feat: add White Security Specification for container security management - #4
Merged
Conversation
- Introduced a comprehensive specification document detailing security features including user namespace management, seccomp profiles, capabilities, AppArmor/SELinux integration, and image signing. - Implemented requirements and scenarios for rootless container setup, seccomp defaults, capability management, and security diagnostics. chore: configure release-please for automated versioning - Added release-please configuration to manage versioning and changelog generation. test: add utility functions for testing with OCI registries - Created test utilities for pushing random and multi-platform images to an in-process OCI registry. - Implemented helper functions for managing test registries and generating fake digests.
📝 WalkthroughWalkthroughThis PR implements core OCI image management functionality for Maestro, including a registry client (Shardik), local content-addressable storage (Maturin), credential handling (Sigul), HTTP resilience (Horn), CLI commands for image operations (pull, login, logout, image ls/inspect/history/rm), and comprehensive specification documents defining system architecture. Changes
Sequence Diagram(s)sequenceDiagram
actor User as User/CLI
participant CLI as Image Commands
participant Maturin as Maturin<br/>(Storage)
participant Shardik as Shardik<br/>(Registry Client)
participant Registry as Remote<br/>Registry
participant Sigul as Sigul<br/>(Credentials)
User->>CLI: maestro pull nginx:latest
CLI->>Sigul: Resolve credentials for docker.io
Sigul-->>CLI: Auth token
CLI->>Shardik: GetManifest(nginx:latest)
Shardik->>Registry: Fetch manifest
Registry-->>Shardik: Manifest descriptor
Shardik-->>CLI: Manifest
CLI->>Shardik: GetImage(manifest)
Shardik->>Registry: Fetch config blob
Registry-->>Shardik: Config
Shardik-->>CLI: Image with layers
CLI->>Maturin: Draw(image, layers)
loop For each layer
Maturin->>Maturin: Check if blob exists
alt Blob exists
Maturin-->>CLI: Progress(skipped)
else Blob missing
Maturin->>Shardik: GetBlob(layer digest)
Shardik->>Registry: Download layer
Registry-->>Shardik: Layer data
Shardik-->>Maturin: Layer stream
Maturin->>Maturin: Verify SHA256 digest
Maturin->>Maturin: Store blob in CAS
Maturin-->>CLI: Progress(pulled, size)
end
end
Maturin->>Maturin: Finalize manifest & index
Maturin-->>CLI: Success
CLI-->>User: Pull complete
Estimated code review effort🎯 5 (Critical) | ⏱️ ~120 minutes The PR implements substantial, interdependent subsystems (image storage, registry client, credential handling, HTTP resilience) with complex logic including concurrent access control, cryptographic operations, atomic file I/O, and multi-platform selection. High logic density across heterogeneous components requires careful validation of correctness for digest verification, locking behavior, error handling, and API consistency. Possibly related PRs
Poem
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
|
garnizeh
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces several improvements to the CI/CD pipeline, updates documentation to require Go 1.26.2, and adds automation for releases. The most significant changes include restricting CI runs to the
mainbranch, adding a Release Please workflow for automated versioning and changelog management, and ensuring the Go version is embedded in build artifacts. Additionally, the documentation and roadmap have been updated to reflect the new Go version requirement.CI/CD Pipeline Improvements
.github/workflows/ci.yml) now only runs on pushes and pull requests targeting themainbranch, reducing unnecessary CI runs on pattern-matched branches.make vulntarget, centralizing the command in theMakefilefor consistency. [1] [2]ci-localtarget in theMakefilewas refactored to use existing Makefile targets for linting, vulnerability scanning, testing, and building, reducing duplication.Release Automation
.github/workflows/release-please.yml) to automate versioning and changelog generation, along with its manifest file (.release-please-manifest.json). [1] [2]GOVERSIONenvironment variable and linker flags. [1] [2] [3]Documentation Updates
README.md,docs/design-document.md, anddocs/roadmap.md. [1] [2] [3] [4]Other Minor Changes
vulnMakefile target for runninggovulncheck.Summary by CodeRabbit
New Features
maestro imagecommands:pull(with--platformsupport),ls,inspect,history, andrmfor full image lifecycle management.maestro loginandlogoutfor container registry authentication.Chores