{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://sonny.sh/schemas/isolation-docker-machine-v2.json",
  "title": "Sonny Docker isolation machine trust",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "version", "endpoint", "image", "security", "state_directory",
    "issuer_key_file", "attestation_key_id", "attestation_key_file",
    "journal_max_bytes"
  ],
  "properties": {
    "version": {"const": 2},
    "endpoint": {"$ref": "#/$defs/endpoint"},
    "image": {"$ref": "#/$defs/image"},
    "security": {"$ref": "#/$defs/security"},
    "state_directory": {"$ref": "#/$defs/absolutePath"},
    "issuer_key_file": {"$ref": "#/$defs/absolutePath"},
    "attestation_key_id": {"type": "string", "minLength": 1, "maxLength": 256},
    "attestation_key_file": {"$ref": "#/$defs/absolutePath"},
    "journal_max_bytes": {"type": "integer", "minimum": 1, "maximum": 67108864}
  },
  "$defs": {
    "absolutePath": {
      "type": "string",
      "minLength": 1,
      "maxLength": 4096,
      "description": "Absolute, clean host path; runtime validation is OS-specific."
    },
    "endpoint": {
      "type": "object",
      "additionalProperties": false,
      "required": ["class", "address", "identity", "api_min", "api_max", "require_rootless", "allow_rootful"],
      "properties": {
        "class": {
          "enum": ["local-rootless", "local-socket", "macos-desktop", "windows-pipe", "wsl", "remote-mtls"]
        },
        "address": {"type": "string", "minLength": 1, "maxLength": 4096},
        "identity": {"type": "string", "minLength": 1, "maxLength": 256},
        "api_min": {"type": "string", "minLength": 1, "maxLength": 32},
        "api_max": {"type": "string", "minLength": 1, "maxLength": 32},
        "require_rootless": {"type": "boolean"},
        "allow_rootful": {"type": "boolean"},
        "wsl_distribution": {"type": "string", "minLength": 1, "maxLength": 256},
        "tls_ca_file": {"$ref": "#/$defs/absolutePath"},
        "tls_cert_file": {"$ref": "#/$defs/absolutePath"},
        "tls_key_file": {"$ref": "#/$defs/absolutePath"},
        "tls_server_name": {"type": "string", "minLength": 1, "maxLength": 253}
      },
      "allOf": [
        {
          "not": {
            "properties": {"require_rootless": {"const": true}, "allow_rootful": {"const": true}},
            "required": ["require_rootless", "allow_rootful"]
          }
        },
        {
          "if": {"properties": {"class": {"const": "wsl"}}, "required": ["class"]},
          "then": {"required": ["wsl_distribution"]}
        },
        {
          "if": {"properties": {"class": {"const": "remote-mtls"}}, "required": ["class"]},
          "then": {"required": ["tls_ca_file", "tls_cert_file", "tls_key_file", "tls_server_name"]}
        }
      ]
    },
    "image": {
      "type": "object",
      "additionalProperties": false,
      "required": ["reference", "statement_file", "signature_file", "public_key_file", "trusted_key_id", "minimum_revocation_epoch"],
      "properties": {
        "reference": {"type": "string", "pattern": "@sha256:[a-f0-9]{64}$", "maxLength": 4096},
        "statement_file": {"$ref": "#/$defs/absolutePath"},
        "signature_file": {"$ref": "#/$defs/absolutePath"},
        "public_key_file": {"$ref": "#/$defs/absolutePath"},
        "trusted_key_id": {"type": "string", "minLength": 1, "maxLength": 256},
        "minimum_revocation_epoch": {"type": "integer", "minimum": 1},
        "registry_auth_file": {"$ref": "#/$defs/absolutePath"}
      }
    },
    "security": {
      "type": "object",
      "additionalProperties": false,
      "required": ["seccomp_name", "seccomp_file"],
      "properties": {
        "seccomp_name": {"type": "string", "minLength": 1, "maxLength": 256},
        "seccomp_file": {"$ref": "#/$defs/absolutePath"},
        "lsm_name": {"type": "string", "minLength": 1, "maxLength": 256},
        "lsm_option": {"type": "string", "minLength": 1, "maxLength": 4096}
      },
      "dependentRequired": {"lsm_name": ["lsm_option"], "lsm_option": ["lsm_name"]}
    }
  }
}