holger-sandbox-5.0.0
Holger's scan sandbox: runs the scan worker over one artifact in a hardened rootless podman container (no network, read-only artifact and rootfs, capped tmpfs scratch, CPU/memory/pids limits, a wall-clock timeout, no capabilities, no-new-privileges, a non-root user) and hands back only its capped stdout. Fails closed, by name, when no engine is there.
59 seconds ago