Made security review, applied recommendations.

docs/storage-transfer.md

@@ -103,17 +103,23 @@ The containers run with the following settings:
 |---|---|---|
 | `imds-emulator` | Image | built from `sts-agent/Dockerfile`: a static Go binary on `gcr.io/distroless/static-debian13` |
 | | Port | `8080`, set by `IMDS_PORT` |
+| | Bind address | all interfaces, set by `IMDS_HOST` |
 | | Mount | `/etc/sts-agent`, read only |
 | | Environment | `GOOGLE_APPLICATION_CREDENTIALS=/etc/sts-agent/cred.json` |
 | | Environment | `GOOGLE_API_CERTIFICATE_CONFIG=/etc/sts-agent/certificate_config.json` |
 | | Environment | `PROJECT_ID`, `PROJECT_NUMBER` |
-| `sts-agent` | Image | `gcr.io/cloud-ingest/tsop-agent:latest` |
+| | Health check | `/imds-emulator -check` every 10 seconds |
+| | Restart policy | `unless-stopped` |
+| | Stop grace period | 30 seconds |
+| `agent` | Image | `gcr.io/cloud-ingest/tsop-agent:latest` |
+| | Start condition | the health check of `imds-emulator` passes |
+| | Restart policy | `unless-stopped` |
 | | Mount | `/mnt/ext-storage`, read only |
 | | Environment | `GCE_METADATA_HOST=imds-emulator:8080`, `GCE_METADATA_IP=imds-emulator:8080` |
 | | Locked memory limit | `64000000` bytes |
 | | Arguments | `--project-id=${PROJECT_ID} --hostname=$(hostname) --agent-pool=${STS_AGENT_POOL}` |
 
-The emulator publishes no port; only the containers of the Compose project reach it. The agent container must not set `GOOGLE_API_CERTIFICATE_CONFIG`, because the metadata token code of the agent parses the certificate it points to with `cryptography`.
+The emulator publishes no port; only the containers of the Compose project reach it. It does not authenticate its clients beyond the `Metadata-Flavor` header, as the Compute Engine metadata server does, so every container of the Compose project can obtain the tokens of `sa-test`. When it runs outside Compose, set `IMDS_HOST=127.0.0.1` to bind the loopback interface only. The agent container must not set `GOOGLE_API_CERTIFICATE_CONFIG`, because the metadata token code of the agent parses the certificate it points to with `cryptography`.
 
 `sts-agent/compose.yaml` holds these settings for Docker Compose. Compose substitutes `PROJECT_ID`, `PROJECT_NUMBER`, `STS_AGENT_POOL` and `HOSTNAME` from `sts-agent/.env`. Create the file with the values of `env.sh` and the host name printed by `hostname`:
 
@@ -134,7 +140,13 @@ docker compose build
 docker compose up -d
 ```
 
-The emulator logs one line per request with the path and the status, never the token:
+The agent starts after the emulator reports healthy. The state is shown by:
+
+```bash
+docker compose ps
+```
+
+The emulator logs one line per request with the path and the status, never the query string or the token:
 
 ```bash
 docker compose logs imds-emulator
@@ -142,9 +154,11 @@ docker compose logs imds-emulator
 
 Requests for paths that the emulator does not serve are logged with the status 404.
 
-The emulator is a static binary without dependencies on files of the system: it embeds the root certificates and the time zone data, and it is the first process (PID 1) of its container. On `SIGTERM` or `SIGINT`, which `docker compose stop` sends, it stops accepting connections, lets the requests in progress finish for up to 5 seconds, and exits with status 0. A second signal makes it exit at once.
+The emulator is a static binary without dependencies on files of the system: it embeds the root certificates and the time zone data, and it is the first process (PID 1) of its container. On `SIGTERM` or `SIGINT`, which `docker compose stop` sends, it stops accepting connections, lets the requests in progress finish for up to 20 seconds, and exits with status 0. A second signal makes it exit with status 1 at once. The stop grace period of the container is 30 seconds, longer than the shutdown of the emulator.
 
-The unit tests of the emulator, `sts-agent/main_test.go`, cover the request checks, the metadata endpoints, the token response, the extraction of the service account email from the credentials file, the shutdown, and a run of the emulator as a process stopped with real signals. They run during the build of the image, so a failing test stops it. To run them on a workstation with Go:
+The emulator keeps at most 16 token providers, one per set of scopes requested, and drops them all when the limit is reached.
+
+The unit tests of the emulator, `sts-agent/main_test.go`, cover the request checks, the metadata endpoints, the scope parsing, the token response, the request log, the extraction of the service account email from the credentials file, the shutdown, the check mode, and runs of the emulator as a process stopped with real signals. They run during the build of the image, so a failing test stops it. To run them on a workstation with Go:
 
 ```bash
 cd sts-agent