distribution/scan-worker/Containerfile
# The scan worker image (lane SANDBOX-SCAN). MINTED here, never pulled: it is
# FROM scratch, so building it needs no registry, and it crosses an airgap as an
# OCI archive (`cargo xtask scan-worker save`) with its sha256, like the intel
# bundle. One static (musl) program: holger-scan-worker.
#
# cargo xtask scan-worker image # build the musl worker, then this image
# cargo xtask scan-worker save --out <dir>
# podman load -i <dir>/holger-scan-worker.oci.tar # on the secure side
#
# The sandbox runs it with --network none, a read-only root, a capped tmpfs at
# /scratch, no capabilities, no-new-privileges and uid 65532 (see holger-sandbox).
FROM scratch
COPY --chmod=0555 holger-scan-worker /holger-scan-worker
COPY passwd /etc/passwd
COPY group /etc/group
USER 65532:65532
ENV HOME=/scratch TMPDIR=/scratch
ENTRYPOINT ["/holger-scan-worker"]
CMD ["/in"]