{ "release": "0.12.7", "source_commit": "192e590345c6a4bf1ef8f72b043b318084ea84d6", "binary_sha256": "45a7ae62c66c15693790de1905b72502b75e7889682e4e58cbb4e88756ba6879", "isolation_module": "devnw.dev/isolation@v0.14.1", "scope": "Installed embedded schemas and raw defaults, plus public Sonny/native-machine fields. Not a proof of backend, trust, signature, containment or cleanup.", "defaults_schema_mismatch": true, "expected_source_failures": [ "policy-default" ], "downloads": [ { "kind": "policy", "title": "Isolation policy", "path": "/reference/isolation-policy-schema-0.12.7.json", "schema_id": "https://devnw.dev/isolation/schema/policy-v1.schema.json" }, { "kind": "docker-machine", "title": "Docker machine trust", "path": "/reference/isolation-docker-machine-schema-0.12.7.json", "schema_id": "https://sonny.sh/schemas/isolation-docker-machine-v2.json" }, { "kind": "docker-image-statement", "title": "Docker image statement", "path": "/reference/isolation-docker-image-statement-schema-0.12.7.json", "schema_id": "https://sonny.sh/schemas/isolation-docker-image-statement-v2.json" } ], "groups": [ { "path": "isolation.yaml", "kind": "source-type", "source": "isolationruntime.Config", "fields": [ { "default": 1, "go_type": "int", "has_default": true, "kind": "int", "name": "version", "path": "isolation.yaml.version", "type": "integer", "default_is_object": false, "description": "The complete isolation file requires version 1; this is separate from the policy and machine-schema versions.", "flag": null }, { "default": "off", "go_type": "isolationview.Mode", "has_default": true, "kind": "string", "name": "mode", "path": "isolation.yaml.mode", "type": "string", "default_is_object": false, "description": "off, preferred or required. A requested mode below minimum_mode is refused. The printed constructor default is off; resolved invocation/service posture can differ.", "flag": "--isolation-mode" }, { "default": "off", "go_type": "isolationview.Mode", "has_default": true, "kind": "string", "name": "minimum_mode", "path": "isolation.yaml.minimum_mode", "type": "string", "default_is_object": false, "description": "off, preferred or required; composed layers preserve the strongest floor.", "flag": null }, { "default": "auto", "go_type": "isolation.Backend", "has_default": true, "kind": "string", "name": "backend", "path": "isolation.yaml.backend", "type": "string", "default_is_object": false, "description": "auto, native, docker or vm are declared selections; declaration does not establish availability or policy admission.", "flag": "--isolation-backend" }, { "default": "docker", "go_type": "isolation.Assurance", "has_default": true, "kind": "string", "name": "assurance", "path": "isolation.yaml.assurance", "type": "string", "default_is_object": false, "description": "guarded, native, docker or vm; validated against the requested runtime and inherited policy.", "flag": "--isolation-assurance" }, { "default": "copy", "go_type": "isolation.WorkspaceMode", "has_default": true, "kind": "string", "name": "workspace_mode", "path": "isolation.yaml.workspace_mode", "type": "string", "default_is_object": false, "description": "copy, bind or volume; project narrowing cannot redirect the host-selected mechanism.", "flag": null }, { "default": "sonny-default-docker", "go_type": "string", "has_default": true, "kind": "string", "name": "policy_profile", "path": "isolation.yaml.policy_profile", "type": "string", "default_is_object": false, "description": "Nonempty profile identity; this is not a flag selecting an arbitrary ready machine trust bundle.", "flag": null }, { "default": { "version": 1, "name": "sonny-default-docker", "allowed_backends": [ "docker" ], "backend_preference": [ "docker" ], "required_assurance": "docker", "required_features": [ "capability-drop", "clean-environment", "docker-api", "kill-to-empty", "network-namespace", "no-new-privileges", "opaque-secrets", "read-only-root", "reviewed-export", "seccomp", "signed-attestation", "user-namespace", "verified-rootfs", "worker-auth" ], "allowed_workspace_modes": [ "copy" ], "resources": { "cpu_quota_millis": 1000, "memory_bytes": 536870912, "memory_swap_bytes": 536870912, "pids": 64, "open_files": 256, "locked_memory_bytes": 0, "shared_memory_bytes": 67108864, "read_bytes": 1073741824, "write_bytes": 536870912, "disk_bytes": 1073741824, "runtime_millis": 300000, "concurrent_cells": 8, "concurrent_processes": 64, "network_bytes": 1, "network_connections": 1 }, "network": { "mode": "none", "rules": null, "allow_ipv4": false, "allow_ipv6": false, "allow_published_ports": false, "allow_extra_hosts": false }, "filesystem": { "read_only_root": true, "import_roots": [ "/workspace" ], "export_roots": [ "/workspace" ], "read_only_paths": [ "/proc/sys", "/sys" ], "masked_paths": [ "/proc/kcore", "/proc/keys", "/proc/timer_list" ], "max_import_bytes": 536870912, "max_import_files": 100000, "max_export_bytes": 536870912, "max_export_files": 100000, "tmpfs_bytes": 67108864, "scratch_bytes": 268435456, "exec_scratch": false, "require_review": true, "reject_special_files": true }, "environment": { "allow": [ "LANG", "LC_ALL", "PATH", "TERM", "TZ" ], "deny": [ "BASH_ENV", "DOCKER_CONFIG", "ENV", "GIT_ASKPASS", "HOME", "LD_PRELOAD", "NODE_OPTIONS", "PYTHONPATH", "SSH_AUTH_SOCK" ], "values": { "LANG": "C.UTF-8", "LC_ALL": "C.UTF-8", "PATH": "/usr/local/bin:/usr/bin:/bin", "TZ": "UTC" }, "max_bytes": 32768 }, "output": { "stdout_bytes": 16777216, "stderr_bytes": 16777216, "combined_bytes": 25165824, "log_bytes": 33554432 }, "lifecycle": { "lease_millis": 600000, "heartbeat_millis": 30000, "create_millis": 60000, "start_millis": 60000, "stop_grace_millis": 5000, "close_millis": 30000, "reconcile_millis": 60000, "retention_millis": 86400000 }, "docker": { "version": 1, "endpoint": { "allowed_classes": [ "local-rootless" ], "allowed_identities": null, "api_min": "1.44", "api_max": "1.51", "require_rootless": true, "allow_rootful": false, "allow_remote": false, "allowed_wsl_distros": null, "connect_timeout_millis": 5000, "start_timeout_millis": 60000 }, "image": { "allowed_references": null, "allowed_registries": null, "allowed_platforms": null, "pull_policy": "if-not-present", "allow_local": false, "require_digest": true, "require_signature": true, "require_provenance": true, "require_sbom": true, "max_vulnerability": "medium", "max_age_millis": 2592000000, "max_unpacked_bytes": 2147483648, "emergency_deny_digests": null }, "workspace": { "container_path": "/workspace", "mode": "copy", "read_only": false, "max_bytes": 536870912, "max_files": 100000, "review_export": true }, "process": { "entrypoint": [ "/usr/local/bin/sonny", "isolation-worker", "daemon" ], "workdir": "/workspace", "uid": 65532, "gid": 65532, "groups": null, "environment": { "LANG": "C.UTF-8", "PATH": "/usr/local/bin:/usr/bin:/bin", "TZ": "UTC" }, "init": true, "allow_pty": true, "deadline_millis": 300000, "stop_grace_millis": 5000, "output_bytes": 25165824 }, "filesystem": { "read_only_root": true, "tmpfs": { "/run": 16777216, "/tmp": 67108864 }, "masked_paths": [ "/proc/kcore", "/proc/keys", "/proc/timer_list" ], "read_only_paths": [ "/proc/sys", "/sys" ], "max_writable_bytes": 536870912, "allowed_volume_drivers": null, "private_propagation": true }, "resources": { "cpu_quota_millis": 1000, "memory_bytes": 536870912, "memory_swap_bytes": 536870912, "pids": 64, "open_files": 256, "shared_memory_bytes": 67108864, "disk_bytes": 1073741824, "log_bytes": 33554432, "runtime_millis": 300000, "concurrent_execs": 8 }, "security": { "privileged": false, "capability_add": null, "no_new_privileges": true, "seccomp_profile": "sonny-default", "lsm_profile": "", "user_namespace": "private", "runtime": "", "allow_devices": false, "allowed_sysctls": null, "allow_host_pid": false, "allow_host_ipc": false, "allow_host_network": false }, "network": { "mode": "none", "rules": null, "dedicated": true, "allow_published_ports": false, "allow_extra_hosts": false, "allow_host_gateway": false, "max_bytes": 1, "max_connections": 1 }, "lifecycle": { "lease_millis": 600000, "heartbeat_millis": 30000, "start_millis": 60000, "stop_millis": 10000, "remove_millis": 30000, "readiness_millis": 30000, "reconcile_millis": 60000, "retention_millis": 86400000 }, "observability": { "capture_events": true, "capture_stats": true, "audit": true, "attest": true, "redact": true, "max_event_bytes": 33554432, "max_support_bundle_bytes": 134217728 } } }, "go_type": "isolation.Policy", "has_default": true, "kind": "struct", "name": "policy", "path": "isolation.yaml.policy", "type": "object", "default_is_object": true, "description": "The complete versioned policy object below. Its syntax/schema acceptance is separate from a verified realm.", "flag": null }, { "default": 300000, "go_type": "int64", "has_default": true, "kind": "int64", "name": "evidence_max_age_ms", "path": "isolation.yaml.evidence_max_age_ms", "type": "integer", "default_is_object": false, "description": "Positive milliseconds. Resolution chooses the narrowest inherited window.", "flag": null }, { "default": 30000, "go_type": "int64", "has_default": true, "kind": "int64", "name": "clock_skew_ms", "path": "isolation.yaml.clock_skew_ms", "type": "integer", "default_is_object": false, "description": "Nonnegative milliseconds, no greater than evidence_max_age_ms; inherited windows may narrow.", "flag": null } ] }, { "path": "policy", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "version", "path": "policy.version", "type": "integer", "required_by_schema": true, "has_default": true, "constraints": { "const": 1 }, "default": 1, "default_is_object": false }, { "name": "name", "path": "policy.name", "type": "string", "required_by_schema": false, "has_default": true, "constraints": { "minLength": 1 }, "default": "sonny-default-docker", "default_is_object": false }, { "name": "allowed_backends", "path": "policy.allowed_backends", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "minItems": 1, "uniqueItems": true }, "default": [ "docker" ], "default_is_object": false, "item_contract": { "enum": [ "guarded", "native", "docker", "vm" ] } }, { "name": "backend_preference", "path": "policy.backend_preference", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "minItems": 1, "uniqueItems": true }, "default": [ "docker" ], "default_is_object": false, "item_contract": { "enum": [ "guarded", "native", "docker", "vm" ] } }, { "name": "required_assurance", "path": "policy.required_assurance", "type": "string", "required_by_schema": false, "has_default": true, "constraints": { "enum": [ "guarded", "native", "docker", "vm" ] }, "default": "docker", "default_is_object": false }, { "name": "required_features", "path": "policy.required_features", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": [ "capability-drop", "clean-environment", "docker-api", "kill-to-empty", "network-namespace", "no-new-privileges", "opaque-secrets", "read-only-root", "reviewed-export", "seccomp", "signed-attestation", "user-namespace", "verified-rootfs", "worker-auth" ], "default_is_object": false, "item_contract": { "enum": [ "app-container", "capability-drop", "cgroup-v2", "clean-environment", "docker-api", "docker-rootless", "hyper-v", "job-object", "kill-to-empty", "lsm", "mount-namespace", "network-namespace", "no-new-privileges", "opaque-secrets", "pid-namespace", "read-only-root", "reviewed-export", "seccomp", "signed-attestation", "user-namespace", "verified-rootfs", "virtualization-framework", "vm-guest-auth", "worker-auth" ] } }, { "name": "allowed_workspace_modes", "path": "policy.allowed_workspace_modes", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "minItems": 1, "uniqueItems": true }, "default": [ "copy" ], "default_is_object": false, "item_contract": { "enum": [ "copy", "bind", "volume" ] } }, { "name": "resources", "path": "policy.resources", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": false }, "default": { "cpu_quota_millis": 1000, "memory_bytes": 536870912, "memory_swap_bytes": 536870912, "pids": 64, "open_files": 256, "locked_memory_bytes": 0, "shared_memory_bytes": 67108864, "read_bytes": 1073741824, "write_bytes": 536870912, "disk_bytes": 1073741824, "runtime_millis": 300000, "concurrent_cells": 8, "concurrent_processes": 64, "network_bytes": 1, "network_connections": 1 }, "default_is_object": true }, { "name": "network", "path": "policy.network", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": false }, "default": { "mode": "none", "rules": null, "allow_ipv4": false, "allow_ipv6": false, "allow_published_ports": false, "allow_extra_hosts": false }, "default_is_object": true }, { "name": "filesystem", "path": "policy.filesystem", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": false }, "default": { "read_only_root": true, "import_roots": [ "/workspace" ], "export_roots": [ "/workspace" ], "read_only_paths": [ "/proc/sys", "/sys" ], "masked_paths": [ "/proc/kcore", "/proc/keys", "/proc/timer_list" ], "max_import_bytes": 536870912, "max_import_files": 100000, "max_export_bytes": 536870912, "max_export_files": 100000, "tmpfs_bytes": 67108864, "scratch_bytes": 268435456, "exec_scratch": false, "require_review": true, "reject_special_files": true }, "default_is_object": true }, { "name": "environment", "path": "policy.environment", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": false }, "default": { "allow": [ "LANG", "LC_ALL", "PATH", "TERM", "TZ" ], "deny": [ "BASH_ENV", "DOCKER_CONFIG", "ENV", "GIT_ASKPASS", "HOME", "LD_PRELOAD", "NODE_OPTIONS", "PYTHONPATH", "SSH_AUTH_SOCK" ], "values": { "LANG": "C.UTF-8", "LC_ALL": "C.UTF-8", "PATH": "/usr/local/bin:/usr/bin:/bin", "TZ": "UTC" }, "max_bytes": 32768 }, "default_is_object": true }, { "name": "output", "path": "policy.output", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": false }, "default": { "stdout_bytes": 16777216, "stderr_bytes": 16777216, "combined_bytes": 25165824, "log_bytes": 33554432 }, "default_is_object": true }, { "name": "lifecycle", "path": "policy.lifecycle", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": false }, "default": { "lease_millis": 600000, "heartbeat_millis": 30000, "create_millis": 60000, "start_millis": 60000, "stop_grace_millis": 5000, "close_millis": 30000, "reconcile_millis": 60000, "retention_millis": 86400000 }, "default_is_object": true }, { "name": "docker", "path": "policy.docker", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": false }, "default": { "version": 1, "endpoint": { "allowed_classes": [ "local-rootless" ], "allowed_identities": null, "api_min": "1.44", "api_max": "1.51", "require_rootless": true, "allow_rootful": false, "allow_remote": false, "allowed_wsl_distros": null, "connect_timeout_millis": 5000, "start_timeout_millis": 60000 }, "image": { "allowed_references": null, "allowed_registries": null, "allowed_platforms": null, "pull_policy": "if-not-present", "allow_local": false, "require_digest": true, "require_signature": true, "require_provenance": true, "require_sbom": true, "max_vulnerability": "medium", "max_age_millis": 2592000000, "max_unpacked_bytes": 2147483648, "emergency_deny_digests": null }, "workspace": { "container_path": "/workspace", "mode": "copy", "read_only": false, "max_bytes": 536870912, "max_files": 100000, "review_export": true }, "process": { "entrypoint": [ "/usr/local/bin/sonny", "isolation-worker", "daemon" ], "workdir": "/workspace", "uid": 65532, "gid": 65532, "groups": null, "environment": { "LANG": "C.UTF-8", "PATH": "/usr/local/bin:/usr/bin:/bin", "TZ": "UTC" }, "init": true, "allow_pty": true, "deadline_millis": 300000, "stop_grace_millis": 5000, "output_bytes": 25165824 }, "filesystem": { "read_only_root": true, "tmpfs": { "/run": 16777216, "/tmp": 67108864 }, "masked_paths": [ "/proc/kcore", "/proc/keys", "/proc/timer_list" ], "read_only_paths": [ "/proc/sys", "/sys" ], "max_writable_bytes": 536870912, "allowed_volume_drivers": null, "private_propagation": true }, "resources": { "cpu_quota_millis": 1000, "memory_bytes": 536870912, "memory_swap_bytes": 536870912, "pids": 64, "open_files": 256, "shared_memory_bytes": 67108864, "disk_bytes": 1073741824, "log_bytes": 33554432, "runtime_millis": 300000, "concurrent_execs": 8 }, "security": { "privileged": false, "capability_add": null, "no_new_privileges": true, "seccomp_profile": "sonny-default", "lsm_profile": "", "user_namespace": "private", "runtime": "", "allow_devices": false, "allowed_sysctls": null, "allow_host_pid": false, "allow_host_ipc": false, "allow_host_network": false }, "network": { "mode": "none", "rules": null, "dedicated": true, "allow_published_ports": false, "allow_extra_hosts": false, "allow_host_gateway": false, "max_bytes": 1, "max_connections": 1 }, "lifecycle": { "lease_millis": 600000, "heartbeat_millis": 30000, "start_millis": 60000, "stop_millis": 10000, "remove_millis": 30000, "readiness_millis": 30000, "reconcile_millis": 60000, "retention_millis": 86400000 }, "observability": { "capture_events": true, "capture_stats": true, "audit": true, "attest": true, "redact": true, "max_event_bytes": 