{
  "image": "sorcery-go-hardened-2026",
  "arch": "x86_64",
  "format": "iso",
  "security": {
    "firewall": "opensnitch",
    "mac": "ebpf",
    "ebpf_programs": {
      "tomb_guard": "pkg/warding/ebpf/c/tomb_guard.bpf.c",
      "sorcery_filter": "pkg/warding/ebpf/c/sorcery_filter.bpf.c"
    },
    "ebpf_enforce": true,
    "audit": "ebpf-perf",
    "runtime": "auto"
  },
  "supported_runtimes": {
    "lxc": {
      "description": "System containers via lxc-tools",
      "min_kernel": "4.15",
      "packages": ["lxc", "lxcfs"]
    },
    "podman": {
      "description": "OCI containers via Podman (rootless capable)",
      "min_kernel": "5.11",
      "packages": ["podman", "crun"]
    },
    "firecracker": {
      "description": "Lightweight microVMs via Firecracker",
      "min_kernel": "5.4",
      "packages": ["firecracker", "jailer"],
      "notes": "Provides VM-level isolation. eBPF cgroup filters do not apply to guest."
    },
    "baremetal": {
      "description": "Direct filesystem deployment (no container)",
      "min_kernel": "any",
      "packages": [],
      "notes": "eBPF LSM still protects the Tomb at kernel level."
    }
  },
  "essences": [
    "kernel-hardened-6.x.ess",
    "sorcery-go-engine.ess",
    "warding-monitor.ess",
    "legal-sentinel.ess"
  ],
  "sanctum_templates": {
    "web":  {
      "runtime": "podman",
      "image": "profile-restricted-net.ess",
      "memory_mb": 512,
      "caps": ["CAP_NET_BIND_SERVICE"]
    },
    "db":   {
      "runtime": "lxc",
      "image": "profile-no-net.ess",
      "memory_mb": 1024,
      "network": "none"
    },
    "edge": {
      "runtime": "firecracker",
      "image": "profile-aarch64-portable.ess",
      "vcpus": 1,
      "memory_mb": 256
    }
  },
  "compliance": {
    "posture": "strict_copyleft",
    "sbom_format": "cyclonedx",
    "auto_rebuild_on_cve": true
  },
  "portable_bin": {
    "include_emergency_kit": true,
    "static_linkage": "musl",
    "rebuild_interval_days": 30
  }
}