The SOC reads every container's logs and holds no shell

The security team wants the logs from sixty application containers. Nobody wants to give the security team sixty terminals.

Each container publishes one share: POST /api/v1/containers/{id}/storage/shares with source_path: /var/log/app, mode: readonly, target set to the SOC container. The SOC container mounts them, and they appear under /hoody/shares/{alias}/, sixty folders, one per app. Readonly is enforced by the host: the SOC can list, read, and grep, and cannot create, modify, or delete. The application containers never see a login. Their owners never handed out a credential.

From there the SOC runs ripgrep across all sixty folders through its own files URL, from a phone if it has to. No log shipper, no agent install in sixty places, no central log platform seat. The bytes stay where they were written.

The security team's view of the fleet is a folder of read-only mounts.