toolframe-core 0.6.2__tar.gz → 0.6.3__tar.gz

toolframe_core-0.6.3/.dockerignore

@@ -0,0 +1,15 @@
+**
+!Dockerfile
+!scripts/
+!scripts/container-healthcheck.py
+!scripts/harden-container.py
+!build/
+!build/container/
+!build/container/amd64/
+!build/container/amd64/toolframe
+!build/container/amd64/LICENSE
+!build/container/amd64/NOTICE
+!build/container/arm64/
+!build/container/arm64/toolframe
+!build/container/arm64/LICENSE
+!build/container/arm64/NOTICE

toolframe_core-0.6.3/.github/actions/scan-container/action.yml

@@ -0,0 +1,44 @@
+name: Scan a Toolframe container
+description: Retain the full vulnerability inventory and enforce publication policy
+inputs:
+  image:
+    description: Local image tag or public registry reference
+    required: true
+  platform:
+    description: Linux platform to scan
+    required: true
+  image-source:
+    description: Trivy image source (docker or remote)
+    required: true
+runs:
+  using: composite
+  steps:
+    - uses: aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567
+      with:
+        version: v0.76.0
+        cache: false
+    - name: Scan every severity and keep the package inventory
+      shell: bash
+      env:
+        SCAN_IMAGE: ${{ inputs.image }}
+        SCAN_PLATFORM: ${{ inputs.platform }}
+        SCAN_SOURCE: ${{ inputs.image-source }}
+      run: |
+        mkdir -p build/security
+        trivy image --image-src "$SCAN_SOURCE" --platform "$SCAN_PLATFORM" \
+          --scanners vuln --ignorefile '' --disable-telemetry --list-all-pkgs \
+          --timeout 10m --format json --output build/security/scan.json "$SCAN_IMAGE"
+        trivy version --format json > build/security/scanner.json
+        trivy convert --format cyclonedx --output build/security/sbom.cdx.json build/security/scan.json
+    - name: Enforce the security policy
+      shell: bash
+      run: |
+        python3 scripts/check-container-security.py build/security/scan.json \
+          --summary build/security/summary.md
+    - name: Add findings to the run summary
+      if: always()
+      shell: bash
+      run: |
+        if [ -f build/security/summary.md ]; then
+          cat build/security/summary.md >> "$GITHUB_STEP_SUMMARY"
+        fi

toolframe_core-0.6.3/.github/dependabot.yml

@@ -0,0 +1,27 @@
+version: 2
+updates:
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '04:23'
+      timezone: Etc/UTC
+    open-pull-requests-limit: 4
+    commit-message:
+      prefix: fix(container)
+    ignore:
+      # The 0.6.3 launcher accepts uv >=0.12.2,<0.13.0.
+      # Widen this only alongside a compatible launcher release.
+      - dependency-name: astral-sh/uv
+        versions: ['>=0.13.0']
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '04:23'
+      timezone: Etc/UTC
+    open-pull-requests-limit: 4
+    commit-message:
+      prefix: chore(ci)

toolframe_core-0.6.3/.github/workflows/container-security.yml

@@ -0,0 +1,52 @@
+name: Container security
+
+on:
+  schedule:
+    - cron: '23 3 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: container-security-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  scan:
+    name: ${{ matrix.variant }} (${{ matrix.arch }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        variant: [standard, distroless]
+        arch: [amd64, arm64]
+        include:
+          - variant: standard
+            tag: latest
+          - variant: distroless
+            tag: distroless
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Select the public image
+        id: image
+        env:
+          OWNER: ${{ github.repository_owner }}
+          TAG: ${{ matrix.tag }}
+        run: echo "ref=ghcr.io/${OWNER,,}/toolframe:$TAG" >> "$GITHUB_OUTPUT"
+      - uses: ./.github/actions/scan-container
+        with:
+          image: ${{ steps.image.outputs.ref }}
+          platform: linux/${{ matrix.arch }}
+          image-source: remote
+      - name: Save findings and the inventory
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: container-security-${{ matrix.variant }}-${{ matrix.arch }}
+          path: build/security/
+          if-no-files-found: warn
+          retention-days: 7

