feat: use_keyring config option for container-runtime compatibility

[allamiro]

Fixes #227
Supersedes #311 (this PR includes that work plus adds the config option)

Problem

Issue #227 has two distinct parts:

1. Native macOS compilation — linux-keyutils was an unconditional dependency, so the binary wouldn't compile outside Linux. This was the scope of feat: abstract key storage, in-memory fallback for non-linux platforms #311.

2. Docker container on macOS (the remaining gap) — even with a Linux binary, users running Docker Desktop on macOS may not have the keyctl/add_key/request_key syscalls available, or may not know to pass --security-opt seccomp=seccomp/keyring.json. This makes the container fail at runtime with a non-obvious error.

Solution

Add use_keyring: bool (default true) to Config. When false, the in-memory key store is used even on Linux, making the seccomp profile optional for deployments where the kernel keyring is unavailable or undesired.

This PR includes the full key-store abstraction from #311 (split into keyring.rs + memory.rs modules, linux-keyutils moved to Linux-only target dep) and builds on top of it with the runtime dispatch.

Changes

• SecretKey::store / SecretKey::retrieve accept use_keyring: bool; dispatch picks keyring or memory at runtime on Linux, always memory on other platforms
• memory module always compiled (was cfg(not(linux))), keyring module Linux-only
• linux-keyutils moved to [target.'cfg(target_os = "linux")'.dependencies]
• config.yml documents the option and its Docker-on-macOS use case
• Tests use use_keyring=false so they run without real keyring privileges
• Roundtrip test: read_to_vec() instead of fixed 32-byte buffer (from Bump regex from 1.10.0 to 1.10.2 #21/Bump core-js from 3.33.0 to 3.33.1 #22 — avoids corrupting non-32-byte keys)

Testing

cargo test — 9/9 pass on Linux inside Docker (keyring not available in the test container)

[coderabbitai]

Warning

Review limit reached

Next included review available in 59 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6bfaf019-fd5b-4d89-9dab-267b91578c71

📥 Commits

Reviewing files that changed from the base of the PR and between a6b40a7 and 196f640.

📒 Files selected for processing (8)

• Cargo.toml
• config.yml
• src/config/config.rs
• src/keepass/keepass.rs
• src/keepass/key.rs
• src/keepass/key/keyring.rs
• src/keepass/key/memory.rs
• src/server/route/util.rs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[lixmal]

This was stacked on #311, which is now on master, so the rebase is in #342 rather than a force push here: same change with your commit as the base, plus a startup warning when the keyring is off and a README paragraph next to the seccomp section it is the fallback for. The default stays true.

[lixmal]

Merged as #342, rebased onto the key store from #311 with a startup warning and README coverage added.