mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Opus 5.5
85f4f0b3d4
Demos are data the verifier executes (fixed build recipes, runtime+path start, HTTP/CLI steps with captures; the canary is never referable). The agent loop with the key never runs repository code: executor tasks without a key exchange commands and results through presigned objects. AX capacity errors are back-pressure with at most 2 tasks in flight; caches and builds under /workspace with a 2 GiB guard; verifiers take one presigned archive per side. Launcher fix: private /dev in bwrap. 190 tests on the host; probe 5/5 demonstrated. Co-Authored-By: Claude Opus 5.5 <[email protected]>
33 lines
1.7 KiB
Docker
33 lines
1.7 KiB
Docker
# Build from the repository root; retain the AX runner entrypoint and command.
|
|
FROM eclipse-temurin:17-jdk-jammy AS jdk
|
|
FROM ghcr.io/norandom/ax-task-runner:v0.3.1
|
|
LABEL org.opencontainers.image.licenses="Apache-2.0" \
|
|
org.opencontainers.image.source="https://github.com/norandom/OpenUltraSAST"
|
|
USER root
|
|
COPY --from=jdk /opt/java/openjdk /opt/java/openjdk
|
|
ENV JAVA_HOME=/opt/java/openjdk
|
|
ENV PATH="/venv/bin:/opt/java/openjdk/bin:${PATH}"
|
|
# dpkg exclusions prevent docs/manpages entering layers, including transitive deps.
|
|
RUN printf 'path-exclude=/usr/share/doc/*\npath-exclude=/usr/share/man/*\npath-exclude=/usr/share/info/*\n' \
|
|
> /etc/dpkg/dpkg.cfg.d/01-no-docs \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
python3 python3-venv python3-pip nodejs npm node-typescript php-cli composer maven gradle \
|
|
sqlite3 bubblewrap util-linux chromium git ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/* /opt/java/openjdk/lib/src.zip /opt/java/openjdk/man
|
|
WORKDIR /app
|
|
COPY pyproject.toml README.md LICENSE ./
|
|
COPY src ./src
|
|
# Includes the verifier-owned recipes, oracles, and key-free executor entrypoints.
|
|
RUN python3 -m venv /venv \
|
|
&& /venv/bin/pip install --no-cache-dir . \
|
|
&& python3 --version && node --version && tsc --version && php --version \
|
|
&& javac -version && sqlite3 --version && bwrap --version \
|
|
&& setpriv --version && prlimit --version && nsenter --version && chromium --version
|
|
# Dedicated identity for artefacts, apps and Chromium; the verifier keeps root.
|
|
RUN groupadd --gid 10001 search \
|
|
&& useradd --create-home --uid 10001 --gid 10001 search
|
|
# gVisor is the outer boundary; retain inner bwrap when its capability probe succeeds.
|
|
USER root
|
|
# Do not replace the AX runner's ENTRYPOINT or CMD.
|