toolframe_core-0.6.3/.github/workflows/container.yml

@@ -0,0 +1,213 @@
+name: Container images
+
+on:
+  pull_request:
+    paths:
+      - Dockerfile
+      - .dockerignore
+      - .github/workflows/container.yml
+      - .github/workflows/container-security.yml
+      - .github/actions/scan-container/**
+      - scripts/*container*.py
+      - tests/test_container_*.py
+  workflow_call:
+    inputs:
+      publish:
+        type: boolean
+        default: false
+      release_artifacts:
+        description: Use the validated launcher artifacts from this workflow run
+        type: boolean
+        default: false
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: Publish both tested variants to GHCR
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: ${{ matrix.variant }} (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        variant: [standard, distroless]
+        arch: [amd64, arm64]
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+            target: x86_64-unknown-linux-gnu
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+    outputs:
+      version: ${{ steps.metadata.outputs.version }}
+      image: ${{ steps.metadata.outputs.image }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - name: Read the version and registry namespace
+        id: metadata
+        env:
+          REPOSITORY_OWNER: ${{ github.repository_owner }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          version=$(python -c 'import tomllib; print(tomllib.load(open("Cargo.toml", "rb"))["package"]["version"])')
+          # PRs exercise packaging with an available public runtime; source CI
+          # validates the unreleased Core independently.
+          if [ "$GITHUB_EVENT_NAME" = pull_request ]; then
+            tag=$(gh release view --repo "$GITHUB_REPOSITORY" --json tagName --jq .tagName)
+            version=${tag#v}
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "image=ghcr.io/${REPOSITORY_OWNER,,}/toolframe" >> "$GITHUB_OUTPUT"
+      - name: Download the validated launcher from this publication run
+        if: inputs.release_artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: launcher-release-${{ matrix.target }}
+          path: build/container-release/
+      - name: Stage the verified executable
+        env:
+          USE_ARTIFACTS: ${{ inputs.release_artifacts }}
+          ARCH: ${{ matrix.arch }}
+          VERSION: ${{ steps.metadata.outputs.version }}
+        run: |
+          options=()
+          if [ "$USE_ARTIFACTS" = true ]; then
+            options+=(--release-dir build/container-release)
+          fi
+          python scripts/prepare-container.py --architecture "$ARCH" --version "$VERSION" \
+            --repository "$GITHUB_REPOSITORY" "${options[@]}"
+      - name: Build the native image
+        env:
+          ARCH: ${{ matrix.arch }}
+          VARIANT: ${{ matrix.variant }}
+          VERSION: ${{ steps.metadata.outputs.version }}
+        run: |
+          docker buildx build --platform "linux/$ARCH" --target "$VARIANT" \
+            --pull --no-cache-filter runtime \
+            --build-arg "TOOLFRAME_VERSION=$VERSION" \
+            --build-arg "TOOLFRAME_REVISION=$GITHUB_SHA" \
+            --label "org.opencontainers.image.source=https://github.com/$GITHUB_REPOSITORY" \
+            --provenance=false --load --tag toolframe-check:local .
+      - name: Verify public interfaces, persistence and shutdown
+        env:
+          ARCH: ${{ matrix.arch }}
+          VARIANT: ${{ matrix.variant }}
+        run: |
+          python scripts/verify-container.py --image toolframe-check:local \
+            --variant "$VARIANT" --platform "linux/$ARCH" \
+            --output build/container-verification.json
+      - name: Save verification evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: container-evidence-${{ matrix.variant }}-${{ matrix.arch }}
+          path: build/container-verification*
+          if-no-files-found: warn
+          retention-days: 7
+      - name: Scan the tested image before publication
+        uses: ./.github/actions/scan-container
+        with:
+          image: toolframe-check:local
+          platform: linux/${{ matrix.arch }}
+          image-source: docker
+      - name: Save security evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: container-security-${{ matrix.variant }}-${{ matrix.arch }}
+          path: build/security/
+          if-no-files-found: warn
+          retention-days: 7
+      - name: Log in to GHCR
+        if: inputs.publish
+        uses: docker/login-action@783ae9cac559640a24c9212dfa6cd9e998252f9a
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Push the exact locally tested image
+        if: inputs.publish
+        env:
+          IMAGE: ${{ steps.metadata.outputs.image }}
+          ARCH: ${{ matrix.arch }}
+          VARIANT: ${{ matrix.variant }}
+        run: |
+          ref="$IMAGE:build-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$VARIANT-$ARCH"
+          docker tag toolframe-check:local "$ref"
+          docker push "$ref"
+          mkdir -p build/digests
+          docker image inspect --format '{{index .RepoDigests 0}}' "$ref" \
+            > "build/digests/$VARIANT-$ARCH.txt"
+      - name: Save the tested image digest
+        if: inputs.publish
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: container-digest-${{ matrix.variant }}-${{ matrix.arch }}
+          path: build/digests/*.txt
+          if-no-files-found: error
+
+  publish:
+    name: Publish multi-platform tags
+    needs: build
+    if: inputs.publish
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      packages: write
+    concurrency:
+      group: container-publish-${{ github.repository }}
+      cancel-in-progress: false
+    steps:
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: container-digest-*
+          merge-multiple: true
+          path: build/digests/
+      - uses: docker/login-action@783ae9cac559640a24c9212dfa6cd9e998252f9a
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Publish both architectures after all four checks pass
+        env:
+          IMAGE: ${{ needs.build.outputs.image }}
+          VERSION: ${{ needs.build.outputs.version }}
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          latest=$(gh release view --repo "$GH_REPO" --json tagName --jq .tagName)
+          for variant in standard distroless; do
+            suffix=""
+            alias=latest
+            if [ "$variant" = distroless ]; then
+              suffix=-distroless
+              alias=distroless
+            fi
+            mapfile -t refs < <(cat build/digests/"$variant"-*.txt)
+            test "${#refs[@]}" -eq 2
+            tags=(--tag "$IMAGE:$VERSION$suffix")
+            if [ "$latest" = "v$VERSION" ] && [[ "$VERSION" != *-* ]]; then
+              tags+=(--tag "$IMAGE:$alias")
+            fi
+            docker buildx imagetools create "${tags[@]}" "${refs[@]}"
+            docker buildx imagetools inspect "$IMAGE:$VERSION$suffix"
+          done

