{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://devnw.dev/isolation/schema/policy-v1.schema.json",
  "title": "devnw.dev/isolation policy v1",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "version"
  ],
  "properties": {
    "version": {
      "const": 1
    },
    "name": {
      "type": "string",
      "minLength": 1
    },
    "allowed_backends": {
      "type": "array",
      "items": {
        "enum": [
          "guarded",
          "native",
          "docker",
          "vm"
        ]
      },
      "minItems": 1,
      "uniqueItems": true
    },
    "backend_preference": {
      "type": "array",
      "items": {
        "enum": [
          "guarded",
          "native",
          "docker",
          "vm"
        ]
      },
      "minItems": 1,
      "uniqueItems": true
    },
    "required_assurance": {
      "enum": [
        "guarded",
        "native",
        "docker",
        "vm"
      ]
    },
    "required_features": {
      "type": "array",
      "items": {
        "enum": [
          "app-container",
          "capability-drop",
          "cgroup-v2",
          "clean-environment",
          "docker-api",
          "docker-rootless",
          "hyper-v",
          "job-object",
          "kill-to-empty",
          "lsm",
          "mount-namespace",
          "network-namespace",
          "no-new-privileges",
          "opaque-secrets",
          "pid-namespace",
          "read-only-root",
          "reviewed-export",
          "seccomp",
          "signed-attestation",
          "user-namespace",
          "verified-rootfs",
          "virtualization-framework",
          "vm-guest-auth",
          "worker-auth"
        ]
      },
      "uniqueItems": true
    },
    "allowed_workspace_modes": {
      "type": "array",
      "items": {
        "enum": [
          "copy",
          "bind",
          "volume"
        ]
      },
      "minItems": 1,
      "uniqueItems": true
    },
    "resources": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "cpu_quota_millis": {
          "$ref": "#/$defs/positiveInteger"
        },
        "memory_bytes": {
          "$ref": "#/$defs/positiveInteger"
        },
        "memory_swap_bytes": {
          "$ref": "#/$defs/positiveInteger"
        },
        "pids": {
          "$ref": "#/$defs/positiveInteger"
        },
        "open_files": {
          "$ref": "#/$defs/positiveInteger"
        },
        "locked_memory_bytes": {
          "type": "integer",
          "minimum": 0
        },
        "shared_memory_bytes": {
          "$ref": "#/$defs/positiveInteger"
        },
        "read_bytes": {
          "$ref": "#/$defs/positiveInteger"
        },
        "write_bytes": {
          "$ref": "#/$defs/positiveInteger"
        },
        "disk_bytes": {
          "$ref": "#/$defs/positiveInteger"
        },
        "runtime_millis": {
          "$ref": "#/$defs/positiveInteger"
        },
        "concurrent_cells": {
          "$ref": "#/$defs/positiveInteger"
        },
        "concurrent_processes": {
          "$ref": "#/$defs/positiveInteger"
        },
        "network_bytes": {
          "$ref": "#/$defs/positiveInteger"
        },
        "network_connections": {
          "$ref": "#/$defs/positiveInteger"
        }
      }
    },
    "network": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "mode": {
          "enum": [
            "none",
            "proxy-only",
            "allowlist"
          ]
        },
        "rules": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": false,
            "properties": {
              "host": {
                "type": "string",
                "minLength": 1
              },
              "port": {
                "type": "integer",
                "minimum": 1,
                "maximum": 65535
              },
              "protocol": {
                "enum": [
                  "tcp",
                  "udp"
                ]
              }
            }
          },
          "uniqueItems": true
        },
        "allow_ipv4": {
          "type": "boolean"
        },
        "allow_ipv6": {
          "type": "boolean"
        },
        "allow_published_ports": {
          "type": "boolean"
        },
        "allow_extra_hosts": {
          "type": "boolean"
        }
      }
    },
    "filesystem": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "read_only_root": {
          "type": "boolean"
        },
        "import_roots": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "uniqueItems": true
        },
        "export_roots": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "uniqueItems": true
        },
        "read_only_paths": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "uniqueItems": true
        },
        "masked_paths": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "uniqueItems": true
        },
        "max_import_bytes": {
          "$ref": "#/$defs/positiveInteger"
        },
        "max_import_files": {
          "$ref": "#/$defs/positiveInteger"
        },
        "max_export_bytes": {
          "$ref": "#/$defs/positiveInteger"
        },
        "max_export_files": {
          "$ref": "#/$defs/positiveInteger"
        },
        "tmpfs_bytes": {
          "$ref": "#/$defs/positiveInteger"
        },
        "scratch_bytes": {
          "$ref": "#/$defs/positiveInteger",
          "maximum": 8589934592
        },
        "exec_scratch": {
          "type": "boolean",
          "default": false
        },
        "require_review": {
          "type": "boolean"
        },
        "reject_special_files": {
          "type": "boolean"
        }
      }
    },
    "environment": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "allow": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "uniqueItems": true
        },
        "deny": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "uniqueItems": true
        },
        "values": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "max_bytes": {
