Use this reference with Sonny 0.12.7. It combines 260 fields from three embedded schemas and the public Sonny/native-machine types. The release uses devnw.dev/isolation 0.14.1. These are configuration contracts, not evidence that a machine has a working Docker, native or VM realm. Read privacy and permissions for authority boundaries and the operator check for the actual service identity’s verified posture and cleanup.

Choose the correct document

DocumentPurposeRelease reference
Complete isolation.yamlSonny mode, floor, mechanism, policy and evidence windowsTen source-derived wrapper fields and raw printed defaults
Nested policy objectAllowed mechanisms, resources, network, files, environment and lifecyclePolicy schema , 174 fields
Docker machine trustReviewed engine endpoint, pinned image, security files and host keysDocker machine schema , 32 fields
Native Linux machine trustPinned runtime/init/rootfs, delegated cgroup and subordinate IDs, host keys22 source-derived fields; not the Docker machine schema
Docker image statementSigned supply-chain and runtime-fact documentImage-statement schema , 22 fields

Download the complete field index . The schema files preserve the installed exports byte-for-byte. Their $id values identify schema contracts; the download links above are the checked locations for this documentation release. Do not substitute one document for another just because several contain a version or digest.

These installed commands print data without starting an isolation backend:

sonny isolation defaults --json
sonny isolation policy-schema
sonny isolation machine-schema
sonny isolation image-statement-schema

Each tested command exited 0, printed a direct JSON object and had empty stderr. machine-schema exports Docker version-2 machine trust; it is not a generic schema for every backend. The complete isolation file and native machine file use version 1. Schema validity alone does not read a protected file, verify an executable or image identity, provision a realm, or prove cleanup.

Read the defaults and the schema separately

The installed defaults --json prints mode: off and minimum_mode: off, with an auto backend selection and Docker-oriented policy defaults. Those are the constructor/export values, not a statement about every invocation or service: trusted files, project narrowing, invocation overrides and a selected backend determine the resolved posture. Do not change a floor to match an example or use an off setting as a fix for a refused tool.

The raw defaults’ nested policy does not pass the exported policy schema: twelve empty collections print as null, while their schema types require arrays. Runtime decoding accepted those same defaults. The failed positive schema expectation remains in the qualification record. A separate synthetic fixture with explicit empty arrays passed both the schema and the runtime decoder; it provisioned no machine trust or backend. The download intentionally keeps the actual export, rather than silently rewriting it into a deployment template. The affected fields below identify the mismatch.

Docker has a separate compatibility boundary: the runtime decoder accepted version-1 machine input and migrated it to version 2, supplying revocation epoch 1 when the legacy input omitted it. The current schema refused that v1 input. This is a measured migration path, not permission to downgrade or omit the current revocation floor. The v2 decoder refused an explicit zero floor. A relative state path passed the machine schema’s string shape but was refused by the runtime’s absolute-path check. Schema acceptance is therefore weaker than complete runtime admission.

Files, precedence and trust

These files are separate from the root .sonny.yaml and its automatic environment bindings. There are no generic per-field SONNY_* environment overrides for the fields below. Configuration-directory selection follows the platform path rules .

Isolation policy starts with the selected backend’s base, then organization, machine and user isolation.yaml layers. Linux machine paths are /etc/sonny/isolation.yaml and /usr/local/etc/sonny/isolation.yaml; macOS uses /Library/Application Support/sonny/isolation.yaml, and Windows uses %ProgramData%\sonny\isolation.yaml. These platform paths come from source; the executed tests here are Linux only. The user layer is <config>/isolation.yaml. Trusted policy files may be readable by others, but only the owner or an administrator may modify them; symlink/unsafe-file and size checks still apply.

Project .sonny/isolation.yaml files in the workspace’s discovered directory chain are untrusted complete narrowing layers. They can intersect policy and strengthen a floor; they cannot redirect the host-selected mechanism, reduce requested mode/assurance or widen inherited capabilities. The explicit --isolation-policy file is another protected layer. A Recipe or downloaded repository cannot establish machine trust by declaring these fields.

For sonny run, --isolation-mode, --isolation-backend and --isolation-assurance request bounded overrides. For isolation doctor and isolation explain, the command-local forms are --mode, --backend and --assurance, with --policy and --machine path selectors. Check the canonical command inventory for the specific command; these options are not accepted on every export command.

Docker machine trust defaults to <config>/isolation-docker.yaml; the explicit run --isolation-machine / inspection --machine path selects that Docker file. Native selection reads <config>/isolation-native.yaml through its separate resolver. Do not assume the Docker path override selects native trust. Machine trust uses a private protected-file reader. The native source tests accepted an owned 0600 file and refused 0644; this is stricter than the readable-by-others permission policy described in the trusted-permissions reference .

