acr-control-plane 1.1.3__tar.gz

acr_control_plane-1.1.3/.env.example

@@ -0,0 +1,123 @@
+# ACR Control Plane — Environment Variable Template
+#
+# HOW TO USE:
+#   Development : cp .env.example .env  (defaults work for local docker-compose)
+#   Staging/Prod: populate each CHANGE_ME value with a strong random secret.
+#                 Use a secrets manager (Vault, AWS SM, K8s Secrets) — never
+#                 commit real credentials to version control.
+#
+# Generate strong secrets with:
+#   python -c "import secrets; print(secrets.token_hex(32))"
+
+# ── Database ──────────────────────────────────────────────────────────────────
+# Format: postgresql+asyncpg://<user>:<password>@<host>:<port>/<db>
+DATABASE_URL=postgresql+asyncpg://acr:acr_dev_password@localhost:5432/acr_control_plane
+
+# Postgres service credentials (used by docker-compose postgres healthcheck)
+POSTGRES_USER=acr
+POSTGRES_PASSWORD=acr_dev_password
+POSTGRES_DB=acr_control_plane
+
+# ── Redis ─────────────────────────────────────────────────────────────────────
+REDIS_URL=redis://localhost:6379/0
+
+# ── Open Policy Agent ─────────────────────────────────────────────────────────
+OPA_URL=http://localhost:8181
+
+# ── Kill Switch ───────────────────────────────────────────────────────────────
+KILLSWITCH_URL=http://localhost:8443
+# Minimum 32 random bytes (hex). Required on ALL kill switch endpoints.
+# Dev default is rejected in staging/production at startup.
+KILLSWITCH_SECRET=killswitch_dev_secret_change_me
+
+# ── JWT Authentication ────────────────────────────────────────────────────────
+# HS256 requires >= 256-bit (32-byte) key.
+# The server will refuse to start in non-development environments if this
+# is set to a known-weak value or fewer than 32 bytes.
+JWT_SECRET_KEY=dev_jwt_secret_change_in_production
+JWT_ALGORITHM=HS256
+JWT_TOKEN_EXPIRE_MINUTES=30
+
+# ── Runtime ───────────────────────────────────────────────────────────────────
+# Accepted values: development | staging | production
+# Non-development environments enforce strong secret validation at startup.
+ACR_ENV=development
+LOG_LEVEL=INFO
+ACR_VERSION=1.0
+SCHEMA_BOOTSTRAP_MODE=auto
+STRICT_DEPENDENCY_STARTUP=false
+
+# ── Operator Auth / RBAC ─────────────────────────────────────────────────────
+# JSON object keyed by API key. Each value must include a subject and roles.
+# Example:
+# OPERATOR_API_KEYS_JSON={"change-me":{"subject":"platform-admin","roles":["agent_admin","approver","security_admin","auditor","killswitch_operator"]}}
+OPERATOR_API_KEYS_JSON=
+# Used by the main gateway when it calls the independent kill switch service.
+SERVICE_OPERATOR_API_KEY=
+OPERATOR_SESSION_SECRET=dev_operator_session_secret_change_me
+OIDC_ENABLED=false
+OIDC_ISSUER=
+OIDC_CLIENT_ID=
+OIDC_CLIENT_SECRET=
+OIDC_AUTHORIZE_URL=