33554432, "max_support_bundle_bytes": 134217728 } }, "default_is_object": true } ] }, { "path": "policy.docker", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "version", "path": "policy.docker.version", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "const": 1 }, "default": 1, "default_is_object": false }, { "name": "endpoint", "path": "policy.docker.endpoint", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": false }, "default": { "allowed_classes": [ "local-rootless" ], "allowed_identities": null, "api_min": "1.44", "api_max": "1.51", "require_rootless": true, "allow_rootful": false, "allow_remote": false, "allowed_wsl_distros": null, "connect_timeout_millis": 5000, "start_timeout_millis": 60000 }, "default_is_object": true }, { "name": "image", "path": "policy.docker.image", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": false }, "default": { "allowed_references": null, "allowed_registries": null, "allowed_platforms": null, "pull_policy": "if-not-present", "allow_local": false, "require_digest": true, "require_signature": true, "require_provenance": true, "require_sbom": true, "max_vulnerability": "medium", "max_age_millis": 2592000000, "max_unpacked_bytes": 2147483648, "emergency_deny_digests": null }, "default_is_object": true }, { "name": "workspace", "path": "policy.docker.workspace", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": false }, "default": { "container_path": "/workspace", "mode": "copy", "read_only": false, "max_bytes": 536870912, "max_files": 100000, "review_export": true }, "default_is_object": true }, { "name": "process", "path": "policy.docker.process", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": false }, "default": { "entrypoint": [ "/usr/local/bin/sonny", "isolation-worker", "daemon" ], "workdir": "/workspace", "uid": 65532, "gid": 65532, "groups": null, "environment": { "LANG": "C.UTF-8", "PATH": "/usr/local/bin:/usr/bin:/bin", "TZ": "UTC" }, "init": true, "allow_pty": true, "deadline_millis": 300000, "stop_grace_millis": 5000, "output_bytes": 25165824 }, "default_is_object": true }, { "name": "filesystem", "path": "policy.docker.filesystem", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": false }, "default": { "read_only_root": true, "tmpfs": { "/run": 16777216, "/tmp": 67108864 }, "masked_paths": [ "/proc/kcore", "/proc/keys", "/proc/timer_list" ], "read_only_paths": [ "/proc/sys", "/sys" ], "max_writable_bytes": 536870912, "allowed_volume_drivers": null, "private_propagation": true }, "default_is_object": true }, { "name": "resources", "path": "policy.docker.resources", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": false }, "default": { "cpu_quota_millis": 1000, "memory_bytes": 536870912, "memory_swap_bytes": 536870912, "pids": 64, "open_files": 256, "shared_memory_bytes": 67108864, "disk_bytes": 1073741824, "log_bytes": 33554432, "runtime_millis": 300000, "concurrent_execs": 8 }, "default_is_object": true }, { "name": "security", "path": "policy.docker.security", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": false }, "default": { "privileged": false, "capability_add": null, "no_new_privileges": true, "seccomp_profile": "sonny-default", "lsm_profile": "", "user_namespace": "private", "runtime": "", "allow_devices": false, "allowed_sysctls": null, "allow_host_pid": false, "allow_host_ipc": false, "allow_host_network": false }, "default_is_object": true }, { "name": "network", "path": "policy.docker.network", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": false }, "default": { "mode": "none", "rules": null, "dedicated": true, "allow_published_ports": false, "allow_extra_hosts": false, "allow_host_gateway": false, "max_bytes": 1, "max_connections": 1 }, "default_is_object": true }, { "name": "lifecycle", "path": "policy.docker.lifecycle", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": false }, "default": { "lease_millis": 600000, "heartbeat_millis": 30000, "start_millis": 60000, "stop_millis": 10000, "remove_millis": 30000, "readiness_millis": 30000, "reconcile_millis": 60000, "retention_millis": 86400000 }, "default_is_object": true }, { "name": "observability", "path": "policy.docker.observability", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": false }, "default": { "capture_events": true, "capture_stats": true, "audit": true, "attest": true, "redact": true, "max_event_bytes": 33554432, "max_support_bundle_bytes": 134217728 }, "default_is_object": true } ] }, { "path": "policy.docker.endpoint", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "allowed_classes", "path": "policy.docker.endpoint.allowed_classes", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": [ "local-rootless" ], "default_is_object": false, "item_contract": { "type": "string" } }, { "name": "allowed_identities", "path": "policy.docker.endpoint.allowed_identities", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": null, "default_is_object": false, "default_schema_mismatch": "The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.", "item_contract": { "type": "string" } }, { "name": "api_min", "path": "policy.docker.endpoint.api_min", "type": "string", "required_by_schema": false, "has_default": true, "constraints": {}, "default": "1.44", "default_is_object": false }, { "name": "api_max", "path": "policy.docker.endpoint.api_max", "type": "string", "required_by_schema": false, "has_default": true, "constraints": {}, "default": "1.51", "default_is_object": false }, { "name": "require_rootless", "path": "policy.docker.endpoint.require_rootless", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false }, { "name": "allow_rootful", "path": "policy.docker.endpoint.allow_rootful", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": false, "default_is_object": false }, { "name": "allow_remote", "path": "policy.docker.endpoint.allow_remote", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": false, "default_is_object": false }, { "name": "allowed_wsl_distros", "path": "policy.docker.endpoint.allowed_wsl_distros", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": null, "default_is_object": false, "default_schema_mismatch": "The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.", "item_contract": { "type": "string" } }, { "name": "connect_timeout_millis", "path": "policy.docker.endpoint.connect_timeout_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 5000, "default_is_object": false }, { "name": "start_timeout_millis", "path": "policy.docker.endpoint.start_timeout_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 60000, "default_is_object": false } ] }, { "path": "policy.docker.filesystem", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "read_only_root", "path": "policy.docker.filesystem.read_only_root", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false }, { "name": "tmpfs", "path": "policy.docker.filesystem.tmpfs", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": { "$ref": "#/$defs/positiveInteger" } }, "default": { "/run": 16777216, "/tmp": 67108864 }, "default_is_object": true }, { "name": "masked_paths", "path": "policy.docker.filesystem.masked_paths", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": [ "/proc/kcore", "/proc/keys", "/proc/timer_list" ], "default_is_object": false, "item_contract": { "type": "string" } }, { "name": "read_only_paths", "path": "policy.docker.filesystem.read_only_paths", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": [ "/proc/sys", "/sys" ], "default_is_object": false, "item_contract": { "type": "string" } }, { "name": "max_writable_bytes", "path": "policy.docker.filesystem.max_writable_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 536870912, "default_is_object": false }, { "name": "allowed_volume_drivers", "path": "policy.docker.filesystem.allowed_volume_drivers", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": null, "default_is_object": false, "default_schema_mismatch": "The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.", "item_contract": { "type": "string" } }, { "name": "private_propagation", "path": "policy.docker.filesystem.private_propagation", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false } ] }, { "path": "policy.docker.image", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "allowed_references", "path": "policy.docker.image.allowed_references", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": null, "default_is_object": false, "default_schema_mismatch": "The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.", "item_contract": { "type": "string" } }, { "name": "allowed_registries", "path": "policy.docker.image.allowed_registries", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": null, "default_is_object": false, "default_schema_mismatch": "The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.", "item_contract": { "type": "string" } }, { "name": "allowed_platforms", "path": "policy.docker.image.allowed_platforms", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": null, "default_is_object": false, "default_schema_mismatch": "The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.", "item_contract": { "type": "string" } }, { "name": "pull_policy", "path": "policy.docker.image.pull_policy", "type": "string", "required_by_schema": false, "has_default": true, "constraints": { "enum": [ "never", "if-not-present", "always", "digest-refresh" ] }, "default": "if-not-present", "default_is_object": false }, { "name": "allow_local", "path": "policy.docker.image.allow_local", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": false, "default_is_object": false }, { "name": "require_digest", "path": "policy.docker.image.require_digest", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false }, { "name": "require_signature", "path": "policy.docker.image.require_signature", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false }, { "name": "require_provenance", "path": "policy.docker.image.require_provenance", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false }, { "name": "require_sbom", "path": "policy.docker.image.require_sbom", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false }, { "name": "max_vulnerability", "path": "policy.docker.image.max_vulnerability", "type": "string", "required_by_schema": false, "has_default": true, "constraints": { "enum": [ "none", "low", "medium", "high", "critical" ] }, "default": "medium", "default_is_object": false }, { "name": "max_age_millis", "path": "policy.docker.image.max_age_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 2592000000, "default_is_object": false }, { "name": "max_unpacked_bytes", "path": "policy.docker.image.max_unpacked_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 2147483648, "default_is_object": false }, { "name": "emergency_deny_digests", "path": "policy.docker.image.emergency_deny_digests", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": null, "default_is_object": false, "default_schema_mismatch": "The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.", "item_contract": { "type": "string" } } ] }, { "path": "policy.docker.lifecycle", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "lease_millis", "path": "policy.docker.lifecycle.lease_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 600000, "default_is_object": false }, { "name": "heartbeat_millis", "path": "policy.docker.lifecycle.heartbeat_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 30000, "default_is_object": false }, { "name": "start_millis", "path": "policy.docker.lifecycle.start_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 60000, "default_is_object": false }, { "name": "stop_millis", "path": "policy.docker.lifecycle.stop_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 10000, "default_is_object": false }, { "name": "remove_millis", "path": "policy.docker.lifecycle.remove_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 30000, "default_is_object": false }, { "name": "readiness_millis", "path": "policy.docker.lifecycle.readiness_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 30000, "default_is_object": false }, { "name": "reconcile_millis", "path": "policy.docker.lifecycle.reconcile_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 60000, "default_is_object": false }, { "name": "retention_millis", "path": "policy.docker.lifecycle.retention_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 86400000, "default_is_object": false } ] }, { "path": "policy.docker.network", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "mode", "path": "policy.docker.network.mode", "type": "string", "required_by_schema": false, "has_default": true, "constraints": { "enum": [ "none", "proxy-only", "allowlist" ] }, "default": "none", "default_is_object": false }, { "name": "rules", "path": "policy.docker.network.rules", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": null, "default_is_object": false, "default_schema_mismatch": "The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.", "item_contract": { "type": "object", "additionalProperties": false } }, { "name": "dedicated", "path": "policy.docker.network.dedicated", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false }, { "name": "allow_published_ports", "path": "policy.docker.network.allow_published_ports", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": false, "default_is_object": false }, { "name": "allow_extra_hosts", "path": "policy.docker.network.allow_extra_hosts", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": false, "default_is_object": false }, { "name": "allow_host_gateway", "path": "policy.docker.network.allow_host_gateway", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": false, "default_is_object": false }, { "name": "max_bytes", "path": "policy.docker.network.max_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 1, "default_is_object": false }, { "name": "max_connections", "path": "policy.docker.network.max_connections", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 1, "default_is_object": false } ] }, { "path": "policy.docker.network.rules[]", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "host", "path": "policy.docker.network.rules[].host", "type": "string", "required_by_schema": false, "has_default": false, "constraints": { "minLength": 1 } }, { "name": "port", "path": "policy.docker.network.rules[].port", "type": "integer", "required_by_schema": false, "has_default": false, "constraints": { "minimum": 1, "maximum": 65535 } }, { "name": "protocol", "path": "policy.docker.network.rules[].protocol", "type": "string", "required_by_schema": false, "has_default": false, "constraints": { "enum": [ "tcp", "udp" ] } } ] }, { "path": "policy.docker.observability", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "capture_events", "path": "policy.docker.observability.capture_events", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false }, { "name": "capture_stats", "path": "policy.docker.observability.capture_stats", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false }, { "name": "audit", "path": "policy.docker.observability.audit", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false }, { "name": "attest", "path": "policy.docker.observability.attest", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false }, { "name": "redact", "path": "policy.docker.observability.redact", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false }, { "name": "max_event_bytes", "path": "policy.docker.observability.max_event_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 33554432, "default_is_object": false }, { "name": "max_support_bundle_bytes", "path": "policy.docker.observability.max_support_bundle_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 134217728, "default_is_object": false } ] }, { "path": "policy.docker.process", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "entrypoint", "path": "policy.docker.process.entrypoint", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "minItems": 1 }, "default": [ "/usr/local/bin/sonny", "isolation-worker", "daemon" ], "default_is_object": false, "item_contract": { "type": "string" } }, { "name": "workdir", "path": "policy.docker.process.workdir", "type": "string", "required_by_schema": false, "has_default": true, "constraints": { "pattern": "^/" }, "default": "/workspace", "default_is_object": false }, { "name": "uid", "path": "policy.docker.process.uid", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 65532, "default_is_object": false }, { "name": "gid", "path": "policy.docker.process.gid", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 65532, "default_is_object": false }, { "name": "groups", "path": "policy.docker.process.groups", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": null, "default_is_object": false, "default_schema_mismatch": "The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.", "item_contract": { "type": "integer", "minimum": 0 } }, { "name": "environment", "path": "policy.docker.process.environment", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": { "type": "string" } }, "default": { "LANG": "C.UTF-8", "PATH": "/usr/local/bin:/usr/bin:/bin", "TZ": "UTC" }, "default_is_object": true }, { "name": "init", "path": "policy.docker.process.init", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false }, { "name": "allow_pty", "path": "policy.docker.process.allow_pty", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false }, { "name": "deadline_millis", "path": "policy.docker.process.deadline_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 300000, "default_is_object": false }, { "name": "stop_grace_millis", "path": "policy.docker.process.stop_grace_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 5000, "default_is_object": false }, { "name": "output_bytes", "path": "policy.docker.process.output_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 25165824, "default_is_object": false } ] }, { "path": "policy.docker.resources", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "cpu_quota_millis", "path": "policy.docker.resources.cpu_quota_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 1000, "default_is_object": false }, { "name": "memory_bytes", "path": "policy.docker.resources.memory_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 536870912, "default_is_object": false }, { "name": "memory_swap_bytes", "path": "policy.docker.resources.memory_swap_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 536870912, "default_is_object": false }, { "name": "pids", "path": "policy.docker.resources.pids", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 64, "default_is_object": false }, { "name": "open_files", "path": "policy.docker.resources.open_files", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 256, "default_is_object": false }, { "name": "shared_memory_bytes", "path": "policy.docker.resources.shared_memory_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 67108864, "default_is_object": false }, { "name": "disk_bytes", "path": "policy.docker.resources.disk_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 1073741824, "default_is_object": false }, { "name": "log_bytes", "path": "policy.docker.resources.log_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 33554432, "default_is_object": false }, { "name": "runtime_millis", "path": "policy.docker.resources.runtime_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 300000, "default_is_object": false }, { "name": "concurrent_execs", "path": "policy.docker.resources.concurrent_execs", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 8, "default_is_object": false } ] }, { "path": "policy.docker.security", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "privileged", "path": "policy.docker.security.privileged", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": false, "default_is_object": false }, { "name": "capability_add", "path": "policy.docker.security.capability_add", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": null, "default_is_object": false, "default_schema_mismatch": "The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.", "item_contract": { "type": "string" } }, { "name": "no_new_privileges", "path": "policy.docker.security.no_new_privileges", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false }, { "name": "seccomp_profile", "path": "policy.docker.security.seccomp_profile", "type": "string", "required_by_schema": false, "has_default": true, "constraints": {}, "default": "sonny-default", "default_is_object": false }, { "name": "lsm_profile", "path": "policy.docker.security.lsm_profile", "type": "string", "required_by_schema": false, "has_default": true, "constraints": {}, "default": "", "default_is_object": false }, { "name": "user_namespace", "path": "policy.docker.security.user_namespace", "type": "string", "required_by_schema": false, "has_default": true, "constraints": {}, "default": "private", "default_is_object": false }, { "name": "runtime", "path": "policy.docker.security.runtime", "type": "string", "required_by_schema": false, "has_default": true, "constraints": {}, "default": "", "default_is_object": false }, { "name": "allow_devices", "path": "policy.docker.security.allow_devices", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": false, "default_is_object": false }, { "name": "allowed_sysctls", "path": "policy.docker.security.allowed_sysctls", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": null, "default_is_object": false, "default_schema_mismatch": "The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.", "item_contract": { "type": "string" } }, { "name": "allow_host_pid", "path": "policy.docker.security.allow_host_pid", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": false, "default_is_object": false }, { "name": "allow_host_ipc", "path": "policy.docker.security.allow_host_ipc", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": false, "default_is_object": false }, { "name": "allow_host_network", "path": "policy.docker.security.allow_host_network", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": false, "default_is_object": false } ] }, { "path": "policy.docker.workspace", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "container_path", "path": "policy.docker.workspace.container_path", "type": "string", "required_by_schema": false, "has_default": true, "constraints": { "pattern": "^/" }, "default": "/workspace", "default_is_object": false }, { "name": "mode", "path": "policy.docker.workspace.mode", "type": "string", "required_by_schema": false, "has_default": true, "constraints": { "enum": [ "copy", "bind", "volume" ] }, "default": "copy", "default_is_object": false }, { "name": "read_only", "path": "policy.docker.workspace.read_only", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": false, "default_is_object": false }, { "name": "max_bytes", "path": "policy.docker.workspace.max_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 536870912, "default_is_object": false }, { "name": "max_files", "path": "policy.docker.workspace.max_files", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 100000, "default_is_object": false }, { "name": "review_export", "path": "policy.docker.workspace.review_export", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false } ] }, { "path": "policy.environment", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "allow", "path": "policy.environment.allow", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": [ "LANG", "LC_ALL", "PATH", "TERM", "TZ" ], "default_is_object": false, "item_contract": { "type": "string" } }, { "name": "deny", "path": "policy.environment.deny", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": [ "BASH_ENV", "DOCKER_CONFIG", "ENV", "GIT_ASKPASS", "HOME", "LD_PRELOAD", "NODE_OPTIONS", "PYTHONPATH", "SSH_AUTH_SOCK" ], "default_is_object": false, "item_contract": { "type": "string" } }, { "name": "values", "path": "policy.environment.values", "type": "object", "required_by_schema": false, "has_default": true, "constraints": { "additionalProperties": { "type": "string" } }, "default": { "LANG": "C.UTF-8", "LC_ALL": "C.UTF-8", "PATH": "/usr/local/bin:/usr/bin:/bin", "TZ": "UTC" }, "default_is_object": true }, { "name": "max_bytes", "path": "policy.environment.max_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 32768, "default_is_object": false } ] }, { "path": "policy.filesystem", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "read_only_root", "path": "policy.filesystem.read_only_root", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false }, { "name": "import_roots", "path": "policy.filesystem.import_roots", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": [ "/workspace" ], "default_is_object": false, "item_contract": { "type": "string" } }, { "name": "export_roots", "path": "policy.filesystem.export_roots", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": [ "/workspace" ], "default_is_object": false, "item_contract": { "type": "string" } }, { "name": "read_only_paths", "path": "policy.filesystem.read_only_paths", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": [ "/proc/sys", "/sys" ], "default_is_object": false, "item_contract": { "type": "string" } }, { "name": "masked_paths", "path": "policy.filesystem.masked_paths", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": [ "/proc/kcore", "/proc/keys", "/proc/timer_list" ], "default_is_object": false, "item_contract": { "type": "string" } }, { "name": "max_import_bytes", "path": "policy.filesystem.max_import_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 