Tyler King
b1865a0627
Bascule shell runtime workspace — governed shell access layer for Substrate/Guildhouse FFC deployments. Crates: - bascule-agent: node agent with SSH server + command filtering - bascule-core: audit, grant engine, ceremony types, session - bascule-filter-core: log line filtering (stdio protocol) - bascule-gateway: OIDC auth, session management, SAT validation - bascule-node-agent: k8s DaemonSet agent (pod watcher, BPF manager) - bascule-proto: protobuf definitions - bascule-shell: governed SSH shell (commands, elevation, REPL) - bascule-tail: chronicle log tail + fanout - ceremony-engine: ceremony lifecycle (6 types + request/resolution) 172 tests passing. Implements SBS-SPEC-0001 shell model. Reference impl for SPEC-SHELLOPS-0001 Layer 1 (root shell).
33 lines
864 B
Docker
33 lines
864 B
Docker
# Multi-stage build for bascule-agent
|
|
# Stage 1: Build
|
|
FROM rust:latest AS builder
|
|
|
|
WORKDIR /build
|
|
COPY . .
|
|
|
|
ENV SQLX_OFFLINE=true
|
|
RUN cd services && cargo build --release -p bascule-agent
|
|
|
|
# Stage 2: Runtime
|
|
FROM debian:bookworm-slim
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Create substrate user and directories
|
|
RUN groupadd -r substrate && useradd -r -g substrate substrate && \
|
|
mkdir -p /var/run/substrate /etc/substrate && \
|
|
chown substrate:substrate /var/run/substrate
|
|
|
|
COPY --from=builder /build/services/target/release/bascule-agent /usr/local/bin/bascule-agent
|
|
|
|
# Default config
|
|
COPY services/bascule-agent/tests/e2e-config.toml /etc/substrate/shell.toml
|
|
|
|
USER substrate
|
|
|
|
EXPOSE 2222
|
|
|
|
ENTRYPOINT ["bascule-agent"]
|
|
CMD ["--config", "/etc/substrate/shell.toml"]
|