Native shape and application limits

Native runtime/init paths, rootfs/state directories and key paths must be absolute and clean. Runtime/init/rootfs digests must pass the release digest validator. The cgroup path must be a delegated directory beneath /sys/fs/cgroup, not that root itself. io_device has an unsigned major:minor shape. Each subordinate-ID map has a nonzero host ID, at least 65,536 IDs, and an end no greater than 2³². The key ID must be nonempty. Admission of those shapes does not prove the files exist, match their digests, or can create the required boundaries.

Source checks exercised unknown keys, wrong versions, invalid modes, narrowed floors, stale evidence bounds, path/digest/ID-map refusals and legacy Docker migration. They compiled all three embedded schemas with an ECMAScript regex engine. The 47-case matrix has 54 matching assertions and the one retained raw-default/schema positive failure. Thirty-one focused source test/subtest events passed. No container, VM, native realm, registry or model was started by these configuration/export probes.

Changes apply when a process/session resolves and constructs its isolation runtime. Editing a file does not establish that an existing realm reloaded it. Use actual posture, exposure, boundary and cleanup evidence before attributing containment to a configured value. Image-statement syntax does not verify its signature, signer authorization, revocation epoch or freshness.

Field records

Required-member and conditional rules below come from the embedded schemas. The complete wrapper and native-machine rows come from public types and runtime validation; no JSON Schema is invented for them. Default values are from the installed raw export, while an absent machine file or array item has no configured default. The common file/trust/precedence/application rules above apply to every field in its document. Group prefixes identify the document; they are not extra wrapper keys to add to a file. For example, native-machine.runtime is the native file’s runtime object, and isolation.yaml.mode means the mode field in the complete isolation file. On narrow screens, scroll each field table sideways to compare columns. Keyboard users can focus the named table region and use Left/Right arrows.

isolation.yaml — 10 fields

Contract source: isolationruntime.Config.

Fields in isolation.yaml; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
versionintegerComplete source-validated file; consult the runtime rules above.

Exported default: 1.

The complete isolation file requires version 1; this is separate from the policy and machine-schema versions.

modestringComplete source-validated file; consult the runtime rules above.

Exported default: "off".

off, preferred or required. A requested mode below minimum_mode is refused. The printed constructor default is off; resolved invocation/service posture can differ.

Run override: --isolation-mode, subject to inherited limits.

minimum_modestringComplete source-validated file; consult the runtime rules above.

Exported default: "off".

off, preferred or required; composed layers preserve the strongest floor.

backendstringComplete source-validated file; consult the runtime rules above.

Exported default: "auto".

auto, native, docker or vm are declared selections; declaration does not establish availability or policy admission.

Run override: --isolation-backend, subject to inherited limits.

assurancestringComplete source-validated file; consult the runtime rules above.

Exported default: "docker".

guarded, native, docker or vm; validated against the requested runtime and inherited policy.

Run override: --isolation-assurance, subject to inherited limits.

workspace_modestringComplete source-validated file; consult the runtime rules above.

Exported default: "copy".

copy, bind or volume; project narrowing cannot redirect the host-selected mechanism.

policy_profilestringComplete source-validated file; consult the runtime rules above.

Exported default: "sonny-default-docker".

Nonempty profile identity; this is not a flag selecting an arbitrary ready machine trust bundle.

policyobjectComplete source-validated file; consult the runtime rules above.

Exported default: object; inspect its child fields or the full defaults download.

The complete versioned policy object below. Its syntax/schema acceptance is separate from a verified realm.

evidence_max_age_msintegerComplete source-validated file; consult the runtime rules above.

Exported default: 300000.

Positive milliseconds. Resolution chooses the narrowest inherited window.

clock_skew_msintegerComplete source-validated file; consult the runtime rules above.

Exported default: 30000.

Nonnegative milliseconds, no greater than evidence_max_age_ms; inherited windows may narrow.

policy — 14 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
versionintegerRequired by this schema object.

Exported default: 1.

{
  "const": 1
}
namestringNot required by this schema object.

Exported default: "sonny-default-docker".

{
  "minLength": 1
}
allowed_backendsarrayNot required by this schema object.

Exported default: ["docker"].

{
  "minItems": 1,
  "uniqueItems": true
}

Array-item contract:

{
  "enum": [
    "guarded",
    "native",
    "docker",
    "vm"
  ]
}
backend_preferencearrayNot required by this schema object.

Exported default: ["docker"].

{
  "minItems": 1,
  "uniqueItems": true
}

Array-item contract:

{
  "enum": [
    "guarded",
    "native",
    "docker",
    "vm"
  ]
}
required_assurancestringNot required by this schema object.

Exported default: "docker".

{
  "enum": [
    "guarded",
    "native",
    "docker",
    "vm"
  ]
}
required_featuresarrayNot required by this schema object.

Exported default: ["capability-drop","clean-environment","docker-api","kill-to-empty","network-namespace","no-new-privileges","opaque-secrets","read-only-root","reviewed-export","seccomp","signed-attestation","user-namespace","verified-rootfs","worker-auth"].

