marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-17 20:19:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(three-stage-scan): add Docker CLI sandbox runner with isolation flags

Browse Source
This commit is contained in:
Marius Ciepluch
2026-09-03 21:56:02 +02:00
parent 5b7e58ea3a
commit f78ea55e5d
4 changed files with 555 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/specs/three-stage-scan/tasks.md
+1 -1
View File
@@ -85,7 +85,7 @@ This plan ships the three-stage scan without rebuilding CWE policy or the regex
- _Requirements: 9.3_
- _Boundary: SandboxProbe_
- [ ] 4.2 (P) Run jobs through Docker CLI flags that match the threat model
- [x] 4.2 (P) Run jobs through Docker CLI flags that match the threat model
- Network is disabled, source is read-only, scratch is writable, memory/pids/timeout apply, capabilities are dropped, source tree is not writable, and the host Docker socket is never mounted.
- A fake runner records the job and returns a programmed result so default tests do not need a daemon.
- Observable completion: the constructed command line includes network-none and read-only and excludes docker.sock; the fake runner is used by unit tests.