marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

search-with-proof group 4 + image: board, spend reservation, coordinator, search-task image

Browse Source 
Board as immutable versioned blobs (coordinator sole writer); budget reserve/settle
before model calls; per-task and run caps; coordinator loop over an injected
executor; batch.py accepts a fixed allow-list of search variables; XSS browser
oracle; ousast-search-task image (Python, Node/TypeScript, PHP, Java 17, sqlite,
bwrap, chromium) built by CI. 103 tests on the host.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-05 14:26:43 +02:00
co-authored by Claude Opus 5.5
parent 6394ee473d
commit 4b38239f68
17 changed files with 1120 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plane/Dockerfile.search-task
+30
View File
@@ -0,0 +1,30 @@
# Build from the repository root; retain the AX runner entrypoint and command.
FROM eclipse-temurin:17-jdk-jammy AS jdk
FROM ghcr.io/norandom/ax-task-runner:v0.3.1
LABEL org.opencontainers.image.licenses="Apache-2.0" \
org.opencontainers.image.source="https://github.com/norandom/OpenUltraSAST"
USER root
COPY --from=jdk /opt/java/openjdk /opt/java/openjdk
ENV JAVA_HOME=/opt/java/openjdk
ENV PATH="/venv/bin:/opt/java/openjdk/bin:${PATH}"
# dpkg exclusions prevent docs/manpages entering layers, including transitive deps.
RUN printf 'path-exclude=/usr/share/doc/*\npath-exclude=/usr/share/man/*\npath-exclude=/usr/share/info/*\n' \
> /etc/dpkg/dpkg.cfg.d/01-no-docs \
&& apt-get update \
&& apt-get install -y --no-install-recommends \
python3 python3-venv nodejs node-typescript php-cli sqlite3 bubblewrap util-linux chromium git ca-certificates \
&& rm -rf /var/lib/apt/lists/* /opt/java/openjdk/lib/src.zip /opt/java/openjdk/man
WORKDIR /app
COPY pyproject.toml README.md LICENSE ./
COPY src ./src
# Includes the verifier-owned oracle fixtures and sandbox helpers. The worker
# protocol is implemented separately (search-with-proof group 5).
RUN python3 -m venv /venv \
&& /venv/bin/pip install --no-cache-dir . \
&& python3 --version && node --version && tsc --version && php --version \
&& javac -version && sqlite3 --version && bwrap --version \
&& prlimit --version && nsenter --version && chromium --version
# Browser sandbox requires a non-root caller; the AX runner needs no root privileges.
RUN useradd --create-home --uid 10001 search
USER search
# Do not replace the AX runner's ENTRYPOINT or CMD.