{
  "version": 1,
  "mode": "off",
  "minimum_mode": "off",
  "backend": "auto",
  "assurance": "docker",
  "workspace_mode": "copy",
  "policy_profile": "sonny-default-docker",
  "policy": {
    "version": 1,
    "name": "sonny-default-docker",
    "allowed_backends": [
      "docker"
    ],
    "backend_preference": [
      "docker"
    ],
    "required_assurance": "docker",
    "required_features": [
      "capability-drop",
      "clean-environment",
      "docker-api",
      "kill-to-empty",
      "network-namespace",
      "no-new-privileges",
      "opaque-secrets",
      "read-only-root",
      "reviewed-export",
      "seccomp",
      "signed-attestation",
      "user-namespace",
      "verified-rootfs",
      "worker-auth"
    ],
    "allowed_workspace_modes": [
      "copy"
    ],
    "resources": {
      "cpu_quota_millis": 1000,
      "memory_bytes": 536870912,
      "memory_swap_bytes": 536870912,
      "pids": 64,
      "open_files": 256,
      "locked_memory_bytes": 0,
      "shared_memory_bytes": 67108864,
      "read_bytes": 1073741824,
      "write_bytes": 536870912,
      "disk_bytes": 1073741824,
      "runtime_millis": 300000,
      "concurrent_cells": 8,
      "concurrent_processes": 64,
      "network_bytes": 1,
      "network_connections": 1
    },
    "network": {
      "mode": "none",
      "rules": null,
      "allow_ipv4": false,
      "allow_ipv6": false,
      "allow_published_ports": false,
      "allow_extra_hosts": false
    },
    "filesystem": {
      "read_only_root": true,
      "import_roots": [
        "/workspace"
      ],
      "export_roots": [
        "/workspace"
      ],
      "read_only_paths": [
        "/proc/sys",
        "/sys"
      ],
      "masked_paths": [
        "/proc/kcore",
        "/proc/keys",
        "/proc/timer_list"
      ],
      "max_import_bytes": 536870912,
      "max_import_files": 100000,
      "max_export_bytes": 536870912,
      "max_export_files": 100000,
      "tmpfs_bytes": 67108864,
      "scratch_bytes": 268435456,
      "exec_scratch": false,
      "require_review": true,
      "reject_special_files": true
    },
    "environment": {
      "allow": [
        "LANG",
        "LC_ALL",
        "PATH",
        "TERM",
        "TZ"
      ],
      "deny": [
        "BASH_ENV",
        "DOCKER_CONFIG",
        "ENV",
        "GIT_ASKPASS",
        "HOME",
        "LD_PRELOAD",
        "NODE_OPTIONS",
        "PYTHONPATH",
        "SSH_AUTH_SOCK"
      ],
      "values": {
        "LANG": "C.UTF-8",
        "LC_ALL": "C.UTF-8",
        "PATH": "/usr/local/bin:/usr/bin:/bin",
        "TZ": "UTC"
      },
      "max_bytes": 32768
    },
    "output": {
      "stdout_bytes": 16777216,
      "stderr_bytes": 16777216,
      "combined_bytes": 25165824,
      "log_bytes": 33554432
    },
    "lifecycle": {
      "lease_millis": 600000,
      "heartbeat_millis": 30000,
      "create_millis": 60000,
      "start_millis": 60000,
      "stop_grace_millis": 5000,
      "close_millis": 30000,
      "reconcile_millis": 60000,
      "retention_millis": 86400000
    },
    "docker": {
      "version": 1,
      "endpoint": {
        "allowed_classes": [
          "local-rootless"
        ],
        "allowed_identities": null,
        "api_min": "1.44",
        "api_max": "1.51",
        "require_rootless": true,
        "allow_rootful": false,
        "allow_remote": false,
        "allowed_wsl_distros": null,
        "connect_timeout_millis": 5000,
        "start_timeout_millis": 60000
      },
      "image": {
        "allowed_references": null,
        "allowed_registries": null,
        "allowed_platforms": null,
        "pull_policy": "if-not-present",
        "allow_local": false,
        "require_digest": true,
        "require_signature": true,
        "require_provenance": true,
        "require_sbom": true,
        "max_vulnerability": "medium",
        "max_age_millis": 2592000000,
        "max_unpacked_bytes": 2147483648,
        "emergency_deny_digests": null
      },
      "workspace": {
        "container_path": "/workspace",
        "mode": "copy",
        "read_only": false,
        "max_bytes": 536870912,
        "max_files": 100000,
        "review_export": true
      },
      "process": {
        "entrypoint": [
          "/usr/local/bin/sonny",
          "isolation-worker",
          "daemon"
        ],
        "workdir": "/workspace",
        "uid": 65532,
        "gid": 65532,
        "groups": null,
        "environment": {
          "LANG": "C.UTF-8",
          "PATH": "/usr/local/bin:/usr/bin:/bin",
          "TZ": "UTC"
        },
        "init": true,
        "allow_pty": true,
        "deadline_millis": 300000,
        "stop_grace_millis": 5000,
        "output_bytes": 25165824
      },
      "filesystem": {
        "read_only_root": true,
        "tmpfs": {
          "/run": 16777216,
          "/tmp": 67108864
        },
        "masked_paths": [
          "/proc/kcore",
          "/proc/keys",
          "/proc/timer_list"
        ],
        "read_only_paths": [
          "/proc/sys",
          "/sys"
        ],
        "max_writable_bytes": 536870912,
        "allowed_volume_drivers": null,
        "private_propagation": true
      },
      "resources": {
        "cpu_quota_millis": 1000,
        "memory_bytes": 536870912,
        "memory_swap_bytes": 536870912,
        "pids": 64,
        "open_files": 256,
        "shared_memory_bytes": 67108864,
        "disk_bytes": 1073741824,
        "log_bytes": 33554432,
        "runtime_millis": 300000,
        "concurrent_execs": 8
      },
      "security": {
        "privileged": false,
        "capability_add": null,
        "no_new_privileges": true,
        "seccomp_profile": "sonny-default",
        "lsm_profile": "",
        "user_namespace": "private",
        "runtime": "",
        "allow_devices": false,
        "allowed_sysctls": null,
        "allow_host_pid": false,
        "allow_host_ipc": false,
        "allow_host_network": false
      },
      "network": {
        "mode": "none",
        "rules": null,
        "dedicated": true,
        "allow_published_ports": false,
        "allow_extra_hosts": false,
        "allow_host_gateway": false,
        "max_bytes": 1,
        "max_connections": 1
      },
      "lifecycle": {
        "lease_millis": 600000,
        "heartbeat_millis": 30000,
        "start_millis": 60000,
        "stop_millis": 10000,
        "remove_millis": 30000,
        "readiness_millis": 30000,
        "reconcile_millis": 60000,
        "retention_millis": 86400000
      },
      "observability": {
        "capture_events": true,
        "capture_stats": true,
        "audit": true,
        "attest": true,
        "redact": true,
        "max_event_bytes": 33554432,
        "max_support_bundle_bytes": 134217728
      }
    }
  },
  "evidence_max_age_ms": 300000,
  "clock_skew_ms": 30000
}