+OIDC_TOKEN_URL=
+OIDC_JWKS_URL=
+OIDC_REDIRECT_URI=
+OIDC_SCOPES=openid profile email groups
+OIDC_ROLES_CLAIM=groups
+OIDC_SUBJECT_CLAIM=email
+OIDC_ROLE_MAPPING_JSON=
+OIDC_SESSION_TTL_SECONDS=28800
+
+# ── Approval Webhook ─────────────────────────────────────────────────────────
+# Leave blank to disable outbound webhook notifications.
+WEBHOOK_URL=
+# If set, each webhook POST carries X-ACR-Signature: <hmac-sha256-hex>.
+# Receivers must verify this header before trusting the payload.
+# Minimum 32 random bytes (hex). Leave blank to skip signing.
+WEBHOOK_HMAC_SECRET=
+# Minimum 32 random bytes (hex). Used to sign audit/evidence bundles.
+AUDIT_SIGNING_SECRET=dev_audit_signing_secret_change_me
+
+# ── OpenTelemetry ─────────────────────────────────────────────────────────────
+# Leave blank to disable OTLP trace export (e.g. http://localhost:4318).
+OTEL_EXPORTER_OTLP_ENDPOINT=
+OTEL_SERVICE_NAME=acr-control-plane
+
+# ── Downstream Execution ─────────────────────────────────────────────────────
+# If true, allowed actions and approved escalations will POST to the configured tool executor URL.
+EXECUTE_ALLOWED_ACTIONS=false
+# Example: {"query_customer_db":"https://executor.internal/query-customer","issue_refund":"https://executor.internal/refund"}
+TOOL_EXECUTOR_MAP_JSON=
+# Structured integrations for common live business actions.
+# Supported providers: refund_api, email_api, ticket_api, http
+# Secret values can be referenced with env:NAME
+EXECUTOR_INTEGRATIONS_JSON=
+# Optional HMAC secret used to sign execution payloads with X-ACR-Execution-Signature.
+EXECUTOR_HMAC_SECRET=
+# Short-lived execution authorization TTL. Downstream executors should verify
+# X-ACR-Execution-Token so actions cannot bypass the control plane.
+EXECUTOR_AUTH_TTL_SECONDS=60
+# Optional secret used to mint short-lived brokered downstream credentials.
+# Downstream services can verify X-ACR-Brokered-Credential for audience/scope.
+EXECUTOR_CREDENTIAL_SECRET=
+EXECUTOR_CREDENTIAL_TTL_SECONDS=300
+EXECUTOR_TIMEOUT_SECONDS=8.0
+
+# ── Policy Bundle Publishing ────────────────────────────────────────────────
+# Supported backends:
+#   local : write bundles to the local filesystem
+#   s3    : write bundles to S3 or an S3-compatible object store
+REQUIRE_BUNDLE_AUTH=true
+POLICY_BUNDLE_BACKEND=local
+POLICY_BUNDLE_LOCAL_DIR=./var/policy_bundles
+# Required when POLICY_BUNDLE_BACKEND=s3
+POLICY_BUNDLE_S3_BUCKET=
+# Optional key prefix inside the bucket
+POLICY_BUNDLE_S3_PREFIX=acr/policy-bundles
+# Optional AWS region / S3-compatible region hint
+POLICY_BUNDLE_S3_REGION=
+# Optional S3-compatible endpoint URL (e.g. MinIO, R2, Ceph)
+POLICY_BUNDLE_S3_ENDPOINT_URL=
+# Optional public/base URL shown in release history instead of a filesystem path.
+POLICY_BUNDLE_PUBLIC_BASE_URL=