{toolframe_core-0.6.2 → toolframe_core-0.6.3}/.github/workflows/publish.yml

@@ -126,3 +126,14 @@ jobs:
           EOF
           gh release create "$RELEASE_TAG" --verify-tag --title "Toolframe $RELEASE_TAG" \
             --notes-file release-notes.txt releases/*.tar.gz releases/SHA256SUMS releases/manifest-*.json releases/*.whl
+
+  publish-containers:
+    needs: release-binaries
+    if: inputs.index == 'pypi'
+    permissions:
+      contents: read
+      packages: write
+    uses: ./.github/workflows/container.yml
+    with:
+      publish: true
+      release_artifacts: true

toolframe_core-0.6.3/.github/workflows/quality.yml

@@ -0,0 +1,63 @@
+name: Code quality
+
+on:
+  push:
+    branches: ['**']
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  branch-policy:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - name: Check the actual source branch
+        env:
+          BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
+        run: python scripts/check_branch_name.py "$BRANCH_NAME"
+
+  code-quality:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: '0.12.8'
+          enable-cache: false
+      - name: Check Python lint and formatting
+        run: uvx prek==0.5.5 run ruff-check ruff-format --all-files --show-diff-on-failure
+
+  commit-policy:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - uses: commit-check/commit-check-action@a61779784a953fd9047c001c102cfeac5cf26964 # commit-check 2.18.3
+        with:
+          message: true
+          branch: false
+          pr-title: true
+          pr-comments: false

