Story Crater BotandClaude Opus 5
058f11cf2b
Baseline for the Kong replacement on api.riotpiao.com. Brings the working tree under version control for the first time: gateway source, the task board that drives the agent runs, test fixtures, and K8s manifests. Anchor the gateway ignore rule to the repo root. Unanchored, "gateway" also matched the cmd/gateway/ source directory, so the program entrypoint was excluded from every commit. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
1.6 KiB
1.6 KiB
6.1 — Hardened container image (GREEN)
Phase: 6 — Deploy and cutover Stage: GREEN
The gateway is the public edge process. It gets no shell, no package manager, no writable filesystem and no privileges it does not need.
- The runtime image is distroless or scratch — no shell, no package manager, no busybox
- The container runs as a non-root user, enforced by
runAsNonRootand an explicit non-zero UID - The root filesystem is read-only; any writable path the process genuinely needs is an explicitly mounted volume, not a relaxed rootfs
- All Linux capabilities are dropped, and none are added back
seccompProfileisRuntimeDefault- Privilege escalation is disabled
- Image tags are the commit SHA of the source that built them. Never
:latest, never a moving tag — ArgoselfHealcannot reconcile a mutable tag reliably, and a rollback needs a tag that still means what it meant yesterday - The image is reproducible from a committed build definition; nothing is built by hand
- The image contains no credentials, kubeconfig or service-account token baked in (G2)
Verify
docker run --rm --entrypoint sh <image>:<sha>
# expected: fails — no shell in the image
docker run --rm --read-only --user 65532 <image>:<sha> --version
# expected: starts and exits cleanly under a read-only rootfs as a non-root user
docker inspect <image>:<sha> --format '{{.Config.User}}'
# expected: a non-zero numeric UID, not empty and not "root"
grep -rn 'image:' k8s/ | grep -v '@sha256\|:[0-9a-f]\{7,\}'
# expected: no matches — every image reference is pinned to a SHA