• Removed tmpfs requirement — /tmp/agent-runner directory already exists in the image with correct ownership, no need for tmpfs overlay in compose/stack files
• Config file no longer required in Docker — removed --config from default CMD and configs section from docker-stack.yml. Pure env var setup works out of the box
• docker-stack.yml — allow_private_networks enabled by default for overlay network communication

Minimal Swarm deployment now requires zero config files:

docker stack deploy -c docker-stack.yml agent-runner

Full Changelog: v1.1.1...v1.1.2

Full Changelog: v1.1.1...v1.1.2

What's Changed

Config file is now optional

Agent Runner no longer requires a config file. If no file is found (including when passed via --config), defaults + environment variables are used. This enables clean Docker Swarm deployments without mounting a config file:

docker run \
  -e AGENT_RUNNER_AUTH_HMAC_SECRET_FILE=/run/secrets/hmac_secret \
  -e AGENT_RUNNER_PROVIDERS_OPENAI_KEY_FILE=/run/secrets/openai_key \
  -e AGENT_RUNNER_CALLBACK_BASE_URL=http://laravel-app:8000/api/agent-runner \
  -e AGENT_RUNNER_SECURITY_ALLOW_PRIVATE_NETWORKS=true \
  ghcr.io/ginkida/agent-runner:latest

Full Changelog: v1.1.0...v1.1.1

Full Changelog: v1.1.0...v1.1.1

What's New

Configurable SSRF protection for private networks

Agent Runner now supports deployment in Docker Swarm, Kubernetes, and other internal network environments where callbacks resolve to private IP addresses.

New config option security.allow_private_networks (default: false) disables private IP blocking when enabled:

security:
  allow_private_networks: true

Or via environment variable:

AGENT_RUNNER_SECURITY_ALLOW_PRIVATE_NETWORKS=true

When enabled, SSRF protection no longer blocks connections to RFC1918 addresses (10.x, 172.16.x, 192.168.x), loopback, and link-local ranges — allowing callbacks over Docker overlay networks, Kubernetes cluster DNS, and other internal topologies.

Existing deployments are unaffected — the default remains false.

README improvements

• Added Laravel SDK section with usage examples
• Expanded documentation across all sections

Full Changelog: v1.0.1...v1.1.0

Full Changelog: v1.0.1...v1.1.0

Full Changelog: v1.0.0...v1.0.1

Full Changelog: https://github.com/ginkida/agent-runner/commits/v1.0.0