Secure Execution Gateway
FExec turns on-demand automation into a narrow, authenticated HTTP API — callers can only trigger commands or containers an operator has explicitly whitelisted, with every parameter validated before use.
Why it existsThree layers of protection between callers and your host
🔑
Authenticated
Every call requires a JWT or API key — calls to the Docker socket itself are never authenticated.
📋
Whitelisted
Only operator-defined aliases can run. No arbitrary commands, ever.
🧭
Authorized per caller
Granular, per-user permissions determine which aliases each caller is actually allowed to invoke.
🧾
Audited
Every call is logged with user identity, alias, parameters, and exit status.