          "$ref": "#/$defs/positiveInteger"
        }
      }
    },
    "output": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "stdout_bytes": {
          "$ref": "#/$defs/positiveInteger"
        },
        "stderr_bytes": {
          "$ref": "#/$defs/positiveInteger"
        },
        "combined_bytes": {
          "$ref": "#/$defs/positiveInteger"
        },
        "log_bytes": {
          "$ref": "#/$defs/positiveInteger"
        }
      }
    },
    "lifecycle": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "lease_millis": {
          "$ref": "#/$defs/positiveInteger"
        },
        "heartbeat_millis": {
          "$ref": "#/$defs/positiveInteger"
        },
        "create_millis": {
          "$ref": "#/$defs/positiveInteger"
        },
        "start_millis": {
          "$ref": "#/$defs/positiveInteger"
        },
        "stop_grace_millis": {
          "$ref": "#/$defs/positiveInteger"
        },
        "close_millis": {
          "$ref": "#/$defs/positiveInteger"
        },
        "reconcile_millis": {
          "$ref": "#/$defs/positiveInteger"
        },
        "retention_millis": {
          "$ref": "#/$defs/positiveInteger"
        }
      }
    },
    "docker": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "version": {
          "const": 1
        },
        "endpoint": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "allowed_classes": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "uniqueItems": true
            },
            "allowed_identities": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "uniqueItems": true
            },
            "api_min": {
              "type": "string"
            },
            "api_max": {
              "type": "string"
            },
            "require_rootless": {
              "type": "boolean"
            },
            "allow_rootful": {
              "type": "boolean"
            },
            "allow_remote": {
              "type": "boolean"
            },
            "allowed_wsl_distros": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "uniqueItems": true
            },
            "connect_timeout_millis": {
              "$ref": "#/$defs/positiveInteger"
            },
            "start_timeout_millis": {
              "$ref": "#/$defs/positiveInteger"
            }
          }
        },
        "image": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "allowed_references": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "uniqueItems": true
            },
            "allowed_registries": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "uniqueItems": true
            },
            "allowed_platforms": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "uniqueItems": true
            },
            "pull_policy": {
              "enum": [
                "never",
                "if-not-present",
                "always",
                "digest-refresh"
              ]
            },
            "allow_local": {
              "type": "boolean"
            },
            "require_digest": {
              "type": "boolean"
            },
            "require_signature": {
              "type": "boolean"
            },
            "require_provenance": {
              "type": "boolean"
            },
            "require_sbom": {
              "type": "boolean"
            },
            "max_vulnerability": {
              "enum": [
                "none",
                "low",
                "medium",
                "high",
                "critical"
              ]
            },
            "max_age_millis": {
              "$ref": "#/$defs/positiveInteger"
            },
            "max_unpacked_bytes": {
              "$ref": "#/$defs/positiveInteger"
            },
            "emergency_deny_digests": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "uniqueItems": true
            }
          }
        },
        "workspace": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "container_path": {
              "type": "string",
              "pattern": "^/"
            },
            "mode": {
              "enum": [
                "copy",
                "bind",
                "volume"
              ]
            },
            "read_only": {
              "type": "boolean"
            },
            "max_bytes": {
              "$ref": "#/$defs/positiveInteger"
            },
            "max_files": {
              "$ref": "#/$defs/positiveInteger"
            },
            "review_export": {
              "type": "boolean"
            }
          }
        },
        "process": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "entrypoint": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "minItems": 1
            },
            "workdir": {
              "type": "string",
              "pattern": "^/"
            },
            "uid": {
              "type": "integer",
              "minimum": 1
            },
            "gid": {
              "type": "integer",
              "minimum": 1
            },
            "groups": {
              "type": "array",
              "items": {
                "type": "integer",
                "minimum": 0
              },
              "uniqueItems": true
            },
            "environment": {
              "type": "object",
              "additionalProperties": {
                "type": "string"
              }
            },
            "init": {
              "type": "boolean"
            },
            "allow_pty": {
              "type": "boolean"
            },
            "deadline_millis": {
              "$ref": "#/$defs/positiveInteger"
            },
            "stop_grace_millis": {
              "$ref": "#/$defs/positiveInteger"
            },
            "output_bytes": {
              "$ref": "#/$defs/positiveInteger"
            }
          }
        },
        "filesystem": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "read_only_root": {