{
  "uniqueItems": true
}

Array-item contract:

{
  "enum": [
    "app-container",
    "capability-drop",
    "cgroup-v2",
    "clean-environment",
    "docker-api",
    "docker-rootless",
    "hyper-v",
    "job-object",
    "kill-to-empty",
    "lsm",
    "mount-namespace",
    "network-namespace",
    "no-new-privileges",
    "opaque-secrets",
    "pid-namespace",
    "read-only-root",
    "reviewed-export",
    "seccomp",
    "signed-attestation",
    "user-namespace",
    "verified-rootfs",
    "virtualization-framework",
    "vm-guest-auth",
    "worker-auth"
  ]
}
allowed_workspace_modesarrayNot required by this schema object.

Exported default: ["copy"].

{
  "minItems": 1,
  "uniqueItems": true
}

Array-item contract:

{
  "enum": [
    "copy",
    "bind",
    "volume"
  ]
}
resourcesobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": false
}
networkobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": false
}
filesystemobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": false
}
environmentobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": false
}
outputobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": false
}
lifecycleobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": false
}
dockerobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": false
}
policy.docker — 11 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy.docker; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
versionintegerNot required by this schema object.

Exported default: 1.

{
  "const": 1
}
endpointobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": false
}
imageobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": false
}
workspaceobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": false
}
processobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": false
}
filesystemobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": false
}
resourcesobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": false
}
securityobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": false
}
networkobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": false
}
lifecycleobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": false
}
observabilityobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": false
}
policy.docker.endpoint — 10 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy.docker.endpoint; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
allowed_classesarrayNot required by this schema object.

Exported default: ["local-rootless"].

{
  "uniqueItems": true
}

Array-item contract:

{
  "type": "string"
}
allowed_identitiesarrayNot required by this schema object.

Exported default: null.

The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.

{
  "uniqueItems": true
}

Array-item contract:

{
  "type": "string"
}
api_minstringNot required by this schema object.

Exported default: "1.44".

api_maxstringNot required by this schema object.

Exported default: "1.51".

require_rootlessbooleanNot required by this schema object.

Exported default: true.

allow_rootfulbooleanNot required by this schema object.

Exported default: false.

allow_remotebooleanNot required by this schema object.

Exported default: false.

allowed_wsl_distrosarrayNot required by this schema object.

Exported default: null.

The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.

{
  "uniqueItems": true
}

Array-item contract:

{
  "type": "string"
}
connect_timeout_millisintegerNot required by this schema object.

Exported default: 5000.

{
  "minimum": 1
}
start_timeout_millisintegerNot required by this schema object.

Exported default: 60000.

{
  "minimum": 1
}
policy.docker.filesystem — 7 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy.docker.filesystem; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
read_only_rootbooleanNot required by this schema object.

Exported default: true.

tmpfsobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": {
    "$ref": "#/$defs/positiveInteger"
  }
}
masked_pathsarrayNot required by this schema object.

Exported default: ["/proc/kcore","/proc/keys","/proc/timer_list"].

{
  "uniqueItems": true
}

Array-item contract:

{
  "type": "string"
}
read_only_pathsarrayNot required by this schema object.

Exported default: ["/proc/sys","/sys"].

{
  "uniqueItems": true
}

Array-item contract:

{
  "type": "string"
}
max_writable_bytesintegerNot required by this schema object.

Exported default: 536870912.

{
  "minimum": 1
}
allowed_volume_driversarrayNot required by this schema object.

Exported default: null.

The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.

{
  "uniqueItems": true
}

Array-item contract:

{
  "type": "string"
}
private_propagationbooleanNot required by this schema object.

Exported default: true.

policy.docker.image — 13 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy.docker.image; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
allowed_referencesarrayNot required by this schema object.

Exported default: null.

The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.

{
  "uniqueItems": true
}

Array-item contract:

{
  "type": "string"
}
allowed_registriesarrayNot required by this schema object.

Exported default: null.

The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.

{
  "uniqueItems": true
}

Array-item contract:

{
  "type": "string"
}
allowed_platformsarrayNot required by this schema object.

Exported default: null.

The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.

{
  "uniqueItems": true
}

Array-item contract:

{
  "type": "string"
}
pull_policystringNot required by this schema object.

Exported default: "if-not-present".

{
  "enum": [
    "never",
    "if-not-present",
    "always",
    "digest-refresh"
  ]
}
allow_localbooleanNot required by this schema object.

Exported default: false.

require_digestbooleanNot required by this schema object.

Exported default: true.

require_signaturebooleanNot required by this schema object.

Exported default: true.

require_provenancebooleanNot required by this schema object.

Exported default: true.

require_sbombooleanNot required by this schema object.

Exported default: true.

max_vulnerabilitystringNot required by this schema object.

Exported default: "medium".

{
  "enum": [
    "none",
    "low",
    "medium",
    "high",
    "critical"
  ]
}
max_age_millisintegerNot required by this schema object.

Exported default: 2592000000.

{
  "minimum": 1
}
max_unpacked_bytesintegerNot required by this schema object.