acr_control_plane-1.1.3/.env.production.example

@@ -0,0 +1,64 @@
+# ACR Control Plane — Production Environment Template
+#
+# Populate these values from a secret manager or generated output from:
+#   python scripts/generate_secrets.py > .env.production
+#
+# Do not commit real production values.
+
+DATABASE_URL=postgresql+asyncpg://acr:${POSTGRES_PASSWORD}@db.example.internal:5432/acr_control_plane
+REDIS_URL=redis://redis.example.internal:6379/0
+OPA_URL=http://opa.example.internal:8181
+KILLSWITCH_URL=http://acr-killswitch.example.internal:8443
+
+POSTGRES_USER=acr
+POSTGRES_PASSWORD=CHANGE_ME
+POSTGRES_DB=acr_control_plane
+
+JWT_SECRET_KEY=CHANGE_ME
+JWT_ALGORITHM=HS256
+JWT_TOKEN_EXPIRE_MINUTES=30
+
+KILLSWITCH_SECRET=CHANGE_ME
+AUDIT_SIGNING_SECRET=CHANGE_ME
+OPERATOR_SESSION_SECRET=CHANGE_ME
+WEBHOOK_HMAC_SECRET=CHANGE_ME
+EXECUTOR_HMAC_SECRET=CHANGE_ME
+EXECUTOR_CREDENTIAL_SECRET=CHANGE_ME
+EXECUTOR_AUTH_TTL_SECONDS=60
+EXECUTOR_CREDENTIAL_TTL_SECONDS=300
+
+ACR_ENV=production
+LOG_LEVEL=INFO
+SCHEMA_BOOTSTRAP_MODE=validate
+STRICT_DEPENDENCY_STARTUP=true
+
+OPERATOR_API_KEYS_JSON=CHANGE_ME
+SERVICE_OPERATOR_API_KEY=CHANGE_ME
+
+OIDC_ENABLED=true
+OIDC_ISSUER=https://idp.example.com
+OIDC_CLIENT_ID=CHANGE_ME
+OIDC_CLIENT_SECRET=CHANGE_ME
+OIDC_AUTHORIZE_URL=https://idp.example.com/oauth2/authorize
+OIDC_TOKEN_URL=https://idp.example.com/oauth2/token
+OIDC_JWKS_URL=https://idp.example.com/.well-known/jwks.json
+OIDC_REDIRECT_URI=https://acr.example.com/acr/auth/oidc/callback
+OIDC_SCOPES=openid profile email groups
+OIDC_ROLES_CLAIM=groups
+OIDC_SUBJECT_CLAIM=email
+OIDC_ROLE_MAPPING_JSON={"acr-platform-admin":["agent_admin","approver","security_admin","auditor","killswitch_operator"]}
+
+EXECUTE_ALLOWED_ACTIONS=true
+TOOL_EXECUTOR_MAP_JSON=CHANGE_ME
+EXECUTOR_INTEGRATIONS_JSON=
+
+WEBHOOK_URL=
+OTEL_EXPORTER_OTLP_ENDPOINT=
+
+REQUIRE_BUNDLE_AUTH=false
+POLICY_BUNDLE_BACKEND=s3
+POLICY_BUNDLE_S3_BUCKET=CHANGE_ME
+POLICY_BUNDLE_S3_PREFIX=acr/policy-bundles
+POLICY_BUNDLE_S3_REGION=us-east-1
+POLICY_BUNDLE_S3_ENDPOINT_URL=
+POLICY_BUNDLE_PUBLIC_BASE_URL=https://acr.example.com