toolframe_core-0.6.3/.pre-commit-config.yaml

@@ -0,0 +1,29 @@
+default_install_hook_types: [pre-commit, commit-msg]
+default_stages: [pre-commit]
+default_language_version:
+  python: python3.11
+
+repos:
+  - repo: local
+    hooks:
+      - id: check-branch-name
+        name: Check branch naming policy
+        entry: python scripts/check_branch_name.py
+        language: python
+        always_run: true
+        pass_filenames: false
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.16.8
+    hooks:
+      - id: ruff-check
+        types_or: [python, pyi]
+        files: '^(src/|tests/|scripts/(build-launcher\.py$|verify-release\.py$|verify-skill\.py$|check_branch_name\.py$|ci/))'
+      - id: ruff-format
+        types_or: [python, pyi]
+        args: [--check]
+        files: '^(src/|tests/|scripts/(build-launcher\.py$|verify-release\.py$|verify-skill\.py$|check_branch_name\.py$|ci/))'
+  - repo: https://github.com/commit-check/commit-check
+    rev: v2.18.3
+    hooks:
+      - id: check-message
+        stages: [commit-msg]

{toolframe_core-0.6.2 → toolframe_core-0.6.3}/CHANGELOG.md

@@ -5,6 +5,16 @@ imply that its distributions have been published or every target is qualified.
 
 ## Unreleased
 
+## 0.6.3
+
+- Apply container security updates, remove unused pip bootstrap dependencies and
+  privileged executable bits, and gate publication on vulnerability scans with
+  daily image checks and weekly dependency update proposals.
+
+## 0.6.2
+
+- Add Debian and Distroless container images with prepared Core runtimes, Tini,
+  persistent application volumes and verified multi-platform GHCR publication.
 - Run multiple SQL storage providers using service defaults and per-plugin bindings.
 - Retain store provider ownership across removal and restart; reject silent rebinding.
 - Bind migration plans and forward repair to their provider, and preserve admitted

toolframe_core-0.6.3/CONTRIBUTING.md

@@ -0,0 +1,47 @@
+# Contributing
+
+## Commit hooks
+
+Install [prek](https://prek.j178.dev/) and enable the repository's hooks:
+
+```sh
+uv tool install prek==0.5.5
+prek install --allow-missing-config
+prek run --all-files
+```
+
+The missing-config option allows older worktrees without this configuration to
+keep working. Worktrees containing `.pre-commit-config.yaml` still run the checks.
+The `pre-commit` hook checks the branch name, Python lint, and formatting. The
+`commit-msg` hook checks Conventional Commits. Both Ruff hooks only check files;
+they do not rewrite a commit's contents. Fix lint and formatting explicitly:
+
+```sh
+uvx ruff==0.16.8 check --fix src tests scripts/build-launcher.py scripts/verify-release.py scripts/verify-skill.py scripts/ci scripts/check_branch_name.py
+uvx ruff==0.16.8 format src tests scripts/build-launcher.py scripts/verify-release.py scripts/verify-skill.py scripts/ci scripts/check_branch_name.py
+prek run --all-files
+```
+
+The Ruff version and checked paths are pinned in
+[the hook configuration](.pre-commit-config.yaml); the Python rules remain in
+[pyproject.toml](pyproject.toml). CI uses these same hooks on all tracked files
+within their configured paths. Existing package, integration, and release checks
+run independently.
+
+## Branches and commits
+
+[cchk.toml](cchk.toml) defines the allowed branch and commit types. Work branches
+use `feat/`, `fix/`, `release/`, or `chore/`, followed by lowercase ASCII letters
+and digits separated by single hyphens. Release versions may also contain dots,
+as in `release/v1.2.0-rc.1`; every separator must have an alphanumeric character on
+both sides. The default branch `main` is the standalone exception.
+
+Commit types are independent of branch types: for example,
+`docs: clarify setup` is valid on `chore/update-docs`. Commit-check uses Conventional
+Commits with its default subject length of 5–80 characters. Pull requests check
+their commits and title so the title can be used for a Conventional Commit when
+squash merging.
+
+Local hooks can be bypassed. CI reports `branch-policy`, `code-quality`, and
+`commit-policy`; maintainers must configure required status checks separately to
+make passing checks a merge requirement.