Exported default: 2147483648.

{
  "minimum": 1
}
emergency_deny_digestsarrayNot required by this schema object.

Exported default: null.

The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.

{
  "uniqueItems": true
}

Array-item contract:

{
  "type": "string"
}
policy.docker.lifecycle — 8 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy.docker.lifecycle; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
lease_millisintegerNot required by this schema object.

Exported default: 600000.

{
  "minimum": 1
}
heartbeat_millisintegerNot required by this schema object.

Exported default: 30000.

{
  "minimum": 1
}
start_millisintegerNot required by this schema object.

Exported default: 60000.

{
  "minimum": 1
}
stop_millisintegerNot required by this schema object.

Exported default: 10000.

{
  "minimum": 1
}
remove_millisintegerNot required by this schema object.

Exported default: 30000.

{
  "minimum": 1
}
readiness_millisintegerNot required by this schema object.

Exported default: 30000.

{
  "minimum": 1
}
reconcile_millisintegerNot required by this schema object.

Exported default: 60000.

{
  "minimum": 1
}
retention_millisintegerNot required by this schema object.

Exported default: 86400000.

{
  "minimum": 1
}
policy.docker.network — 8 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy.docker.network; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
modestringNot required by this schema object.

Exported default: "none".

{
  "enum": [
    "none",
    "proxy-only",
    "allowlist"
  ]
}
rulesarrayNot required by this schema object.

Exported default: null.

The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.

{
  "uniqueItems": true
}

Array-item contract:

{
  "additionalProperties": false,
  "type": "object"
}
dedicatedbooleanNot required by this schema object.

Exported default: true.

allow_published_portsbooleanNot required by this schema object.

Exported default: false.

allow_extra_hostsbooleanNot required by this schema object.

Exported default: false.

allow_host_gatewaybooleanNot required by this schema object.

Exported default: false.

max_bytesintegerNot required by this schema object.

Exported default: 1.

{
  "minimum": 1
}
max_connectionsintegerNot required by this schema object.

Exported default: 1.

{
  "minimum": 1
}
policy.docker.network.rules[] — 3 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy.docker.network.rules[]; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
hoststringNot required by this schema object.

No configured default object/item or machine trust file.

{
  "minLength": 1
}
portintegerNot required by this schema object.

No configured default object/item or machine trust file.

{
  "maximum": 65535,
  "minimum": 1
}
protocolstringNot required by this schema object.

No configured default object/item or machine trust file.

{
  "enum": [
    "tcp",
    "udp"
  ]
}
policy.docker.observability — 7 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy.docker.observability; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
capture_eventsbooleanNot required by this schema object.

Exported default: true.

capture_statsbooleanNot required by this schema object.

Exported default: true.

auditbooleanNot required by this schema object.

Exported default: true.

attestbooleanNot required by this schema object.

Exported default: true.

redactbooleanNot required by this schema object.

Exported default: true.

max_event_bytesintegerNot required by this schema object.

Exported default: 33554432.

{
  "minimum": 1
}
max_support_bundle_bytesintegerNot required by this schema object.

Exported default: 134217728.

{
  "minimum": 1
}
policy.docker.process — 11 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy.docker.process; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
entrypointarrayNot required by this schema object.

Exported default: ["/usr/local/bin/sonny","isolation-worker","daemon"].

{
  "minItems": 1
}

Array-item contract:

{
  "type": "string"
}
workdirstringNot required by this schema object.

Exported default: "/workspace".

{
  "pattern": "^/"
}
uidintegerNot required by this schema object.

Exported default: 65532.

{
  "minimum": 1
}
gidintegerNot required by this schema object.

Exported default: 65532.

{
  "minimum": 1
}
groupsarrayNot required by this schema object.

Exported default: null.

The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.

{
  "uniqueItems": true
}

Array-item contract:

{
  "minimum": 0,
  "type": "integer"
}
environmentobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": {
    "type": "string"
  }
}
initbooleanNot required by this schema object.

Exported default: true.

allow_ptybooleanNot required by this schema object.

Exported default: true.

deadline_millisintegerNot required by this schema object.

Exported default: 300000.

{
  "minimum": 1
}
stop_grace_millisintegerNot required by this schema object.

Exported default: 5000.

{
  "minimum": 1
}
output_bytesintegerNot required by this schema object.

Exported default: 25165824.

{
  "minimum": 1
}
policy.docker.resources — 10 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy.docker.resources; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
cpu_quota_millisintegerNot required by this schema object.

Exported default: 1000.

{
  "minimum": 1
}
memory_bytesintegerNot required by this schema object.

Exported default: 536870912.

{
  "minimum": 1
}
memory_swap_bytesintegerNot required by this schema object.

Exported default: 536870912.

{
  "minimum": 1
}
pidsintegerNot required by this schema object.

Exported default: 64.

{
  "minimum": 1
}
open_filesintegerNot required by this schema object.

Exported default: 256.