              "type": "boolean"
            },
            "tmpfs": {
              "type": "object",
              "additionalProperties": {
                "$ref": "#/$defs/positiveInteger"
              }
            },
            "masked_paths": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "uniqueItems": true
            },
            "read_only_paths": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "uniqueItems": true
            },
            "max_writable_bytes": {
              "$ref": "#/$defs/positiveInteger"
            },
            "allowed_volume_drivers": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "uniqueItems": true
            },
            "private_propagation": {
              "type": "boolean"
            }
          }
        },
        "resources": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "cpu_quota_millis": {
              "$ref": "#/$defs/positiveInteger"
            },
            "memory_bytes": {
              "$ref": "#/$defs/positiveInteger"
            },
            "memory_swap_bytes": {
              "$ref": "#/$defs/positiveInteger"
            },
            "pids": {
              "$ref": "#/$defs/positiveInteger"
            },
            "open_files": {
              "$ref": "#/$defs/positiveInteger"
            },
            "shared_memory_bytes": {
              "$ref": "#/$defs/positiveInteger"
            },
            "disk_bytes": {
              "$ref": "#/$defs/positiveInteger"
            },
            "log_bytes": {
              "$ref": "#/$defs/positiveInteger"
            },
            "runtime_millis": {
              "$ref": "#/$defs/positiveInteger"
            },
            "concurrent_execs": {
              "$ref": "#/$defs/positiveInteger"
            }
          }
        },
        "security": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "privileged": {
              "type": "boolean"
            },
            "capability_add": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "uniqueItems": true
            },
            "no_new_privileges": {
              "type": "boolean"
            },
            "seccomp_profile": {
              "type": "string"
            },
            "lsm_profile": {
              "type": "string"
            },
            "user_namespace": {
              "type": "string"
            },
            "runtime": {
              "type": "string"
            },
            "allow_devices": {
              "type": "boolean"
            },
            "allowed_sysctls": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "uniqueItems": true
            },
            "allow_host_pid": {
              "type": "boolean"
            },
            "allow_host_ipc": {
              "type": "boolean"
            },
            "allow_host_network": {
              "type": "boolean"
            }
          }
        },
        "network": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "mode": {
              "enum": [
                "none",
                "proxy-only",
                "allowlist"
              ]
            },
            "rules": {
              "type": "array",
              "items": {
                "type": "object",
                "additionalProperties": false,
                "properties": {
                  "host": {
                    "type": "string",
                    "minLength": 1
                  },
                  "port": {
                    "type": "integer",
                    "minimum": 1,
                    "maximum": 65535
                  },
                  "protocol": {
                    "enum": [
                      "tcp",
                      "udp"
                    ]
                  }
                }
              },
              "uniqueItems": true
            },
            "dedicated": {
              "type": "boolean"
            },
            "allow_published_ports": {
              "type": "boolean"
            },
            "allow_extra_hosts": {
              "type": "boolean"
            },
            "allow_host_gateway": {
              "type": "boolean"
            },
            "max_bytes": {
              "$ref": "#/$defs/positiveInteger"
            },
            "max_connections": {
              "$ref": "#/$defs/positiveInteger"
            }
          }
        },
        "lifecycle": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "lease_millis": {
              "$ref": "#/$defs/positiveInteger"
            },
            "heartbeat_millis": {
              "$ref": "#/$defs/positiveInteger"
            },
            "start_millis": {
              "$ref": "#/$defs/positiveInteger"
            },
            "stop_millis": {
              "$ref": "#/$defs/positiveInteger"
            },
            "remove_millis": {
              "$ref": "#/$defs/positiveInteger"
            },
            "readiness_millis": {
              "$ref": "#/$defs/positiveInteger"
            },
            "reconcile_millis": {
              "$ref": "#/$defs/positiveInteger"
            },
            "retention_millis": {
              "$ref": "#/$defs/positiveInteger"
            }
          }
        },
        "observability": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "capture_events": {
              "type": "boolean"
            },
            "capture_stats": {
              "type": "boolean"
            },
            "audit": {
              "type": "boolean"
            },
            "attest": {
              "type": "boolean"
            },
            "redact": {
              "type": "boolean"
            },
            "max_event_bytes": {
              "$ref": "#/$defs/positiveInteger"
            },
            "max_support_bundle_bytes": {
              "$ref": "#/$defs/positiveInteger"
            }
          }
        }
      }
    }
  },
  "$defs": {
    "positiveInteger": {
      "type": "integer",
      "minimum": 1
    }
  }
}