76 lines
2.0 KiB
JSON
Executable File
76 lines
2.0 KiB
JSON
Executable File
{
|
|
"image": "sorcery-go-hardened-2026",
|
|
"arch": "x86_64",
|
|
"format": "iso",
|
|
"security": {
|
|
"firewall": "opensnitch",
|
|
"mac": "ebpf",
|
|
"ebpf_programs": {
|
|
"tomb_guard": "pkg/warding/ebpf/c/tomb_guard.bpf.c",
|
|
"sorcery_filter": "pkg/warding/ebpf/c/sorcery_filter.bpf.c"
|
|
},
|
|
"ebpf_enforce": true,
|
|
"audit": "ebpf-perf",
|
|
"runtime": "auto"
|
|
},
|
|
"supported_runtimes": {
|
|
"lxc": {
|
|
"description": "System containers via lxc-tools",
|
|
"min_kernel": "4.15",
|
|
"packages": ["lxc", "lxcfs"]
|
|
},
|
|
"podman": {
|
|
"description": "OCI containers via Podman (rootless capable)",
|
|
"min_kernel": "5.11",
|
|
"packages": ["podman", "crun"]
|
|
},
|
|
"firecracker": {
|
|
"description": "Lightweight microVMs via Firecracker",
|
|
"min_kernel": "5.4",
|
|
"packages": ["firecracker", "jailer"],
|
|
"notes": "Provides VM-level isolation. eBPF cgroup filters do not apply to guest."
|
|
},
|
|
"baremetal": {
|
|
"description": "Direct filesystem deployment (no container)",
|
|
"min_kernel": "any",
|
|
"packages": [],
|
|
"notes": "eBPF LSM still protects the Tomb at kernel level."
|
|
}
|
|
},
|
|
"essences": [
|
|
"kernel-hardened-6.x.ess",
|
|
"sorcery-go-engine.ess",
|
|
"warding-monitor.ess",
|
|
"legal-sentinel.ess"
|
|
],
|
|
"sanctum_templates": {
|
|
"web": {
|
|
"runtime": "podman",
|
|
"image": "profile-restricted-net.ess",
|
|
"memory_mb": 512,
|
|
"caps": ["CAP_NET_BIND_SERVICE"]
|
|
},
|
|
"db": {
|
|
"runtime": "lxc",
|
|
"image": "profile-no-net.ess",
|
|
"memory_mb": 1024,
|
|
"network": "none"
|
|
},
|
|
"edge": {
|
|
"runtime": "firecracker",
|
|
"image": "profile-aarch64-portable.ess",
|
|
"vcpus": 1,
|
|
"memory_mb": 256
|
|
}
|
|
},
|
|
"compliance": {
|
|
"posture": "strict_copyleft",
|
|
"sbom_format": "cyclonedx",
|
|
"auto_rebuild_on_cve": true
|
|
},
|
|
"portable_bin": {
|
|
"include_emergency_kit": true,
|
|
"static_linkage": "musl",
|
|
"rebuild_interval_days": 30
|
|
}
|
|
} |