Security Model

Mirrored from docs/security/model.md in the repository, 2026-08-05. The repo copy is authoritative for anything CI-cited (exact commands, workflow files, versions) — this page exists so the wiki is self-contained, but re-sync it from the source if the two drift.

Security model

Inputs must be a regular executable and the output must not already exist. Entrypoints must be clean absolute container paths; label keys cannot be duplicated. Files are written to a fresh temporary directory and atomically renamed to avoid partial output. SHA-256 identifies every blob. Tar and gzip timestamps, gzip OS, and the default created value are fixed, so identical input bytes and options produce identical layouts.

The builder never reads or copies credentials, source trees, environment variables, or host CA files. TLS/mTLS labels are metadata only. No OCI image configuration can enforce no_new_privileges or a read-only root filesystem: enforce those at runtime, for example docker run --read-only --security-opt no-new-privileges ..., Kubernetes securityContext.readOnlyRootFilesystem: true and allowPrivilegeEscalation: false, or equivalent containerd policy.

This is a summary. For the full asset/actor/trust-boundary model, the threat and control register (T01-T30), and documented residual risks, see the Threat Model. For which security-relevant capabilities are stable versus still experimental, see the maturity matrix.