Hi team, I’d like to discuss updating our security requirements regarding local deployments (specifically using Docker Compose). Currently, Texera supports three deployment options:
*Local Microservices:* Running Scala and Node applications separately. *Docker Compose:* Running a single-node setup. *Kubernetes (K8s):* Running on a cluster (Production standard). Solutions 1 and 2 are intended strictly for local development, testing, or single-user scenarios. Solution 3 is our production standard, designed for cloud deployments and multi-user access. There are known security vulnerabilities in solutions 1 and 2 that are only resolved in the K8s deployment. For instance, in Kubernetes, we leverage native features to authorize requests before they reach specific microservices (e.g., keeping compute unit pods private and guarded by the access control service). In Docker Compose, these endpoints remain publicly exposed. *Proposal:* I suggest updating SECURITY.md to explicitly state that local deployments are intended for testing and development only, and that production-grade security features are not guaranteed in these environments. Best regards, Ali
