Skip to content

feat(security): Add runtime review profiles #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nfebe wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(security): Add runtime review profiles #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
74 changes: 74 additions & 0 deletions astro/metadata.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,77 @@ mounts:
description: Astro application source code
type: file
required: true

security_profile: {
"api_version": "flatrun.security-profile/v1",
"baseline_version": "1.0.0",
"version": "1.0.0",
"runtime": "javascript",
"targets": {
"source": {
"service": "app",
"roots": [
"/app"
],
"metadata_sources": [
"inventory"
]
}
},
"reviews": {
"runtime-files": {
"concern": "integrity",
"target": "source",
"runs": [
"incremental",
"full"
],
"expectations": [
"Inspect approved snapshots without executing application code. Indicators require runtime and policy context."
],
"collect": [
{
"id": "runtime-files",
"image": "",
"command": [
"python3",
"/collectors/inventory.py",
"--runtime",
"javascript"
],
"snapshot_paths": [
"."
],
"metadata_sources": [],
"required": true,
"signals": [
{
"id": "file-indicators",
"kind": "json_count_gt",
"pointer": "/items/0/indicator_count",
"value": 0
}
]
}
]
}
},
"schedule": {
"incremental": "*/5 * * * *",
"retrospective": "17 * * * *",
"full": "0 2 * * *"
},
"budget": {
"timeout_seconds": 30,
"max_output_bytes": 65536,
"max_files": 10000,
"max_snapshot_bytes": 67108864,
"model_input_bytes": 131072,
"model_output_bytes": 32768,
"max_file_bytes": 1048576
},
"access_policy": {
"version": "1",
"actions": {}
}
}
15 changes: 15 additions & 0 deletions go/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
name: ${NAME}
services:
web:
image: golang:1.25
container_name: ${NAME}
working_dir: /workspace
command: /workspace/server
expose:
- "8080"
networks:
- proxy
restart: unless-stopped
networks:
proxy:
external: true
87 changes: 87 additions & 0 deletions go/metadata.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,87 @@
name: Go
description: Run a prebuilt Go server listening on port 8080
logo: https://cdn.simpleicons.org/go
category: runtime
priority: 30
container_port: 8080
mounts:
- id: workspace
name: Application
container_path: /workspace
description: Prebuilt server binary and application files
type: file
required: true

security_profile: {
"api_version": "flatrun.security-profile/v1",
"baseline_version": "1.0.0",
"version": "1.0.0",
"runtime": "go",
"targets": {
"source": {
"service": "web",
"roots": [
"/workspace"
],
"metadata_sources": [
"inventory"
]
}
},
"reviews": {
"runtime-files": {
"concern": "integrity",
"target": "source",
"runs": [
"incremental",
"full"
],
"expectations": [
"Inspect approved snapshots without executing application code. Indicators require runtime and policy context."
],
"collect": [
{
"id": "runtime-files",
"image": "",
"command": [
"python3",
"/collectors/inventory.py",
"--runtime",
"go"
],
"snapshot_paths": [
"."
],
"metadata_sources": [],
"required": true,
"signals": [
{
"id": "file-indicators",
"kind": "json_count_gt",
"pointer": "/items/0/indicator_count",
"value": 0
}
]
}
]
}
},
"schedule": {
"incremental": "*/5 * * * *",
"retrospective": "17 * * * *",
"full": "0 2 * * *"
},
"budget": {
"timeout_seconds": 30,
"max_output_bytes": 65536,
"max_files": 10000,
"max_snapshot_bytes": 67108864,
"model_input_bytes": 131072,
"model_output_bytes": 32768,
"max_file_bytes": 67108864
},
"access_policy": {
"version": "1",
"actions": {}
}
}
74 changes: 74 additions & 0 deletions laravel/metadata.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,3 +115,77 @@ backup:
- service: app
command: php artisan up
timeout: 30

security_profile: {
"api_version": "flatrun.security-profile/v1",
"baseline_version": "1.0.0",
"version": "1.0.0",
"runtime": "php",
"targets": {
"source": {
"service": "app",
"roots": [
"/app"
],
"metadata_sources": [
"inventory"
]
}
},
"reviews": {
"runtime-files": {
"concern": "integrity",
"target": "source",
"runs": [
"incremental",
"full"
],
"expectations": [
"Inspect approved snapshots without executing application code. Indicators require runtime and policy context."
],
"collect": [
{
"id": "runtime-files",
"image": "",
"command": [
"python3",
"/collectors/inventory.py",
"--runtime",
"php"
],
"snapshot_paths": [
"."
],
"metadata_sources": [],
"required": true,
"signals": [
{
"id": "file-indicators",
"kind": "json_count_gt",
"pointer": "/items/0/indicator_count",
"value": 0
}
]
}
]
}
},
"schedule": {
"incremental": "*/5 * * * *",
"retrospective": "17 * * * *",
"full": "0 2 * * *"
},
"budget": {
"timeout_seconds": 30,
"max_output_bytes": 65536,
"max_files": 10000,
"max_snapshot_bytes": 67108864,
"model_input_bytes": 131072,
"model_output_bytes": 32768,
"max_file_bytes": 1048576
},
"access_policy": {
"version": "1",
"actions": {}
}
}
74 changes: 74 additions & 0 deletions nextcloud/metadata.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,3 +26,77 @@ mounts:
type: file
required: false
user: "33:33"

security_profile: {
"api_version": "flatrun.security-profile/v1",
"baseline_version": "1.0.0",
"version": "1.0.0",
"runtime": "php",
"targets": {
"source": {
"service": "app",
"roots": [
"/var/www/html"
],
"metadata_sources": [
"inventory"
]
}
},
"reviews": {
"runtime-files": {
"concern": "integrity",
"target": "source",
"runs": [
"incremental",
"full"
],
"expectations": [
"Inspect approved snapshots without executing application code. Indicators require runtime and policy context."
],
"collect": [
{
"id": "runtime-files",
"image": "",
"command": [
"python3",
"/collectors/inventory.py",
"--runtime",
"php"
],
"snapshot_paths": [
"."
],
"metadata_sources": [],
"required": true,
"signals": [
{
"id": "file-indicators",
"kind": "json_count_gt",
"pointer": "/items/0/indicator_count",
"value": 0
}
]
}
]
}
},
"schedule": {
"incremental": "*/5 * * * *",
"retrospective": "17 * * * *",
"full": "0 2 * * *"
},
"budget": {
"timeout_seconds": 30,
"max_output_bytes": 65536,
"max_files": 10000,
"max_snapshot_bytes": 67108864,
"model_input_bytes": 131072,
"model_output_bytes": 32768,
"max_file_bytes": 1048576
},
"access_policy": {
"version": "1",
"actions": {}
}
}
Loading
Loading