zeroquarry/worker repository overview

⁠ZeroQuarry Private Runner

The ZeroQuarry Private Runner executes authorized security scans from a customer-controlled Docker host while ZeroQuarry SaaS remains the control plane. It connects outbound over HTTPS, so private networks do not need to expose an inbound runner endpoint.

The image supports:

• remote scans of applications reachable only from the runner's network;
• source scans where the runner clones Git repositories directly; and
• direct LLM-provider calls using the ZeroQuarry account's own provider keys.

This image requires an active ZeroQuarry Enterprise subscription or another written commercial agreement. It is not a standalone scanner.

⁠Connect a runner

In ZeroQuarry, an account administrator creates a private runner pool under Account → Private Runners, selects Add runner, and copies the generated command. The enrollment token works once and expires after 24 hours.

A generated command has this shape:

docker run -d --restart on-failure:5 \
  --name zeroquarry-runner \
  --volume zq-runner-state:/var/lib/zeroquarry \
  --env ZEROQUARRY_ACCEPT_EULA=yes \
  --env ZEROQUARRY_CONTROL_PLANE_URL=https://api.zeroquarry.com \
  --env ZEROQUARRY_ENROLLMENT_TOKEN='<one-time-token>' \
  --env ZEROQUARRY_RUNNER_NAME='Production VPC runner' \
  zeroquarry/worker:latest

Use the command shown in your account rather than reusing the placeholder above. The Docker volume stores the enrolled worker identity. Preserve it when updating or recreating the container; deleting it requires a new enrollment token.

The bounded restart policy retries transient startup failures up to five times. A permanent enrollment rejection, such as an expired or already-used token, stops the container immediately. Generate a new command before starting it again.

⁠Network access

The runner requires outbound HTTPS access to:

• the ZeroQuarry control-plane URL shown in the enrollment command;
• the configured LLM provider endpoints; and
• Git hosts used by private source scans.

It also needs network access from the Docker host to the private applications selected for remote scans. No inbound connection from ZeroQuarry SaaS is required.

⁠Result privacy

Administrators choose the return policy when creating a pool:

• Standard returns detailed findings, relevant excerpts, logs, and artifacts to the ZeroQuarry control plane.
• Minimized returns allowlisted finding metadata while retaining detailed evidence, logs, errors, and runner-generated artifacts on the runner.

Private source scans clone directly on the runner. Browser-uploaded source is not accepted for private execution because it would first transit the SaaS control plane.

⁠Updating

Pull the desired tag and recreate the container while retaining the state volume. Stable releases also update latest; production deployments may pin an explicit version:

docker pull zeroquarry/worker:1.0.0

If a worker must stop accepting new scans, drain it in ZeroQuarry before recreating it. Revoking a worker invalidates its credential and requires a new enrollment.

⁠License and support

Running the image requires affirmative acceptance through ZEROQUARRY_ACCEPT_EULA=yes. The ZeroQuarry Private Runner commercial license is included in the image at:

/usr/share/licenses/zeroquarry-worker/WORKER-EULA.md

Support, warranties, data-protection terms, and liability terms are governed by your written ZeroQuarry agreement.