536870912, "default_is_object": false }, { "name": "max_import_files", "path": "policy.filesystem.max_import_files", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 100000, "default_is_object": false }, { "name": "max_export_bytes", "path": "policy.filesystem.max_export_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 536870912, "default_is_object": false }, { "name": "max_export_files", "path": "policy.filesystem.max_export_files", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 100000, "default_is_object": false }, { "name": "tmpfs_bytes", "path": "policy.filesystem.tmpfs_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 67108864, "default_is_object": false }, { "name": "scratch_bytes", "path": "policy.filesystem.scratch_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1, "maximum": 8589934592 }, "default": 268435456, "default_is_object": false }, { "name": "exec_scratch", "path": "policy.filesystem.exec_scratch", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": { "default": false }, "default": false, "default_is_object": false }, { "name": "require_review", "path": "policy.filesystem.require_review", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false }, { "name": "reject_special_files", "path": "policy.filesystem.reject_special_files", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": true, "default_is_object": false } ] }, { "path": "policy.lifecycle", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "lease_millis", "path": "policy.lifecycle.lease_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 600000, "default_is_object": false }, { "name": "heartbeat_millis", "path": "policy.lifecycle.heartbeat_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 30000, "default_is_object": false }, { "name": "create_millis", "path": "policy.lifecycle.create_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 60000, "default_is_object": false }, { "name": "start_millis", "path": "policy.lifecycle.start_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 60000, "default_is_object": false }, { "name": "stop_grace_millis", "path": "policy.lifecycle.stop_grace_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 5000, "default_is_object": false }, { "name": "close_millis", "path": "policy.lifecycle.close_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 30000, "default_is_object": false }, { "name": "reconcile_millis", "path": "policy.lifecycle.reconcile_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 60000, "default_is_object": false }, { "name": "retention_millis", "path": "policy.lifecycle.retention_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 86400000, "default_is_object": false } ] }, { "path": "policy.network", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "mode", "path": "policy.network.mode", "type": "string", "required_by_schema": false, "has_default": true, "constraints": { "enum": [ "none", "proxy-only", "allowlist" ] }, "default": "none", "default_is_object": false }, { "name": "rules", "path": "policy.network.rules", "type": "array", "required_by_schema": false, "has_default": true, "constraints": { "uniqueItems": true }, "default": null, "default_is_object": false, "default_schema_mismatch": "The exported default is null; this schema requires an array. See the measured defaults/schema mismatch above.", "item_contract": { "type": "object", "additionalProperties": false } }, { "name": "allow_ipv4", "path": "policy.network.allow_ipv4", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": false, "default_is_object": false }, { "name": "allow_ipv6", "path": "policy.network.allow_ipv6", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": false, "default_is_object": false }, { "name": "allow_published_ports", "path": "policy.network.allow_published_ports", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": false, "default_is_object": false }, { "name": "allow_extra_hosts", "path": "policy.network.allow_extra_hosts", "type": "boolean", "required_by_schema": false, "has_default": true, "constraints": {}, "default": false, "default_is_object": false } ] }, { "path": "policy.network.rules[]", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "host", "path": "policy.network.rules[].host", "type": "string", "required_by_schema": false, "has_default": false, "constraints": { "minLength": 1 } }, { "name": "port", "path": "policy.network.rules[].port", "type": "integer", "required_by_schema": false, "has_default": false, "constraints": { "minimum": 1, "maximum": 65535 } }, { "name": "protocol", "path": "policy.network.rules[].protocol", "type": "string", "required_by_schema": false, "has_default": false, "constraints": { "enum": [ "tcp", "udp" ] } } ] }, { "path": "policy.output", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "stdout_bytes", "path": "policy.output.stdout_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 16777216, "default_is_object": false }, { "name": "stderr_bytes", "path": "policy.output.stderr_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 16777216, "default_is_object": false }, { "name": "combined_bytes", "path": "policy.output.combined_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 25165824, "default_is_object": false }, { "name": "log_bytes", "path": "policy.output.log_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 33554432, "default_is_object": false } ] }, { "path": "policy.resources", "kind": "policy", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "cpu_quota_millis", "path": "policy.resources.cpu_quota_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 1000, "default_is_object": false }, { "name": "memory_bytes", "path": "policy.resources.memory_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 536870912, "default_is_object": false }, { "name": "memory_swap_bytes", "path": "policy.resources.memory_swap_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 536870912, "default_is_object": false }, { "name": "pids", "path": "policy.resources.pids", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 64, "default_is_object": false }, { "name": "open_files", "path": "policy.resources.open_files", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 256, "default_is_object": false }, { "name": "locked_memory_bytes", "path": "policy.resources.locked_memory_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 0 }, "default": 0, "default_is_object": false }, { "name": "shared_memory_bytes", "path": "policy.resources.shared_memory_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 67108864, "default_is_object": false }, { "name": "read_bytes", "path": "policy.resources.read_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 1073741824, "default_is_object": false }, { "name": "write_bytes", "path": "policy.resources.write_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 536870912, "default_is_object": false }, { "name": "disk_bytes", "path": "policy.resources.disk_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 1073741824, "default_is_object": false }, { "name": "runtime_millis", "path": "policy.resources.runtime_millis", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 300000, "default_is_object": false }, { "name": "concurrent_cells", "path": "policy.resources.concurrent_cells", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 8, "default_is_object": false }, { "name": "concurrent_processes", "path": "policy.resources.concurrent_processes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 64, "default_is_object": false }, { "name": "network_bytes", "path": "policy.resources.network_bytes", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 1, "default_is_object": false }, { "name": "network_connections", "path": "policy.resources.network_connections", "type": "integer", "required_by_schema": false, "has_default": true, "constraints": { "minimum": 1 }, "default": 1, "default_is_object": false } ] }, { "path": "docker-machine", "kind": "docker-machine", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "version", "path": "docker-machine.version", "type": "integer", "required_by_schema": true, "has_default": false, "constraints": { "const": 2 } }, { "name": "endpoint", "path": "docker-machine.endpoint", "type": "object", "required_by_schema": true, "has_default": false, "constraints": { "additionalProperties": false, "allOf": [ { "not": { "properties": { "require_rootless": { "const": true }, "allow_rootful": { "const": true } }, "required": [ "require_rootless", "allow_rootful" ] } }, { "if": { "properties": { "class": { "const": "wsl" } }, "required": [ "class" ] }, "then": { "required": [ "wsl_distribution" ] } }, { "if": { "properties": { "class": { "const": "remote-mtls" } }, "required": [ "class" ] }, "then": { "required": [ "tls_ca_file", "tls_cert_file", "tls_key_file", "tls_server_name" ] } } ] } }, { "name": "image", "path": "docker-machine.image", "type": "object", "required_by_schema": true, "has_default": false, "constraints": { "additionalProperties": false } }, { "name": "security", "path": "docker-machine.security", "type": "object", "required_by_schema": true, "has_default": false, "constraints": { "additionalProperties": false, "dependentRequired": { "lsm_name": [ "lsm_option" ], "lsm_option": [ "lsm_name" ] } } }, { "name": "state_directory", "path": "docker-machine.state_directory", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 1, "maxLength": 4096 }, "description": "Absolute, clean host path; runtime validation is OS-specific." }, { "name": "issuer_key_file", "path": "docker-machine.issuer_key_file", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 1, "maxLength": 4096 }, "description": "Absolute, clean host path; runtime validation is OS-specific." }, { "name": "attestation_key_id", "path": "docker-machine.attestation_key_id", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 1, "maxLength": 256 } }, { "name": "attestation_key_file", "path": "docker-machine.attestation_key_file", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 1, "maxLength": 4096 }, "description": "Absolute, clean host path; runtime validation is OS-specific." }, { "name": "journal_max_bytes", "path": "docker-machine.journal_max_bytes", "type": "integer", "required_by_schema": true, "has_default": false, "constraints": { "minimum": 1, "maximum": 67108864 } } ] }, { "path": "docker-machine.endpoint", "kind": "docker-machine", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "class", "path": "docker-machine.endpoint.class", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "enum": [ "local-rootless", "local-socket", "macos-desktop", "windows-pipe", "wsl", "remote-mtls" ] } }, { "name": "address", "path": "docker-machine.endpoint.address", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 1, "maxLength": 4096 } }, { "name": "identity", "path": "docker-machine.endpoint.identity", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 1, "maxLength": 256 } }, { "name": "api_min", "path": "docker-machine.endpoint.api_min", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 1, "maxLength": 32 } }, { "name": "api_max", "path": "docker-machine.endpoint.api_max", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 1, "maxLength": 32 } }, { "name": "require_rootless", "path": "docker-machine.endpoint.require_rootless", "type": "boolean", "required_by_schema": true, "has_default": false, "constraints": {} }, { "name": "allow_rootful", "path": "docker-machine.endpoint.allow_rootful", "type": "boolean", "required_by_schema": true, "has_default": false, "constraints": {} }, { "name": "wsl_distribution", "path": "docker-machine.endpoint.wsl_distribution", "type": "string", "required_by_schema": false, "has_default": false, "constraints": { "minLength": 1, "maxLength": 256 } }, { "name": "tls_ca_file", "path": "docker-machine.endpoint.tls_ca_file", "type": "string", "required_by_schema": false, "has_default": false, "constraints": { "minLength": 1, "maxLength": 4096 }, "description": "Absolute, clean host path; runtime validation is OS-specific." }, { "name": "tls_cert_file", "path": "docker-machine.endpoint.tls_cert_file", "type": "string", "required_by_schema": false, "has_default": false, "constraints": { "minLength": 1, "maxLength": 4096 }, "description": "Absolute, clean host path; runtime validation is OS-specific." }, { "name": "tls_key_file", "path": "docker-machine.endpoint.tls_key_file", "type": "string", "required_by_schema": false, "has_default": false, "constraints": { "minLength": 1, "maxLength": 4096 }, "description": "Absolute, clean host path; runtime validation is OS-specific." }, { "name": "tls_server_name", "path": "docker-machine.endpoint.tls_server_name", "type": "string", "required_by_schema": false, "has_default": false, "constraints": { "minLength": 1, "maxLength": 253 } } ], "conditional_constraints": [ { "not": { "properties": { "require_rootless": { "const": true }, "allow_rootful": { "const": true } }, "required": [ "require_rootless", "allow_rootful" ] } }, { "if": { "properties": { "class": { "const": "wsl" } }, "required": [ "class" ] }, "then": { "required": [ "wsl_distribution" ] } }, { "if": { "properties": { "class": { "const": "remote-mtls" } }, "required": [ "class" ] }, "then": { "required": [ "tls_ca_file", "tls_cert_file", "tls_key_file", "tls_server_name" ] } } ] }, { "path": "docker-machine.image", "kind": "docker-machine", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "reference", "path": "docker-machine.image.reference", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "pattern": "@sha256:[a-f0-9]{64}$", "maxLength": 4096 } }, { "name": "statement_file", "path": "docker-machine.image.statement_file", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 1, "maxLength": 4096 }, "description": "Absolute, clean host path; runtime validation is OS-specific." }, { "name": "signature_file", "path": "docker-machine.image.signature_file", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 1, "maxLength": 4096 }, "description": "Absolute, clean host path; runtime validation is OS-specific." }, { "name": "public_key_file", "path": "docker-machine.image.public_key_file", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 1, "maxLength": 4096 }, "description": "Absolute, clean host path; runtime validation is OS-specific." }, { "name": "trusted_key_id", "path": "docker-machine.image.trusted_key_id", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 1, "maxLength": 256 } }, { "name": "minimum_revocation_epoch", "path": "docker-machine.image.minimum_revocation_epoch", "type": "integer", "required_by_schema": true, "has_default": false, "constraints": { "minimum": 1 } }, { "name": "registry_auth_file", "path": "docker-machine.image.registry_auth_file", "type": "string", "required_by_schema": false, "has_default": false, "constraints": { "minLength": 1, "maxLength": 4096 }, "description": "Absolute, clean host path; runtime validation is OS-specific." } ] }, { "path": "docker-machine.security", "kind": "docker-machine", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "seccomp_name", "path": "docker-machine.security.seccomp_name", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 1, "maxLength": 256 } }, { "name": "seccomp_file", "path": "docker-machine.security.seccomp_file", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 1, "maxLength": 4096 }, "description": "Absolute, clean host path; runtime validation is OS-specific." }, { "name": "lsm_name", "path": "docker-machine.security.lsm_name", "type": "string", "required_by_schema": false, "has_default": false, "constraints": { "minLength": 1, "maxLength": 256 } }, { "name": "lsm_option", "path": "docker-machine.security.lsm_option", "type": "string", "required_by_schema": false, "has_default": false, "constraints": { "minLength": 1, "maxLength": 4096 } } ] }, { "path": "native-machine", "kind": "source-type", "source": "isolationruntime.NativeMachineConfig", "fields": [ { "go_type": "int", "has_default": false, "kind": "int", "name": "version", "path": "native-machine.version", "type": "integer", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." }, { "go_type": "isolationruntime.NativeExecutable", "has_default": false, "kind": "struct", "name": "runtime", "path": "native-machine.runtime", "type": "object", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." }, { "go_type": "isolationruntime.NativeExecutable", "has_default": false, "kind": "struct", "name": "init", "path": "native-machine.init", "type": "object", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." }, { "go_type": "isolationruntime.NativeRootFS", "has_default": false, "kind": "struct", "name": "rootfs", "path": "native-machine.rootfs", "type": "object", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." }, { "go_type": "string", "has_default": false, "kind": "string", "name": "state_directory", "path": "native-machine.state_directory", "type": "string", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." }, { "go_type": "string", "has_default": false, "kind": "string", "name": "cgroup_root", "path": "native-machine.cgroup_root", "type": "string", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." }, { "go_type": "string", "has_default": false, "kind": "string", "name": "io_device", "path": "native-machine.io_device", "type": "string", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." }, { "go_type": "isolationruntime.NativeIDMap", "has_default": false, "kind": "struct", "name": "subuid", "path": "native-machine.subuid", "type": "object", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." }, { "go_type": "isolationruntime.NativeIDMap", "has_default": false, "kind": "struct", "name": "subgid", "path": "native-machine.subgid", "type": "object", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." }, { "go_type": "string", "has_default": false, "kind": "string", "name": "issuer_key_file", "path": "native-machine.issuer_key_file", "type": "string", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." }, { "go_type": "string", "has_default": false, "kind": "string", "name": "attestation_key_id", "path": "native-machine.attestation_key_id", "type": "string", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." }, { "go_type": "string", "has_default": false, "kind": "string", "name": "attestation_key_file", "path": "native-machine.attestation_key_file", "type": "string", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." } ] }, { "path": "native-machine.init", "kind": "source-type", "source": "isolationruntime.NativeExecutable", "fields": [ { "go_type": "string", "has_default": false, "kind": "string", "name": "path", "path": "native-machine.init.path", "type": "string", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." }, { "go_type": "isolation.Digest", "has_default": false, "kind": "string", "name": "sha256", "path": "native-machine.init.sha256", "type": "string", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." } ] }, { "path": "native-machine.rootfs", "kind": "source-type", "source": "isolationruntime.NativeRootFS", "fields": [ { "go_type": "string", "has_default": false, "kind": "string", "name": "directory", "path": "native-machine.rootfs.directory", "type": "string", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." }, { "go_type": "isolation.Digest", "has_default": false, "kind": "string", "name": "digest", "path": "native-machine.rootfs.digest", "type": "string", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." } ] }, { "path": "native-machine.runtime", "kind": "source-type", "source": "isolationruntime.NativeExecutable", "fields": [ { "go_type": "string", "has_default": false, "kind": "string", "name": "path", "path": "native-machine.runtime.path", "type": "string", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." }, { "go_type": "isolation.Digest", "has_default": false, "kind": "string", "name": "sha256", "path": "native-machine.runtime.sha256", "type": "string", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." } ] }, { "path": "native-machine.subgid", "kind": "source-type", "source": "isolationruntime.NativeIDMap", "fields": [ { "go_type": "uint32", "has_default": false, "kind": "uint32", "name": "host_id", "path": "native-machine.subgid.host_id", "type": "integer", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." }, { "go_type": "uint32", "has_default": false, "kind": "uint32", "name": "size", "path": "native-machine.subgid.size", "type": "integer", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." } ] }, { "path": "native-machine.subuid", "kind": "source-type", "source": "isolationruntime.NativeIDMap", "fields": [ { "go_type": "uint32", "has_default": false, "kind": "uint32", "name": "host_id", "path": "native-machine.subuid.host_id", "type": "integer", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." }, { "go_type": "uint32", "has_default": false, "kind": "uint32", "name": "size", "path": "native-machine.subuid.size", "type": "integer", "default_is_object": false, "description": "Native-machine trust member; no built-in machine file or generic per-field environment override. See native validation and protected-path rules above." } ] }, { "path": "docker-image-statement", "kind": "docker-image-statement", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "version", "path": "docker-image-statement.version", "type": "integer", "required_by_schema": true, "has_default": false, "constraints": { "const": 2 } }, { "name": "key_id", "path": "docker-image-statement.key_id", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 1, "maxLength": 256, "pattern": "^[^\\s].*[^\\s]$|^[^\\s]$" } }, { "name": "reference", "path": "docker-image-statement.reference", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 73, "maxLength": 4096, "pattern": "@sha256:[a-f0-9]{64}$" } }, { "name": "manifest_digest", "path": "docker-image-statement.manifest_digest", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "pattern": "^sha256:[a-f0-9]{64}$" } }, { "name": "config_digest", "path": "docker-image-statement.config_digest", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "pattern": "^sha256:[a-f0-9]{64}$" } }, { "name": "rootfs_digest", "path": "docker-image-statement.rootfs_digest", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "pattern": "^[a-f0-9]{64}$" } }, { "name": "os", "path": "docker-image-statement.os", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 1, "maxLength": 64 } }, { "name": "architecture", "path": "docker-image-statement.architecture", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 1, "maxLength": 64 } }, { "name": "unpacked_bytes", "path": "docker-image-statement.unpacked_bytes", "type": "integer", "required_by_schema": true, "has_default": false, "constraints": { "minimum": 1 } }, { "name": "highest_vulnerability", "path": "docker-image-statement.highest_vulnerability", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "enum": [ "none", "low", "medium", "high", "critical" ] } }, { "name": "signature_digest", "path": "docker-image-statement.signature_digest", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "pattern": "^[a-f0-9]{64}$" } }, { "name": "provenance_digest", "path": "docker-image-statement.provenance_digest", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "pattern": "^[a-f0-9]{64}$" } }, { "name": "sbom_digest", "path": "docker-image-statement.sbom_digest", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "pattern": "^[a-f0-9]{64}$" } }, { "name": "vulnerability_digest", "path": "docker-image-statement.vulnerability_digest", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "pattern": "^[a-f0-9]{64}$" } }, { "name": "revocation_epoch", "path": "docker-image-statement.revocation_epoch", "type": "integer", "required_by_schema": true, "has_default": false, "constraints": { "minimum": 1 } }, { "name": "verified_at_unix_milli", "path": "docker-image-statement.verified_at_unix_milli", "type": "integer", "required_by_schema": true, "has_default": false, "constraints": { "minimum": 1 } }, { "name": "expires_at_unix_milli", "path": "docker-image-statement.expires_at_unix_milli", "type": "integer", "required_by_schema": true, "has_default": false, "constraints": { "minimum": 1 } }, { "name": "local", "path": "docker-image-statement.local", "type": "boolean", "required_by_schema": true, "has_default": false, "constraints": {} }, { "name": "runtime_facts", "path": "docker-image-statement.runtime_facts", "type": "object", "required_by_schema": true, "has_default": false, "constraints": { "additionalProperties": false } } ] }, { "path": "docker-image-statement.runtime_facts", "kind": "docker-image-statement", "source": "Installed embedded JSON Schema", "additional_properties": false, "fields": [ { "name": "os", "path": "docker-image-statement.runtime_facts.os", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 1, "maxLength": 64 } }, { "name": "arch", "path": "docker-image-statement.runtime_facts.arch", "type": "string", "required_by_schema": true, "has_default": false, "constraints": { "minLength": 1, "maxLength": 64 } }, { "name": "executables", "path": "docker-image-statement.runtime_facts.executables", "type": "object", "required_by_schema": true, "has_default": false, "constraints": { "minProperties": 1, "maxProperties": 256, "propertyNames": { "minLength": 1, "maxLength": 256 }, "additionalProperties": { "type": "string", "pattern": "^/[^\\u0000]*$", "maxLength": 4096 } } } ] } ] }