Static inputs are untrusted: OCI JSON, descriptors, tar paths, compressed layers, ELF structures, and imported traces are length-bounded and checked. OCI content hashes and diff IDs are verified before analysis. Archive extraction is modeled in memory; runtime materialization rejects symlink ancestors and special files. No image-specified host command is executed during static scanning.
Dynamic analysis executes the supplied workload. Use a disposable Linux CI machine appropriate for untrusted native containers. It creates runc/runsc sandboxes with no external network, no host directory mounts, dropped capabilities, new namespaces, timeouts, output budgets, and resource limits. The native comparison is only as isolated as runc and the host kernel. Rootful runtime management is a privileged operation. This project does not claim that dynamic analysis is read-only or that arbitrary container execution has no attack surface.
The default tracer is the trusted host installation of strace. For a dynamically linked tracer, its loader and libraries are copied into a reserved rootfs directory and used only to start the tracer. Never supply an untrusted host executable through --strace-bin, --runc-bin, or --runsc-bin. Treat trace artifacts as potentially sensitive application data; they can contain file paths, arguments, and output.
The native trace is stored in a guest-writable tracer directory. A malicious workload can modify that trace or its output. Local execution labels and SHA-256 hashes do not prevent such tampering, and signing a report does not retrospectively make its collection trustworthy. The parser separates diagnostic chatter from discarded guest records; malformed records and missing completions prevent a clean scan. It validates balanced call syntax and pinned runsc framing, but text logs and user-controlled task names are not authenticated messages. A nonempty, well-formed trace does not prove complete capture or prevent every forged log record. SENTRYCHECK's dynamic results are empirical compatibility evidence under a trusted CI producer, not an adversarial execution attestation.
doctor executes bounded version probes of configured trusted host tools; it does not launch the target workload or install/configure anything. report validate checks report consistency and optionally artifact hashes and trace interpretation within --artifacts-root. It does not authenticate the author or collection environment. report diff likewise assumes trustworthy reports and comparable hosts. SARIF context files are explicit user associations, not recovered source locations. See docs/CI-TOOLS.md for command-specific guarantees.
report render embeds report data in an offline Astro page. Native JSON receives report consistency checks; SARIF receives reduced-format consistency checks. Neither authenticates the producer or verifies referenced trace artifacts. Browser file imports are structural checks only. The HTML serializer escapes script delimiters; the viewer treats report content as text and disables external resources and connections through CSP. Citation navigation remains an explicit user action. An edited HTML page can misrepresent its payload, and its input hash is not a signature. Keep the original report when verifying signed evidence.
OCI annotations and Pod annotations are not authorization inputs. The signing command creates a compact Ed25519 claim bound to the exact report hash, platform image digest, runtime version, architecture, scan time, and profile. The controller rejects unknown keys, altered signatures, expired claims, stale scans, and runtime mismatches. Keep private keys outside version control and workload namespaces; rotate public trust keys through the controller config.
sentrycheck-admission verify --file envelope.json --public-key ci-public.pem --report report.json verifies the signature and binds the supplied report's exact bytes to its signed digest. Omitting --report verifies the compact claim only. Retain original report bytes: reformatting JSON changes its digest. Neither mode proves that a trusted signer used an uncompromised runner.
The node probe needs the container-runtime socket, which is effectively privileged host control. Restrict its namespace and service account to trusted infrastructure. Its binary/version/CRI canary check detects drift; it is not an attestation against an actively compromised host. The controller owns protected node labels and parameter snapshots. Enable the NodeRestriction admission plugin and Node authorizer, protect RuntimeClass writes, and monitor controller readiness. See the controller-outage limitation in LIMITATIONS.md.
Use separate Pod Security controls to prohibit privileged containers, host namespaces, and host mounts where the workload trust model requires them. Limit direct binding, scheduler credentials, and pods/binding access to trusted infrastructure; the compatibility policy is not a universal scheduling authorization layer. During a controller outage, stale labels and snapshots can remain usable by CEL, which has no wall clock. Monitor freshness and suspend new sandbox scheduling until reconciliation recovers.
To report a vulnerability before a public repository is established, contact the repository owner privately. No public security contact or disclosure SLA has been invented for this initial implementation.