Subtask of #169 (worth doing later, ranked 7).
The docker job builds the image and stops. Nothing ever runs the assembled
container — so distroless behaviour, the nonroot user, environment defaults, and
the BUGWARDEN_POLICY refuse-to-start path are all unverified in the artifact
that actually ships.
Precedent: #114 was a shipped container-behaviour defect (SIGTERM handling).
binary_shutdown.rs covers signals at the binary level, which is not the same
thing as covering them in a distroless image with a different PID 1 story.
Suggested direction
Run the built image in the docker job: start it with a mounted policy, assert
it serves; start it without one, assert it refuses to start rather than serving
unguarded. Both are cheap and both pin properties nothing currently tests.
Related, worth checking in the same pass: whether a mounted read-only policy file
and a missing MCP_READ_ONLY behave as the docs claim inside the image, not just
on the host.
Subtask of #169 (worth doing later, ranked 7).
The
dockerjob builds the image and stops. Nothing ever runs the assembledcontainer — so distroless behaviour, the nonroot user, environment defaults, and
the
BUGWARDEN_POLICYrefuse-to-start path are all unverified in the artifactthat actually ships.
Precedent: #114 was a shipped container-behaviour defect (SIGTERM handling).
binary_shutdown.rscovers signals at the binary level, which is not the samething as covering them in a distroless image with a different PID 1 story.
Suggested direction
Run the built image in the
dockerjob: start it with a mounted policy, assertit serves; start it without one, assert it refuses to start rather than serving
unguarded. Both are cheap and both pin properties nothing currently tests.
Related, worth checking in the same pass: whether a mounted read-only policy file
and a missing
MCP_READ_ONLYbehave as the docs claim inside the image, not juston the host.