mirror of
https://github.com/lima-vm/lima.git
synced 2026-10-28 11:44:35 +08:00
Jan Dubois
1311c7fa5d
Anthropic's OSS Scanner builds an enrolled project's Dockerfile with network access, scans the resulting image offline, and emails its findings to the project. Keeping the Dockerfile and the threat model in this repository lets us change them without a pull request to the scanner's enrollment repository. The image boots the default instance once during the build, while the network is up, so the scanner can start it offline and probe the host from a real guest. We expect the scanner's machine to provide nested KVM; without it, QEMU emulates the CPU and the boot is slow. The threat model summarizes Lima's CNCF self-assessment for the scanner. It also treats everything in the guest, guest root included, as untrusted, because the docs recommend Lima as a sandbox for AI agents. Signed-off-by: Jan Dubois <jan.dubois@suse.com>
46 lines
1007 B
YAML
46 lines
1007 B
YAML
# ls-lint configuration file.
|
|
# https://ls-lint.org/2.2/configuration/the-basics.html
|
|
ls:
|
|
.dir: kebab-case
|
|
.go: snake_case
|
|
.lima: snake_case
|
|
.sh: kebab-case
|
|
.TEMPLATE.yaml: kebab-case
|
|
.yaml: kebab-case
|
|
.yml: kebab-case
|
|
|
|
.github:
|
|
.yaml: snake_case
|
|
|
|
.oss-scanner:
|
|
.md: snake_case
|
|
|
|
cmd/limactl:
|
|
# valid names are `show-ssh.go`, `show-ssh_windows.go` or `show-ssh_test.go`
|
|
.go: lowercase
|
|
|
|
templates:
|
|
# _default and _images have leading underscores
|
|
.dir: lowercase
|
|
|
|
website/content:
|
|
.dir: lowercase
|
|
|
|
ignore:
|
|
- .git
|
|
- .golangci.yml
|
|
- .ls-lint.yml
|
|
- '_output'
|
|
- '**/*.pb\.go'
|
|
- hack/common.inc.sh
|
|
- pkg/cidata/cidata.TEMPLATE.d
|
|
- pkg/cidata/cidata.TEMPLATE.d/util/compare_version.sh
|
|
- pkg/cidata/cidata.TEMPLATE.d/util/escape_fstab.sh
|
|
- pkg/cidata/cidata.TEMPLATE.d/util/unescape_fstab.sh
|
|
- pkg/cidata/wincidata.TEMPLATE.d
|
|
- website
|
|
# "ubuntu-24.04" does not follow the kebab-case
|
|
- '**/ubuntu-*\.yaml'
|
|
# "boot.<OS>" does not follow the kebab-case
|
|
- '**/boot.*'
|