enclavaultcorp/base-run repository overview

⁠Enclavault Base Runtime Image

The image is intentionally minimal and focused on secure runtime execution (not for compilation).

⁠Purpose

Use this image as the runtime foundation for Enclavault containers.

It provides:

• Required shared runtime libraries
• A non-root runtime user (enclavault, UID/GID 1000)
• Pre-created runtime directories with restricted permissions
• A writable runtime volume at /var/run/enclavault

⁠What Is Included

The image is based on Alpine Linux (3.20) and installs runtime packages such as:

• ca-certificates, curl, tzdata, jq
• libxml2, readline, lz4-libs, zstd-libs, openssl
• bash, icu-libs, krb5-libs

⁠Security and Runtime Defaults

The Dockerfile applies these defaults:

• Creates non-root user/group: enclavault (UID/GID 1000)
• Creates /var/run/enclavault with restricted permissions (750)
• Creates /var/run/enclavault/embedded with stricter permissions (700)
• Creates /etc/config.yaml owned by enclavault with 640 mode
• Sets HOME=/var/run/enclavault
• Sets container user to USER enclavault