LOKI LogoLOKIv1.10.0

Authorization Guardrail

Localhost runs with zero friction; non-local hosts require a one-time confirmation persisted in .loki/authorized_targets.json.

How it works

  • Localhost passes without friction: localhost, 127.0.0.1, ::1, and 0.0.0.0 are always allowed immediately without prompts.
  • Interactive hostname confirmation or --authorized: For any other host, loki run and loki record block until you confirm permission by typing the exact hostname at the prompt, or pass --authorized (for non-interactive / CI runs).
  • Persisted in .loki/authorized_targets.json: Once confirmed, the hostname is saved in .loki/authorized_targets.json so future runs against that host won't prompt again.

Managing authorized hosts (`loki auth`)

FlagTypeDefaultDescription
loki auth listcommand—List all non-local hosts recorded in .loki/authorized_targets.json (Host, Authorized At, Note).
loki auth add <host>hostname—Pre-authorize a hostname (e.g. staging.example.com) so loki run and loki record won't prompt.
loki auth remove <host>hostname—Revoke a previously confirmed hostname so future runs against it will prompt again.
Terminal
loki auth list
loki auth add staging.example.com
loki auth remove staging.example.com
# Non-interactive authorization in CI pipelines
loki run https://staging.example.com --authorized --ci
.loki/authorized_targets.json
{
  "hosts": {
    "staging.example.com": {
      "authorized_at": "2026-10-22T15:30:00+00:00",
      "note": "loki auth add"
    }
  }
}

Running chaos against systems you don't own or lack written permission to test may be illegal.

PreviousInfrastructure ChaosNextNetwork Scrubber