{
  "minimum": 1
}
shared_memory_bytesintegerNot required by this schema object.

Exported default: 67108864.

{
  "minimum": 1
}
disk_bytesintegerNot required by this schema object.

Exported default: 1073741824.

{
  "minimum": 1
}
log_bytesintegerNot required by this schema object.

Exported default: 33554432.

{
  "minimum": 1
}
runtime_millisintegerNot required by this schema object.

Exported default: 300000.

{
  "minimum": 1
}
concurrent_execsintegerNot required by this schema object.

Exported default: 8.

{
  "minimum": 1
}
policy.docker.security — 12 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy.docker.security; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
privilegedbooleanNot required by this schema object.

Exported default: false.

capability_addarrayNot required by this schema object.

Exported default: null.

The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.

{
  "uniqueItems": true
}

Array-item contract:

{
  "type": "string"
}
no_new_privilegesbooleanNot required by this schema object.

Exported default: true.

seccomp_profilestringNot required by this schema object.

Exported default: "sonny-default".

lsm_profilestringNot required by this schema object.

Exported default: "".

user_namespacestringNot required by this schema object.

Exported default: "private".

runtimestringNot required by this schema object.

Exported default: "".

allow_devicesbooleanNot required by this schema object.

Exported default: false.

allowed_sysctlsarrayNot required by this schema object.

Exported default: null.

The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.

{
  "uniqueItems": true
}

Array-item contract:

{
  "type": "string"
}
allow_host_pidbooleanNot required by this schema object.

Exported default: false.

allow_host_ipcbooleanNot required by this schema object.

Exported default: false.

allow_host_networkbooleanNot required by this schema object.

Exported default: false.

policy.docker.workspace — 6 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy.docker.workspace; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
container_pathstringNot required by this schema object.

Exported default: "/workspace".

{
  "pattern": "^/"
}
modestringNot required by this schema object.

Exported default: "copy".

{
  "enum": [
    "copy",
    "bind",
    "volume"
  ]
}
read_onlybooleanNot required by this schema object.

Exported default: false.

max_bytesintegerNot required by this schema object.

Exported default: 536870912.

{
  "minimum": 1
}
max_filesintegerNot required by this schema object.

Exported default: 100000.

{
  "minimum": 1
}
review_exportbooleanNot required by this schema object.

Exported default: true.

policy.environment — 4 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy.environment; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
allowarrayNot required by this schema object.

Exported default: ["LANG","LC_ALL","PATH","TERM","TZ"].

{
  "uniqueItems": true
}

Array-item contract:

{
  "type": "string"
}
denyarrayNot required by this schema object.

Exported default: ["BASH_ENV","DOCKER_CONFIG","ENV","GIT_ASKPASS","HOME","LD_PRELOAD","NODE_OPTIONS","PYTHONPATH","SSH_AUTH_SOCK"].

{
  "uniqueItems": true
}

Array-item contract:

{
  "type": "string"
}
valuesobjectNot required by this schema object.

Exported default: object; inspect its child fields or the full defaults download.

{
  "additionalProperties": {
    "type": "string"
  }
}
max_bytesintegerNot required by this schema object.

Exported default: 32768.

{
  "minimum": 1
}
policy.filesystem — 14 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy.filesystem; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
read_only_rootbooleanNot required by this schema object.

Exported default: true.

import_rootsarrayNot required by this schema object.

Exported default: ["/workspace"].

{
  "uniqueItems": true
}

Array-item contract:

{
  "type": "string"
}
export_rootsarrayNot required by this schema object.

Exported default: ["/workspace"].

{
  "uniqueItems": true
}

Array-item contract:

{
  "type": "string"
}
read_only_pathsarrayNot required by this schema object.

Exported default: ["/proc/sys","/sys"].

{
  "uniqueItems": true
}

Array-item contract:

{
  "type": "string"
}
masked_pathsarrayNot required by this schema object.

Exported default: ["/proc/kcore","/proc/keys","/proc/timer_list"].

{
  "uniqueItems": true
}

Array-item contract:

{
  "type": "string"
}
max_import_bytesintegerNot required by this schema object.

Exported default: 536870912.

{
  "minimum": 1
}
max_import_filesintegerNot required by this schema object.

Exported default: 100000.

{
  "minimum": 1
}
max_export_bytesintegerNot required by this schema object.

Exported default: 536870912.

{
  "minimum": 1
}
max_export_filesintegerNot required by this schema object.

Exported default: 100000.

{
  "minimum": 1
}
tmpfs_bytesintegerNot required by this schema object.

Exported default: 67108864.

{
  "minimum": 1
}
scratch_bytesintegerNot required by this schema object.

Exported default: 268435456.

{
  "maximum": 8589934592,
  "minimum": 1
}
exec_scratchbooleanNot required by this schema object.

Exported default: false.

{
  "default": false
}
require_reviewbooleanNot required by this schema object.

Exported default: true.

reject_special_filesbooleanNot required by this schema object.