acr_control_plane-1.1.3/.github/workflows/ci.yml

@@ -0,0 +1,180 @@
+name: CI
+
+on:
+  push:
+    branches: ["main", "develop"]
+  pull_request:
+    branches: ["main"]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # ── Lint ────────────────────────────────────────────────────────────────────
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+
+      - name: Install dev dependencies
+        run: pip install -e ".[dev]" ruff
+
+      - name: Ruff — format check
+        run: ruff format --check src/ tests/
+
+      - name: Ruff — lint
+        run: ruff check src/ tests/
+
+  # ── Tests ───────────────────────────────────────────────────────────────────
+  test:
+    name: Tests (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      - name: Run tests with coverage
+        env:
+          # Use safe test defaults — no real secrets needed in CI
+          JWT_SECRET_KEY: "ci_test_secret_not_for_production_at_all"
+          KILLSWITCH_SECRET: "ci_killswitch_secret_not_for_production"
+          ACR_ENV: "test"
+        run: |
+          pytest tests/ -v \
+            --ignore=tests/integration \
+            --cov=src/acr \
+            --cov-report=term-missing \
+            --cov-report=xml \
+            --cov-fail-under=80
+
+      - name: Upload coverage report
+        if: matrix.python-version == '3.11'
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: coverage.xml
+          retention-days: 7
+
+  # ── Integration Tests ──────────────────────────────────────────────────────
+  integration-tests:
+    name: Integration Tests
+    runs-on: ubuntu-latest
+    needs: [test]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Start services
+        run: docker-compose up -d postgres redis opa
+        working-directory: implementations/acr-control-plane
+
+      - name: Wait for services
+        run: |
+          timeout 60 bash -c 'until docker-compose exec -T postgres pg_isready; do sleep 2; done'
+          timeout 30 bash -c 'until curl -sf http://localhost:8181/health; do sleep 2; done'
+        working-directory: implementations/acr-control-plane
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+        working-directory: implementations/acr-control-plane
+
+      - name: Run integration tests
+        run: pytest tests/integration/ -v --tb=short
+        working-directory: implementations/acr-control-plane
+        env:
+          RUN_INTEGRATION_TESTS: "true"
+          TEST_DATABASE_URL: postgresql+asyncpg://acr:acr_dev_password@localhost:5432/acr_control_plane
+          TEST_REDIS_URL: redis://localhost:6379/1
+          TEST_OPA_URL: http://localhost:8181
+
+      - name: Tear down services
+        if: always()
+        run: docker-compose down -v
+        working-directory: implementations/acr-control-plane
+
+  # ── Security ─────────────────────────────────────────────────────────────────
+  security:
+    name: Security scan (pip-audit)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      - name: pip-audit — check for known CVEs
+        run: pip-audit --strict
+
+  # ── OPA policy tests ─────────────────────────────────────────────────────────
+  opa:
+    name: OPA policy tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install OPA
+        run: |
+          curl -L -o /usr/local/bin/opa \
+            https://openpolicyagent.org/downloads/v0.70.0/opa_linux_amd64_static
+          chmod +x /usr/local/bin/opa
+
+      - name: Verify OPA policies parse cleanly
+        run: opa check policies/
+
+      - name: Run OPA policy tests
+        run: opa test policies/ -v
+
+  # ── Docker build ─────────────────────────────────────────────────────────────
+  docker:
+    name: Docker build (${{ matrix.service }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - service: gateway
+            dockerfile: Dockerfile
+          - service: killswitch
+            dockerfile: Dockerfile.killswitch
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build ${{ matrix.service }} image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ${{ matrix.dockerfile }}
+          push: false
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: acr-${{ matrix.service }}:ci

acr_control_plane-1.1.3/.github/workflows/release.yml

@@ -0,0 +1,76 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  # ── Build & push versioned Docker images ────────────────────────────────────
+  docker-publish:
+    name: Publish ${{ matrix.service }} image
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - service: gateway
+            dockerfile: Dockerfile
+            image: ghcr.io/${{ github.repository }}/acr-gateway
+          - service: killswitch
+            dockerfile: Dockerfile.killswitch
+            image: ghcr.io/${{ github.repository }}/acr-killswitch
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ matrix.image }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=sha,prefix=sha-
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push ${{ matrix.service }}
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ${{ matrix.dockerfile }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  # ── Create GitHub Release ────────────────────────────────────────────────────
+  github-release:
+    name: Create GitHub Release
+    runs-on: ubuntu-latest
+    needs: docker-publish
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Create release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true
+          make_latest: true

acr_control_plane-1.1.3/.github/workflows/security.yml

@@ -0,0 +1,126 @@
+name: Security
+
+on:
+  push:
+    branches: ["main", "develop"]
+  pull_request:
+    branches: ["main"]
+  schedule:
+    - cron: "0 9 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  secret-hygiene:
+    name: Secret hygiene
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Block dev-secret patterns in production-facing assets
+        run: python scripts/check_no_dev_secrets.py
+
+  codeql:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["python"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@v3
+
+  semgrep:
+    name: Semgrep
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run Semgrep
+        uses: returntocorp/semgrep-action@v1
+        with:
+          config: >-
+            p/python
+            p/dockerfile
+            p/secrets
+
+  gitleaks:
+    name: Gitleaks
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run Gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  trivy-and-sbom:
+    name: Trivy and SBOM
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Trivy filesystem scan
+        uses: aquasecurity/trivy-action@0.24.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: sarif
+          output: trivy-results.sarif
+          severity: HIGH,CRITICAL
+
+      - name: Upload Trivy SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: trivy-results.sarif
+
+      - name: Generate CycloneDX SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          path: .
+          format: cyclonedx-json
+          output-file: sbom.cdx.json
+
+      - name: Upload SBOM artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: cyclonedx-sbom
+          path: sbom.cdx.json
+          retention-days: 30

