server/sandbox/Cargo.toml
[package]
name = "holger-sandbox"
version = "5.0.0"
edition = "2021"
authors = ["Ignalina ApS", "Vetra Automation AB"]
description = "Holger's scan sandbox: runs the scan worker over one artifact in a hardened rootless podman container (no network, read-only artifact and rootfs, capped tmpfs scratch, CPU/memory/pids limits, a wall-clock timeout, no capabilities, no-new-privileges, a non-root user) and hands back only its capped stdout. Fails closed, by name, when no engine is there."
license = "AGPL-3.0-only"
repository = "https://git.gunnar.rs/nordisk/holger"
categories = ["development-tools"]
keywords = ["airgap", "sandbox", "podman", "scanning"]
# NETWORK-FREE: it starts `podman` (local, or over its socket with `--url`), `crun`,
# or asks a scan-worker sidecar over a unix socket (`engine: remote`), and
# reads pipes. Every dependency is already in holger's Cargo.lock.
[dependencies]
serde = { version = "1", features = ["derive"] }
# The libpod create spec and its replies (the API-socket engine).
serde_json = "1"
holger-errcode = { version = "3.1.2", path = "../../errcode" }
# Non-blocking pipes, so one thread reads stdout and stderr under a deadline.
rustix = { version = "1.1", default-features = false, features = ["fs", "std", "process", "thread"] }
tempfile = "3"
# The sandbox on the medium (lane HOLGER-MEDIA): the worker's rootfs as a tar, each
# entry's sha256 checked at boot.
tar = "0.4"
sha2 = "0.11"
[dev-dependencies]
ron = "0.12"
toml = "1"
[[test]]
name = "live_podman"