Exported default: true.

policy.lifecycle — 8 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy.lifecycle; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
lease_millisintegerNot required by this schema object.

Exported default: 600000.

{
  "minimum": 1
}
heartbeat_millisintegerNot required by this schema object.

Exported default: 30000.

{
  "minimum": 1
}
create_millisintegerNot required by this schema object.

Exported default: 60000.

{
  "minimum": 1
}
start_millisintegerNot required by this schema object.

Exported default: 60000.

{
  "minimum": 1
}
stop_grace_millisintegerNot required by this schema object.

Exported default: 5000.

{
  "minimum": 1
}
close_millisintegerNot required by this schema object.

Exported default: 30000.

{
  "minimum": 1
}
reconcile_millisintegerNot required by this schema object.

Exported default: 60000.

{
  "minimum": 1
}
retention_millisintegerNot required by this schema object.

Exported default: 86400000.

{
  "minimum": 1
}
policy.network — 6 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy.network; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
modestringNot required by this schema object.

Exported default: "none".

{
  "enum": [
    "none",
    "proxy-only",
    "allowlist"
  ]
}
rulesarrayNot required by this schema object.

Exported default: null.

The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.

{
  "uniqueItems": true
}

Array-item contract:

{
  "additionalProperties": false,
  "type": "object"
}
allow_ipv4booleanNot required by this schema object.

Exported default: false.

allow_ipv6booleanNot required by this schema object.

Exported default: false.

allow_published_portsbooleanNot required by this schema object.

Exported default: false.

allow_extra_hostsbooleanNot required by this schema object.

Exported default: false.

policy.network.rules[] — 3 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy.network.rules[]; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
hoststringNot required by this schema object.

No configured default object/item or machine trust file.

{
  "minLength": 1
}
portintegerNot required by this schema object.

No configured default object/item or machine trust file.

{
  "maximum": 65535,
  "minimum": 1
}
protocolstringNot required by this schema object.

No configured default object/item or machine trust file.

{
  "enum": [
    "tcp",
    "udp"
  ]
}
policy.output — 4 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy.output; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
stdout_bytesintegerNot required by this schema object.

Exported default: 16777216.

{
  "minimum": 1
}
stderr_bytesintegerNot required by this schema object.

Exported default: 16777216.

{
  "minimum": 1
}
combined_bytesintegerNot required by this schema object.

Exported default: 25165824.

{
  "minimum": 1
}
log_bytesintegerNot required by this schema object.

Exported default: 33554432.

{
  "minimum": 1
}
policy.resources — 15 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in policy.resources; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
cpu_quota_millisintegerNot required by this schema object.

Exported default: 1000.

{
  "minimum": 1
}
memory_bytesintegerNot required by this schema object.

Exported default: 536870912.

{
  "minimum": 1
}
memory_swap_bytesintegerNot required by this schema object.

Exported default: 536870912.

{
  "minimum": 1
}
pidsintegerNot required by this schema object.

Exported default: 64.

{
  "minimum": 1
}
open_filesintegerNot required by this schema object.

Exported default: 256.

{
  "minimum": 1
}
locked_memory_bytesintegerNot required by this schema object.

Exported default: 0.

{
  "minimum": 0
}
shared_memory_bytesintegerNot required by this schema object.

Exported default: 67108864.

{
  "minimum": 1
}
read_bytesintegerNot required by this schema object.

Exported default: 1073741824.

{
  "minimum": 1
}
write_bytesintegerNot required by this schema object.

Exported default: 536870912.

{
  "minimum": 1
}
disk_bytesintegerNot required by this schema object.

Exported default: 1073741824.

{
  "minimum": 1
}
runtime_millisintegerNot required by this schema object.

Exported default: 300000.

{
  "minimum": 1
}
concurrent_cellsintegerNot required by this schema object.

Exported default: 8.

{
  "minimum": 1
}
concurrent_processesintegerNot required by this schema object.

Exported default: 64.

{
  "minimum": 1
}
network_bytesintegerNot required by this schema object.

Exported default: 1.

{
  "minimum": 1
}
network_connectionsintegerNot required by this schema object.

Exported default: 1.

{
  "minimum": 1
}
docker-machine — 9 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in docker-machine; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
versionintegerRequired by this schema object.

No configured default object/item or machine trust file.

{
  "const": 2
}
endpointobjectRequired by this schema object.

No configured default object/item or machine trust file.

{
  "additionalProperties": false,
  "allOf": [
    {
      "not": {
        "properties": {
          "allow_rootful": {
            "const": true
          },
          "require_rootless": {
            "const": true
          }
        },
        "required": [
          "require_rootless",
          "allow_rootful"
        ]
      }
    },
    {
      "if": {
        "properties": {
          "class": {
            "const": "wsl"
          }
        },
        "required": [
          "class"
        ]
      },
      "then": {
        "required": [
          "wsl_distribution"
        ]
      }
    },
    {
      "if": {
        "properties": {
          "class": {
            "const": "remote-mtls"
          }
        },
        "required": [
          "class"
        ]
      },
      "then": {
        "required": [
          "tls_ca_file",
          "tls_cert_file",
          "tls_key_file",
          "tls_server_name"
        ]
      }
    }
  ]
}
imageobjectRequired by this schema object.

