From 9bf942c5f2412a2939be158bb5c78bcc1120acba Mon Sep 17 00:00:00 2001 From: ali Date: Mon, 19 Oct 2026 14:50:35 -0700 Subject: [PATCH 1/2] docs(security): document which deployment modes provide the full security model State that some of Texera's security features rely on Kubernetes: only the Kubernetes deployment provides the full security model described in this document. The local JVM and single-node Docker Compose deployments are for development, evaluation, and single-user or fully-trusted-team use, and their security is not guaranteed. Co-Authored-By: Claude Opus 4.8 --- SECURITY.md | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 8f424e14192..14f8a19044b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -175,6 +175,16 @@ Texera can be deployed in several configurations, such as local development, sin clusters. For details on supported deployment options and their operational differences, see the deployment guides in our [wiki](https://github.com/apache/texera/wiki/How-to-run-Texera-on-local-Kubernetes). +### Deployment Modes and Security Coverage + +Some of Texera's security features rely on Kubernetes. Only the **Kubernetes deployment** (Helm chart under `bin/k8s`) +provides the full security model described in this document, and it is the mode to use for production and multi-user +deployments. + +**Local deployment on the JVM** (e.g., `bin/local-dev.sh`) and **single-node Docker Compose deployment** +(`bin/single-node`) are intended for development, testing, evaluation, and single-user or fully-trusted-team use. Their +security is **not guaranteed**. + ### Computing Unit Types Texera executes workflows on **computing units**. UI users (REGULAR and ADMIN) can execute arbitrary code (e.g., through @@ -188,7 +198,7 @@ Local computing units run as processes on the same machine as the Texera service **Security characteristics**: -- Suitable for development, testing, and small team use +- Suitable for development, testing, and single-user or fully-trusted-team use - All computing units share the same host machine - No infrastructure-level isolation between users' workflows - Deployment managers control all computing resources @@ -228,6 +238,7 @@ Texera's security model does NOT guarantee: - Protection against malicious code in user workflows (users can execute arbitrary code) - Isolation of application secrets from UDF code executing within the same process or pod - Strong isolation between workflows in local computing units +- Security of local JVM or Docker Compose deployments (see [Deployment Modes and Security Coverage](#deployment-modes-and-security-coverage)) - Complete isolation between workflows in Kubernetes computing units within the same namespace - Protection against infrastructure-level compromises - Protection against deployment manager misconfigurations @@ -289,7 +300,7 @@ lists and website. --- -**Last Updated**: April 2026 +**Last Updated**: October 2026 **Disclaimer**: This project is currently undergoing incubation at The Apache Software Foundation (ASF). Incubation is required of all newly accepted projects until a further review indicates that the infrastructure, communications, and From 9c201ab1ba65838bcc04a116b33c0ca45d16c5c8 Mon Sep 17 00:00:00 2001 From: ali Date: Tue, 20 Oct 2026 08:52:36 -0700 Subject: [PATCH 2/2] docs(security): reduce to a scope statement for Kubernetes deployments Co-Authored-By: Claude Opus 5.5 (1M context) --- SECURITY.md | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 14f8a19044b..433a096894f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -175,15 +175,8 @@ Texera can be deployed in several configurations, such as local development, sin clusters. For details on supported deployment options and their operational differences, see the deployment guides in our [wiki](https://github.com/apache/texera/wiki/How-to-run-Texera-on-local-Kubernetes). -### Deployment Modes and Security Coverage - -Some of Texera's security features rely on Kubernetes. Only the **Kubernetes deployment** (Helm chart under `bin/k8s`) -provides the full security model described in this document, and it is the mode to use for production and multi-user -deployments. - -**Local deployment on the JVM** (e.g., `bin/local-dev.sh`) and **single-node Docker Compose deployment** -(`bin/single-node`) are intended for development, testing, evaluation, and single-user or fully-trusted-team use. Their -security is **not guaranteed**. +When reading this document, only Kubernetes deployments are considered. Docker Compose and single-node deployments are +not intended for production. ### Computing Unit Types @@ -198,7 +191,7 @@ Local computing units run as processes on the same machine as the Texera service **Security characteristics**: -- Suitable for development, testing, and single-user or fully-trusted-team use +- Suitable for development, testing, and small team use - All computing units share the same host machine - No infrastructure-level isolation between users' workflows - Deployment managers control all computing resources @@ -238,7 +231,6 @@ Texera's security model does NOT guarantee: - Protection against malicious code in user workflows (users can execute arbitrary code) - Isolation of application secrets from UDF code executing within the same process or pod - Strong isolation between workflows in local computing units -- Security of local JVM or Docker Compose deployments (see [Deployment Modes and Security Coverage](#deployment-modes-and-security-coverage)) - Complete isolation between workflows in Kubernetes computing units within the same namespace - Protection against infrastructure-level compromises - Protection against deployment manager misconfigurations