Story Crater BotandClaude Opus 5
058f11cf2b
Baseline for the Kong replacement on api.riotpiao.com. Brings the working tree under version control for the first time: gateway source, the task board that drives the agent runs, test fixtures, and K8s manifests. Anchor the gateway ignore rule to the repo root. Unanchored, "gateway" also matched the cmd/gateway/ source directory, so the program entrypoint was excluded from every commit. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
34 lines
1.6 KiB
Markdown
34 lines
1.6 KiB
Markdown
# 6.1 — Hardened container image (GREEN)
|
|
|
|
Phase: 6 — Deploy and cutover
|
|
Stage: GREEN
|
|
|
|
The gateway is the public edge process. It gets no shell, no package manager, no
|
|
writable filesystem and no privileges it does not need.
|
|
|
|
- [ ] The runtime image is distroless or scratch — no shell, no package manager, no busybox
|
|
- [ ] The container runs as a non-root user, enforced by `runAsNonRoot` and an explicit non-zero UID
|
|
- [ ] The root filesystem is read-only; any writable path the process genuinely needs is an explicitly mounted volume, not a relaxed rootfs
|
|
- [ ] All Linux capabilities are dropped, and none are added back
|
|
- [ ] `seccompProfile` is `RuntimeDefault`
|
|
- [ ] Privilege escalation is disabled
|
|
- [ ] Image tags are the commit SHA of the source that built them. Never `:latest`, never a moving tag — Argo `selfHeal` cannot reconcile a mutable tag reliably, and a rollback needs a tag that still means what it meant yesterday
|
|
- [ ] The image is reproducible from a committed build definition; nothing is built by hand
|
|
- [ ] The image contains no credentials, kubeconfig or service-account token baked in (G2)
|
|
|
|
## Verify
|
|
|
|
```bash
|
|
docker run --rm --entrypoint sh <image>:<sha>
|
|
# expected: fails — no shell in the image
|
|
|
|
docker run --rm --read-only --user 65532 <image>:<sha> --version
|
|
# expected: starts and exits cleanly under a read-only rootfs as a non-root user
|
|
|
|
docker inspect <image>:<sha> --format '{{.Config.User}}'
|
|
# expected: a non-zero numeric UID, not empty and not "root"
|
|
|
|
grep -rn 'image:' k8s/ | grep -v '@sha256\|:[0-9a-f]\{7,\}'
|
|
# expected: no matches — every image reference is pinned to a SHA
|
|
```
|