acr_control_plane-1.1.3/.gitignore

@@ -0,0 +1,28 @@
+# OS and editor
+.DS_Store
+Thumbs.db
+*.swp
+*.swo
+*~
+.idea/
+.vscode/
+*.sublime-*
+
+# Local / env
+.env
+.env.local
+*.local
+
+# Build / generated (if any doc tooling is added later)
+_site/
+.cache/
+*.pyc
+__pycache__/
+
+# Generated local policy bundle artifacts
+implementations/acr-control-plane/var/policy_bundles/
+
+# Optional: uncomment if using a doc generator
+# node_modules/
+# .venv/
+# venv/

acr_control_plane-1.1.3/Dockerfile

@@ -0,0 +1,40 @@
+# Stage 1: build
+FROM python:3.12-slim AS builder
+# Version for hatch-vcs (no .git in build context). Set via --build-arg
+# from CI; defaults to 0.0.0+unknown for local builds.
+ARG SETUPTOOLS_SCM_PRETEND_VERSION=0.0.0+unknown
+WORKDIR /build
+RUN apt-get update && apt-get install -y --no-install-recommends gcc libpq-dev \
+    && rm -rf /var/lib/apt/lists/*
+COPY pyproject.toml README.md ./
+COPY src/ ./src/
+RUN pip install --no-cache-dir build wheel \
+    && pip wheel --no-cache-dir --wheel-dir /wheels .
+
+# Stage 2: runtime
+FROM python:3.12-slim AS runtime
+WORKDIR /app
+RUN apt-get update && apt-get install -y --no-install-recommends libpq5 curl \
+    && rm -rf /var/lib/apt/lists/*
+COPY --from=builder /wheels /wheels
+RUN pip install --no-cache-dir --no-index --find-links=/wheels acr-control-plane \
+    && rm -rf /wheels
+COPY src/ ./src/
+COPY policies/ ./policies/
+COPY alembic.ini ./
+# Migration entrypoint shared by the K8s init container, the docker-compose
+# `acr-migrate` one-shot service, and CI. Installed on PATH so it can be
+# invoked simply as `run-migrations` from any container using this image.
+COPY scripts/run-migrations.sh /usr/local/bin/run-migrations
+RUN chmod +x /usr/local/bin/run-migrations
+
+ENV PYTHONPATH=/app/src
+ENV PYTHONUNBUFFERED=1
+ENV WEB_CONCURRENCY=2
+
+EXPOSE 8000
+
+RUN useradd -r -u 1000 acr
+USER acr
+
+CMD ["uvicorn", "acr.main:app", "--host", "0.0.0.0", "--port", "8000"]

acr_control_plane-1.1.3/Dockerfile.killswitch

@@ -0,0 +1,33 @@
+# Stage 1: build
+FROM python:3.12-slim AS builder
+# Version for hatch-vcs (no .git in build context). Set via --build-arg
+# from CI; defaults to 0.0.0+unknown for local builds.
+ARG SETUPTOOLS_SCM_PRETEND_VERSION=0.0.0+unknown
+WORKDIR /build
+RUN apt-get update && apt-get install -y --no-install-recommends gcc \
+    && rm -rf /var/lib/apt/lists/*
+COPY pyproject.toml README.md ./
+COPY src/ ./src/
+RUN pip install --no-cache-dir build wheel \
+    && pip wheel --no-cache-dir --wheel-dir /wheels .
+
+# Stage 2: runtime
+FROM python:3.12-slim AS runtime
+WORKDIR /app
+RUN apt-get update && apt-get install -y --no-install-recommends curl \
+    && rm -rf /var/lib/apt/lists/*
+COPY --from=builder /wheels /wheels
+RUN pip install --no-cache-dir --no-index --find-links=/wheels acr-control-plane \
+    && rm -rf /wheels
+COPY src/ ./src/
+
+ENV PYTHONPATH=/app/src
+ENV PYTHONUNBUFFERED=1
+ENV WEB_CONCURRENCY=2
+
+EXPOSE 8443
+
+RUN useradd -r -u 1000 acr
+USER acr
+
+CMD ["uvicorn", "acr.pillar5_containment.service:app", "--host", "0.0.0.0", "--port", "8443"]