--pid1-process--
cmdline: ./orborus
PID   PPID  USER     COMMAND
    1     0 root     ./orborus
 1435     1 root     [timeout]
 2855     1 root     [timeout]
 4238     0 root     sh -lc echo "cmdline: $(tr "\0" " " < /proc/1/cmdline)"; ps -eo pid,ppid,user,args 2>/dev/null | sed -n "1,20p"
 4245  4238 root     ps -eo pid,ppid,user,args
 4246  4238 root     sed -n 1,20p
--docker-sock-mount--
[
  {
    "Type": "bind",
    "Source": "/var/run/docker.sock",
    "Destination": "/var/run/docker.sock",
    "Mode": "rw",
    "RW": true,
    "Propagation": "rprivate"
  }
]
--docker-sock-in-container--
srw-rw----    1 1001     988              0 May 16 02:37 /var/run/docker.sock
type: socket
--orchestration-environment--
BASE_URL=http://shuffle-backend:5001
CLEANUP=false
DOCKER_API_VERSION=1.44
ENVIRONMENT_NAME=Shuffle
ORBORUS_CONTAINER_NAME=aptl-shuffle-orborus
ORG_ID=Shuffle
SHUFFLE_APP_SDK_TIMEOUT=300
SHUFFLE_LOGS_DISABLED=true
SHUFFLE_ORBORUS_EXECUTION_TIMEOUT=600
SHUFFLE_SKIP_PIPELINES=true
SHUFFLE_STATS_DISABLED=true
SHUFFLE_WORKER_IMAGE=ghcr.io/shuffle/shuffle-worker:latest
--outbound-target-backend--
172.20.0.20       shuffle-backend  shuffle-backend
---tcp 5001 probe---
shuffle-backend (172.20.0.20:5001) open
rc=0
--host-control-note--
orborus runs as PID 1 (the /orborus Go static binary) and is bound to the host Docker daemon via the read-write /var/run/docker.sock bind. It does not listen on any TCP port (no published ports, no listeners); it is an OUTBOUND poller against http://shuffle-backend:5001 and a host-Docker controller. The docker.sock bind is the dominant attack surface of this asset: full host-Docker control == host root.
