init

tests/deployment_contract.rs

@@ -0,0 +1,21 @@
+#[test]
+fn compose_is_a_hardened_read_only_sidecar() {
+    let compose = include_str!("../compose.example.yml");
+    assert!(compose.contains("minecraft-data:/data:ro"));
+    assert!(compose.contains("read_only: true"));
+    assert!(compose.contains("cap_drop: [ALL]"));
+    assert!(compose.contains("no-new-privileges:true"));
+    assert!(!compose.contains("docker.sock"));
+    assert!(!compose.contains("ports:"));
+}
+#[test]
+fn runtime_has_no_node_and_runs_non_root() {
+    let dockerfile = include_str!("../Dockerfile");
+    let runtime = dockerfile
+        .split("FROM debian:bookworm-slim AS runtime")
+        .nth(1)
+        .unwrap();
+    assert!(!runtime.contains("npm "));
+    assert!(!runtime.contains("node "));
+    assert!(runtime.contains("USER 10001:10001"));
+}