cgalo5758
5829091881
The contained runner that drove the 2026-09 security audit, the README review and four rounds of design ideation lived only inside the ignored notebook. It moves to scripts/agent-runner/: the prepare, tools, audit, ideation and teardown scripts, the compose and container files, the allowlist proxy and the prompt templates, with the paths that assumed the notebook fixed and findings written to a caller-named directory. Run outputs, transcripts and the round-specific sheet scripts stay behind. docs/agent-runner.md states the method: the disposable git archive copy and the fail-closed proxy, how a task is shaped, union rather than intersection of findings across models, separate adjudication of every finding against the source, and the evidence a finding must carry.
59 lines
2.9 KiB
Docker
59 lines
2.9 KiB
Docker
# Auditor image: a disposable environment holding opencode plus a deterministic
|
|
# security toolchain. No host credentials are baked in; the only secret reaching
|
|
# a running container is the read-only opencode auth.json mounted at runtime.
|
|
#
|
|
# Everything that needs the network is fetched HERE, at build time, where the
|
|
# daemon has normal egress. At RUN time the container sits on an internal
|
|
# network whose only exit is the allowlist proxy, so the scanners must be
|
|
# fully offline: hence the baked Go vulnerability database and semgrep rules.
|
|
# 1.27.1 to match the project's go.mod directive (staticcheck needs 1.26+;
|
|
# GOTOOLCHAIN=local, so the base version is the version you get.
|
|
FROM golang:1.27.1-bookworm
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
git ripgrep ca-certificates curl unzip jq python3 python3-venv \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# opencode via the vendor install script (a platform binary, so no Node runtime).
|
|
RUN curl -fsSL https://opencode.ai/install | bash
|
|
# GOPATH is /go in the official images, so `go install` lands in /go/bin.
|
|
# Login shells reset PATH from /etc/profile, so the tools are also symlinked
|
|
# into /usr/local/bin below — never rely on this ENV alone.
|
|
ENV PATH="/root/.opencode/bin:/go/bin:${PATH}"
|
|
|
|
# Go security tooling.
|
|
# gosec — Go-specific insecure patterns (G1xx-G7xx), fully offline
|
|
# govulncheck — known CVEs filtered by symbol-level reachability
|
|
# staticcheck — correctness bugs (nil derefs, races) behind security bugs
|
|
# gitleaks — committed secrets
|
|
RUN go install github.com/securego/gosec/v2/cmd/gosec@latest \
|
|
&& go install golang.org/x/vuln/cmd/govulncheck@latest \
|
|
&& go install honnef.co/go/tools/cmd/staticcheck@latest \
|
|
&& go install github.com/zricethezav/gitleaks/v8@latest \
|
|
&& ln -s /go/bin/gosec /go/bin/govulncheck /go/bin/staticcheck /go/bin/gitleaks \
|
|
/usr/local/bin/
|
|
|
|
# semgrep plus its rule corpus, cloned for offline use (--config auto would
|
|
# hit the registry and report the project URL upstream; we never use it).
|
|
RUN python3 -m venv /opt/semgrep \
|
|
&& /opt/semgrep/bin/pip install --no-cache-dir --quiet semgrep \
|
|
&& ln -s /opt/semgrep/bin/semgrep /usr/local/bin/semgrep \
|
|
&& git clone --depth 1 https://github.com/semgrep/semgrep-rules /opt/semgrep-rules
|
|
|
|
# Offline Go vulnerability database: any file:// directory implements the API,
|
|
# so govulncheck runs with no network at all.
|
|
RUN curl -sL https://vuln.go.dev/vulndb.zip -o /tmp/vulndb.zip \
|
|
&& mkdir -p /opt/vulndb \
|
|
&& unzip -q /tmp/vulndb.zip -d /opt/vulndb \
|
|
&& rm /tmp/vulndb.zip
|
|
|
|
# Bake the project's module cache so govulncheck and staticcheck can load
|
|
# packages with no network at run time. prepare.sh exports .code/ before it
|
|
# builds, so these files are present in the build context.
|
|
COPY .code/go.mod .code/go.sum /build/
|
|
RUN cd /build && go mod download
|
|
|
|
ENV SEMGREP_SEND_METRICS=off
|
|
WORKDIR /src
|
|
CMD ["opencode", "--version"]
|