Documentation
¶
Overview ¶
Package harden is the capability module that surfaces runtime-confinement findings through the engine. It is a thin adapter: the deterministic work — parsing a container/pod/OCI spec, verifying it against the hardening baseline, generating least-privilege profiles — lives in internal/harden. This package maps that library onto the Module contract and the `dsecrat harden` command.
The module verifies a container/pod/OCI-runtime spec (TargetContainer). Its core checks are always-on and deterministic; the agent-appliable hardening bundle (the AI-age feature) stays OFF unless a caller opts in, so correctness never depends on it.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Command ¶
Command implements `dsecrat harden <subcommand>`, returning a process exit code (0 ok, 2 usage error, 1 runtime error).
func Register ¶
Register adds the harden module to the registry with its default (deterministic baseline) configuration. The master agent calls this from modules.Default() during integration; per SHARED_CONTRACT §2 this package never edits the shared registry file itself. See NOTES.md for the one-line wiring.
To enable the off-by-default agent-appliable hardening bundle in a given frontend, register a configured instance instead:
r.Register(harden.New(harden.WithHardeningBundle()))
Types ¶
type Module ¶
type Module struct {
// contains filtered or unexported fields
}
Module verifies workload isolation posture and (opt-in) emits an agent-appliable hardening bundle.
func New ¶
New returns a harden module. With no options it is the deterministic baseline verifier with the bundle feature off.
func (*Module) Analyze ¶
Analyze parses the target's spec, verifies every container it describes, and projects the results into findings. A Kubernetes Pod yields one workload per container. Input that is valid JSON but not a spec we recognise yields no findings (the module stays quiet rather than erroring), mirroring the other spec-driven modules.
Source Files