No configured default object/item or machine trust file.

{
  "additionalProperties": false
}
securityobjectRequired by this schema object.

No configured default object/item or machine trust file.

{
  "additionalProperties": false,
  "dependentRequired": {
    "lsm_name": [
      "lsm_option"
    ],
    "lsm_option": [
      "lsm_name"
    ]
  }
}
state_directorystringRequired by this schema object.

No configured default object/item or machine trust file.

Absolute, clean host path; runtime validation is OS-specific.

{
  "maxLength": 4096,
  "minLength": 1
}
issuer_key_filestringRequired by this schema object.

No configured default object/item or machine trust file.

Absolute, clean host path; runtime validation is OS-specific.

{
  "maxLength": 4096,
  "minLength": 1
}
attestation_key_idstringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "maxLength": 256,
  "minLength": 1
}
attestation_key_filestringRequired by this schema object.

No configured default object/item or machine trust file.

Absolute, clean host path; runtime validation is OS-specific.

{
  "maxLength": 4096,
  "minLength": 1
}
journal_max_bytesintegerRequired by this schema object.

No configured default object/item or machine trust file.

{
  "maximum": 67108864,
  "minimum": 1
}
docker-machine.endpoint — 12 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Additional object conditions:

[
  {
    "not": {
      "properties": {
        "allow_rootful": {
          "const": true
        },
        "require_rootless": {
          "const": true
        }
      },
      "required": [
        "require_rootless",
        "allow_rootful"
      ]
    }
  },
  {
    "if": {
      "properties": {
        "class": {
          "const": "wsl"
        }
      },
      "required": [
        "class"
      ]
    },
    "then": {
      "required": [
        "wsl_distribution"
      ]
    }
  },
  {
    "if": {
      "properties": {
        "class": {
          "const": "remote-mtls"
        }
      },
      "required": [
        "class"
      ]
    },
    "then": {
      "required": [
        "tls_ca_file",
        "tls_cert_file",
        "tls_key_file",
        "tls_server_name"
      ]
    }
  }
]
Fields in docker-machine.endpoint; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
classstringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "enum": [
    "local-rootless",
    "local-socket",
    "macos-desktop",
    "windows-pipe",
    "wsl",
    "remote-mtls"
  ]
}
addressstringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "maxLength": 4096,
  "minLength": 1
}
identitystringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "maxLength": 256,
  "minLength": 1
}
api_minstringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "maxLength": 32,
  "minLength": 1
}
api_maxstringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "maxLength": 32,
  "minLength": 1
}
require_rootlessbooleanRequired by this schema object.

No configured default object/item or machine trust file.

allow_rootfulbooleanRequired by this schema object.

No configured default object/item or machine trust file.

wsl_distributionstringNot required by this schema object.

No configured default object/item or machine trust file.

{
  "maxLength": 256,
  "minLength": 1
}
tls_ca_filestringNot required by this schema object.

No configured default object/item or machine trust file.

Absolute, clean host path; runtime validation is OS-specific.

{
  "maxLength": 4096,
  "minLength": 1
}
tls_cert_filestringNot required by this schema object.

No configured default object/item or machine trust file.

Absolute, clean host path; runtime validation is OS-specific.

{
  "maxLength": 4096,
  "minLength": 1
}
tls_key_filestringNot required by this schema object.

No configured default object/item or machine trust file.

Absolute, clean host path; runtime validation is OS-specific.

{
  "maxLength": 4096,
  "minLength": 1
}
tls_server_namestringNot required by this schema object.

No configured default object/item or machine trust file.

{
  "maxLength": 253,
  "minLength": 1
}
docker-machine.image — 7 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in docker-machine.image; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
referencestringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "maxLength": 4096,
  "pattern": "@sha256:[a-f0-9]{64}$"
}
statement_filestringRequired by this schema object.

No configured default object/item or machine trust file.

Absolute, clean host path; runtime validation is OS-specific.

{
  "maxLength": 4096,
  "minLength": 1
}
signature_filestringRequired by this schema object.

No configured default object/item or machine trust file.

Absolute, clean host path; runtime validation is OS-specific.

{
  "maxLength": 4096,
  "minLength": 1
}
public_key_filestringRequired by this schema object.

No configured default object/item or machine trust file.

Absolute, clean host path; runtime validation is OS-specific.

{
  "maxLength": 4096,
  "minLength": 1
}
trusted_key_idstringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "maxLength": 256,
  "minLength": 1
}
minimum_revocation_epochintegerRequired by this schema object.

No configured default object/item or machine trust file.

{
  "minimum": 1
}
registry_auth_filestringNot required by this schema object.

No configured default object/item or machine trust file.

