tegwick
ba9d266b7e
All checks were successful
CLI entry point and approval-engine/audit-core clients; events carry occurred_at (audit-core envelope); hash-locked image with pinned lldap stage builds locally; image workflow and executor tests in CI; pilot example pins the executed files. rapp reshaping still open. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
18 lines
1.3 KiB
Docker
18 lines
1.3 KiB
Docker
# Bounded executor image (NK-WP-0056-T13). Build context: the repository root.
|
|
# docker build -f bounded-executor/Containerfile .
|
|
# lldap_set_password comes from the same pinned LLDAP image production runs, so OPAQUE matches.
|
|
FROM docker.io/lldap/lldap@sha256:9e605a66c02514bfcffd1b67cafb1e98d50992216bb2871d7ae44622047dd09d AS lldap
|
|
FROM python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9
|
|
RUN useradd --create-home --uid 10001 executor
|
|
WORKDIR /app
|
|
COPY --from=lldap /app/lldap_set_password /app/lldap_set_password
|
|
COPY bounded-executor/requirements.txt /app/bounded-executor/requirements.txt
|
|
RUN python -m pip install --no-cache-dir --require-hashes -r /app/bounded-executor/requirements.txt
|
|
# The executed files keep their repository paths: admissions pin them by path and sha256.
|
|
COPY canon/schemas/bounded-execution-admission_v0.1.schema.json /app/canon/schemas/
|
|
COPY tools/bounded-execution-admission/validate.py /app/tools/bounded-execution-admission/
|
|
COPY sso-mfa/k8s/synthetic-journey/journey.py /app/sso-mfa/k8s/synthetic-journey/
|
|
COPY bounded-executor/executor.py bounded-executor/operations.py bounded-executor/clients.py bounded-executor/cli.py /app/bounded-executor/
|
|
USER 10001:10001
|
|
ENV PYTHONDONTWRITEBYTECODE=1
|
|
ENTRYPOINT ["python", "/app/bounded-executor/cli.py"]
|