{toolframe_core-0.6.2 → toolframe_core-0.6.3}/Cargo.lock

@@ -1186,7 +1186,7 @@ dependencies = [
 
 [[package]]
 name = "toolframe"
-version = "0.6.2"
+version = "0.6.3"
 dependencies = [
  "anyhow",
  "flate2",

{toolframe_core-0.6.2 → toolframe_core-0.6.3}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "toolframe"
-version = "0.6.2"
+version = "0.6.3"
 edition = "2024"
 rust-version = "1.88"
 description = "A local-first runtime for agent-built internal apps"

toolframe_core-0.6.3/Dockerfile

@@ -0,0 +1,107 @@
+# syntax=docker/dockerfile:1
+FROM ghcr.io/astral-sh/uv:0.12.24@sha256:3af4716e991d6956a41e573eab705d0ee08500cd829ed30293eb8472f372c65a AS uv
+
+FROM debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f AS runtime
+ARG TARGETARCH
+ARG TOOLFRAME_VERSION=0.6.3
+ARG TOOLFRAME_REVISION
+LABEL org.opencontainers.image.source="https://github.com/toolframe/toolframe-core" \
+      org.opencontainers.image.title="Toolframe" \
+      org.opencontainers.image.description="Persistent control host for Python plugins" \
+      org.opencontainers.image.licenses="Apache-2.0 AND MIT" \
+      org.opencontainers.image.version="${TOOLFRAME_VERSION}" \
+      org.opencontainers.image.revision="${TOOLFRAME_REVISION}"
+RUN apt-get update \
+    && apt-get upgrade -y --no-install-recommends \
+    && apt-get install -y --no-install-recommends ca-certificates git libstdc++6 procps tini \
+    && rm -rf /var/lib/apt/lists/* \
+    && find /usr -xdev -type f -perm /6000 -exec chmod a-s '{}' + \
+    && groupadd --gid 65532 nonroot \
+    && useradd --uid 65532 --gid 65532 --create-home --home-dir /home/nonroot nonroot \
+    && install -d -o 65532 -g 65532 /data /opt/toolframe
+COPY --from=uv /uv /usr/local/bin/uv
+# prepare-container.py verifies the release checksums before staging these files.
+COPY build/container/${TARGETARCH}/toolframe /usr/local/bin/toolframe
+COPY build/container/${TARGETARCH}/LICENSE build/container/${TARGETARCH}/NOTICE /usr/share/doc/toolframe/
+COPY scripts/container-healthcheck.py /usr/local/lib/toolframe/healthcheck.py
+COPY scripts/harden-container.py /usr/local/lib/toolframe/harden.py
+ENV HOME=/home/nonroot \
+    TOOLFRAME_UV=/usr/local/bin/uv \
+    TOOLFRAME_RUNTIME_ROOT=/opt/toolframe/runtime \
+    UV_PYTHON_INSTALL_DIR=/opt/toolframe/python \
+    UV_CACHE_DIR=/data/.toolframe/uv-cache \
+    UV_LINK_MODE=copy \
+    PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1
+USER 65532:65532
+WORKDIR /data
+# --help prepares Core without creating an application, keys or management tokens.
+# Keep the same absolute Python and venv paths in both final images.
+RUN test "$(toolframe --version)" = "toolframe ${TOOLFRAME_VERSION}" \
+    && UV_CACHE_DIR=/tmp/uv-build-cache toolframe --help > /dev/null \
+    && ln -s "$(uv python find --managed-python 3.14.7)" /opt/toolframe/python3 \
+    && UV_CACHE_DIR=/tmp/uv-build-cache uv cache clean \
+    && /opt/toolframe/python3 /usr/local/lib/toolframe/harden.py
+VOLUME ["/data"]
+EXPOSE 9876
+STOPSIGNAL SIGTERM
+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s \
