Roberto Polli ioggstream

Container Security: gVisor (`runsc`) Adoption Guide

A short guide to sandboxing dev containers (e.g. an agent like Claude Code, or untrusted test runs) with gVisor under Docker / Docker Compose.

runsc interposes a user-space "Sentry" kernel between the container and the host. It intercepts syscalls and re-implements a subset of the Linux

	dip(){
	# Show docker ips
	local arg=${1}
	if [ -z "$arg" ]; then
	arg=$(docker ps -q)
	fi
	docker inspect --format ' {{.Name}} {{.NetworkSettings.IPAddress}} {{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' $arg
	}

	openapi: 3.0.3
	info:
	title: Schema API del WaaS Consultazione Pensioni
	description: Schema API del WaaS Consultazione Pensioni relativo all'e-service pubblicato sulla PDND al seguente link https://api.inps.it/pdnd/rest/waas-consultazione-pensioni/v1
	version: "1.0.0"
	termsOfService: https://example.com/terms/
	x-summary: "Servizio rivolto alla consultazione delle pensioni"
	x-api-id: "waas-pensioni-consultazione"
	paths: {}
	components:

	openapi: 3.0.3
	info:
	title: Schema della Pratica di Riscatto
	version: 202401.18.00
	x-summary: Schema della Pratica di Riscatto compatibile con l'Ontologia INPS relativa ai contributi previdenziali.
	license:
	name: CC BY 4.0
	url: https://creativecommons.org/licenses/by/4.0/
	termsOfService: https://creativecommons.org/licenses/by/4.0/
	contact:

	@prefix ns: <https://csrc.nist.gov/ns/csf> .
	@prefix skos: <http://www.w3.org/2004/02/skos/core#> .

	<https://csrc.nist.gov/ns/csf> a owl:Ontology ;
	rdfs:comment "The NIST Cybersecurity Framework (CSF) 2.0 provides guidance to industry, government agencies, and other organizations to manage cybersecurity risks. It offers a taxonomy of high-level cybersecurity outcomes that can be used by any organization — regardless of its size, sector, or maturity — to better understand, assess, prioritize, and communicate its cybersecurity efforts." ;
	owl:versionInfo "2.0" ;
	dcterms:creator "NIST" ;
	dcterms:description "An OWL ontology representing the NIST Cybersecurity Framework version 2.0, including Functions, Categories, and Subcategories for managing cybersecurity risks." ;
	dcterms:issued "2024-02-26"^^xsd:date ;
	dcterms:license <https://www.nist.gov/open/copyright-fair-use-and-licensing-statements-srd-data-software-and-technical-series-publications> ;

	openapi: 3.0.0
	info:
	title: Data model per evento
	version: '1.29.0'
	paths:
	"/":
	get:
	description: Metodo di default
	responses:
	"200":

	#
	# Useful aliases for docker to be placed in /etc/profile.d
	#
	dip(){
	# Show docker ips
	local arg=${1}
	if [ -z "$arg" ]; then
	arg=$(docker ps -q)
	fi
	docker inspect --format ' {{.Name}} {{.NetworkSettings.IPAddress}} {{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' $arg

	openapi: 3.0.3
	info:
	title: Schema del Servizio di Notifica Generalità
	description: \|-
	Lo schema dati del servizio che viene invocato per ottenere le generalità, l’esistenza in vita, la residenza, l’eventuale domicilio digitale presenti in ANPR per un cittadino, alla data di riferimento della richiesta
	Pattern Model applicati:
	- [AUDIT_REST_02 ] Inoltro dati tracciati nel dominio del Fruitore REST con correlazione
	- [BLOCK_REST] Blocking REST
	- [INTEGRITY_REST_02] Integrità del payload messaggio REST in PDND
	version: '1.0.0'

	components:
	schemas:
	PuntoDiContattoOnline:
	title: Punto di Contatto Online
	description: \|
	Questa classe rappresenta un punto di contatto online. Essa raggruppa un insieme di tipi di canali di contatto online come account di social network, email, siti web, ecc.
	type: object
	x-jsonld-type: "https://w3id.org/italia/onto/SM/OnlineContactPoint"
	x-jsonld-context:
	"@vocab": "https://w3id.org/italia/onto/SM/"