Absolute, clean host path; runtime validation is OS-specific.

{
  "maxLength": 4096,
  "minLength": 1
}
docker-machine.security — 4 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in docker-machine.security; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
seccomp_namestringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "maxLength": 256,
  "minLength": 1
}
seccomp_filestringRequired by this schema object.

No configured default object/item or machine trust file.

Absolute, clean host path; runtime validation is OS-specific.

{
  "maxLength": 4096,
  "minLength": 1
}
lsm_namestringNot required by this schema object.

No configured default object/item or machine trust file.

{
  "maxLength": 256,
  "minLength": 1
}
lsm_optionstringNot required by this schema object.

No configured default object/item or machine trust file.

{
  "maxLength": 4096,
  "minLength": 1
}
native-machine — 12 fields

Contract source: isolationruntime.NativeMachineConfig.

Fields in native-machine; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
versionintegerComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

runtimeobjectComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

initobjectComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

rootfsobjectComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

state_directorystringComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

cgroup_rootstringComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

io_devicestringComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

subuidobjectComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

subgidobjectComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

issuer_key_filestringComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

attestation_key_idstringComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

attestation_key_filestringComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

native-machine.init — 2 fields

Contract source: isolationruntime.NativeExecutable.

Fields in native-machine.init; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
pathstringComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

sha256stringComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

native-machine.rootfs — 2 fields

Contract source: isolationruntime.NativeRootFS.

Fields in native-machine.rootfs; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
directorystringComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

digeststringComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

native-machine.runtime — 2 fields

Contract source: isolationruntime.NativeExecutable.

Fields in native-machine.runtime; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
pathstringComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

sha256stringComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

native-machine.subgid — 2 fields

Contract source: isolationruntime.NativeIDMap.

Fields in native-machine.subgid; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
host_idintegerComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

sizeintegerComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

native-machine.subuid — 2 fields

Contract source: isolationruntime.NativeIDMap.

Fields in native-machine.subuid; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
host_idintegerComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

sizeintegerComplete source-validated file; consult the runtime rules above.

No configured default object/item or machine trust file.

Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above.

docker-image-statement — 19 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in docker-image-statement; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
versionintegerRequired by this schema object.

No configured default object/item or machine trust file.

{
  "const": 2
}
key_idstringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "maxLength": 256,
  "minLength": 1,
  "pattern": "^[^\\s].*[^\\s]$|^[^\\s]$"
}
referencestringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "maxLength": 4096,
  "minLength": 73,
  "pattern": "@sha256:[a-f0-9]{64}$"
}
manifest_digeststringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "pattern": "^sha256:[a-f0-9]{64}$"
}
config_digeststringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "pattern": "^sha256:[a-f0-9]{64}$"
}
rootfs_digeststringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "pattern": "^[a-f0-9]{64}$"
}
osstringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "maxLength": 64,
  "minLength": 1
}
architecturestringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "maxLength": 64,
  "minLength": 1
}
unpacked_bytesintegerRequired by this schema object.

No configured default object/item or machine trust file.

{
  "minimum": 1
}
highest_vulnerabilitystringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "enum": [
    "none",
    "low",
    "medium",
    "high",
    "critical"
  ]
}
signature_digeststringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "pattern": "^[a-f0-9]{64}$"
}
provenance_digeststringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "pattern": "^[a-f0-9]{64}$"
}
sbom_digeststringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "pattern": "^[a-f0-9]{64}$"
}
vulnerability_digeststringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "pattern": "^[a-f0-9]{64}$"
}
revocation_epochintegerRequired by this schema object.

No configured default object/item or machine trust file.

{
  "minimum": 1
}
verified_at_unix_milliintegerRequired by this schema object.

No configured default object/item or machine trust file.

{
  "minimum": 1
}
expires_at_unix_milliintegerRequired by this schema object.

No configured default object/item or machine trust file.

{
  "minimum": 1
}
localbooleanRequired by this schema object.

No configured default object/item or machine trust file.

runtime_factsobjectRequired by this schema object.

No configured default object/item or machine trust file.

{
  "additionalProperties": false
}
docker-image-statement.runtime_facts — 3 fields

Contract source: Installed embedded JSON Schema. This schema object refuses additional properties.

Fields in docker-image-statement.runtime_facts; schema validity and runtime admission are separate checks.
FieldTypePresence and defaultContract
osstringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "maxLength": 64,
  "minLength": 1
}
archstringRequired by this schema object.

No configured default object/item or machine trust file.

{
  "maxLength": 64,
  "minLength": 1
}
executablesobjectRequired by this schema object.

No configured default object/item or machine trust file.

{
  "additionalProperties": {
    "maxLength": 4096,
    "pattern": "^/[^\\u0000]*$",
    "type": "string"
  },
  "maxProperties": 256,
  "minProperties": 1,
  "propertyNames": {
    "maxLength": 256,
    "minLength": 1
  }
}