+    CMD ["/opt/toolframe/python3", "/usr/local/lib/toolframe/healthcheck.py"]
+ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/toolframe", "--home", "/data"]
+CMD ["serve", "--host", "0.0.0.0"]
+
+FROM runtime AS ps-dependencies
+USER root
+# Core uses ps to reconcile worker ownership. Retain the final base's libc and
+# loader, and copy only ps's additional shared libraries under their SONAMEs.
+# Include dpkg status fragments so scanners can identify these copied components.
+RUN mkdir -p /opt/ps-libs/var/lib/dpkg/status.d \
+    && ldd /usr/bin/ps | awk '/=> \// { print $3 }' | while read -r library; do \
+         case "$library" in */libc.so.*|*/libm.so.*) continue ;; esac; \
+         directory=$(dirname "$(readlink -f "$library")"); \
+         install -D "$library" "/opt/ps-libs$directory/$(basename "$library")"; \
+         package=$(dpkg-query -S "$(readlink -f "$library")") || exit 1; \
+         package=${package%%:*}; \
+         dpkg-query -s "$package" > "/opt/ps-libs/var/lib/dpkg/status.d/$package" || exit 1; \
+       done \
+    && dpkg-query -s procps > /opt/ps-libs/var/lib/dpkg/status.d/procps \
+    && dpkg-query -s tini > /opt/ps-libs/var/lib/dpkg/status.d/tini
+
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:e792ab3d241a468a4fd7519ddbbebe66b49b5f365771716ea688ad40b6c6f1c2 AS distroless
+ARG TOOLFRAME_VERSION=0.6.3
+ARG TOOLFRAME_REVISION
+LABEL org.opencontainers.image.source="https://github.com/toolframe/toolframe-core" \
+      org.opencontainers.image.title="Toolframe (Distroless)" \
+      org.opencontainers.image.description="Persistent control host for Python plugins, without a system shell" \
+      org.opencontainers.image.licenses="Apache-2.0 AND MIT" \
+      org.opencontainers.image.version="${TOOLFRAME_VERSION}" \
+      org.opencontainers.image.revision="${TOOLFRAME_REVISION}"
+COPY --from=runtime /usr/local/bin/toolframe /usr/local/bin/uv /usr/local/bin/
+COPY --from=runtime /usr/bin/tini /usr/bin/tini
+COPY --from=runtime /usr/bin/ps /usr/bin/ps
+COPY --from=ps-dependencies /opt/ps-libs/ /
+COPY --from=runtime /usr/share/doc/ /usr/share/doc/
+COPY --from=runtime /usr/local/lib/toolframe/ /usr/local/lib/toolframe/
+COPY --from=runtime --chown=65532:65532 /opt/toolframe/ /opt/toolframe/
+COPY --from=runtime --chown=65532:65532 /home/nonroot/ /home/nonroot/
+COPY --from=runtime --chown=65532:65532 /data/ /data/
+ENV HOME=/home/nonroot \
+    TOOLFRAME_UV=/usr/local/bin/uv \
+    TOOLFRAME_RUNTIME_ROOT=/opt/toolframe/runtime \
+    UV_PYTHON_INSTALL_DIR=/opt/toolframe/python \
+    UV_CACHE_DIR=/data/.toolframe/uv-cache \
+    UV_LINK_MODE=copy \
+    PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1
+USER 65532:65532
+WORKDIR /data
+VOLUME ["/data"]
+EXPOSE 9876
+STOPSIGNAL SIGTERM
+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s \
+    CMD ["/opt/toolframe/python3", "/usr/local/lib/toolframe/healthcheck.py"]
+ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/toolframe", "--home", "/data"]
+CMD ["serve", "--host", "0.0.0.0"]
+
+# The default build target is the Debian image.
+FROM runtime AS standard