ms2k/remora
SHA256
Watch
0
Code Releases Activity

Enforce immutable supply chain defaults

Browse source
This commit is contained in:
ms2k 2026-08-21 14:25:58 +09:00
commit 19ac156f4b
1 changed files with 187 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/spec/deployment.md
View file

@ -31,6 +31,8 @@ managed.
## Security
Workload and Vault images require SHA-256 digests by default. A deployment that intentionally accepts a mutable tag enables the corresponding `allowTag` escape hatch explicitly.
NetworkPolicies default-deny each workload, isolate the Worker and management
ports, and allow dependencies by selector or CIDR. The WebBFF may reach only
the API, identity provider, and its session store. Public source egress excludes