cardinal is a Linux container runtime, not a VM boundary. Namespaces, OverlayFS, cgroups, capability dropping, and strict validation reduce the impact of untrusted workloads — and every release is verifiable from source to binary.
Blocks 30+ dangerous syscalls (mount, ptrace, reboot, kexec_load, bpf) by default. Bring your own JSON profile with --seccomp-profile.
A cardinal-container profile restricts access to /proc/sys, /sys/firmware, denies /dev/mem and /dev/kmem, and limits ptrace to the container.
Safe default capability set, SYS_ADMIN and SYS_MODULE dropped, no_new_privs enabled, sysctls restricted to net.*. --cap-drop ALL for an empty set.
Adding SYS_ADMIN, NET_ADMIN, BPF and similar is refused unless --allow-dangerous-caps is passed — and the escalation is flagged in the audit log.
/dev/shm and /dev/mqueue mounted with noexec,nosuid,nodev; /proc/sys and /sys bind-mounted read-only; sensitive devices removed.
--isolated blocks inter-container traffic via iptables, preventing lateral movement between workloads.
Backup archives carry SHA-256 sidecar checksums and optional AES-256-GCM encryption.
Mounts into ~/.ssh, ~/.aws, credential dirs, and container runtime sockets are blocked. Traversal and symlink escapes are rejected.
CARDINAL_REGISTRY_STRICT plus cardinal registry allowlist add <host> refuses pulls and pushes from unapproved registries.
Every release publishes SHA256SUMS.txt, an SPDX-JSON SBOM, and optional cosign signatures. install.sh verifies digests before installing.
Ten rules from the project's SECURITY.md for running cardinal in production.
Install via the SHA256-verified install.sh or the signed APT repository. Verify images with cardinal verify.
Prefer rootless mode with a dedicated service account and cgroup v2 quotas.
Keep the API on 127.0.0.1 unless remote access is required; use CARDINAL_TOKEN and TLS for any external bind.
Never mount /, /etc, /proc, /sys, credential dirs, or sibling runtime sockets into untrusted containers.
Mount configuration and certificates read-only where write access is unnecessary.
memory, cpus, disk, restart budgets, and backup retention for every workload.
Maintain an explicit registry allowlist and run the cluster with CARDINAL_REGISTRY_STRICT=1.
Do not build untrusted Dockerfiles directly on a production host.
Use CARDINAL_REQUIRE_SIGNATURE=1 so cardinal update verifies cosign signatures.
Practice backup restoration on a stopped container quarterly; rotate encryption keys on upgrades.
The runtime deliberately ships no FTP server. For host ↔ container transfers, cardinal uses the paths that protect against the misconfigurations FTP enabled:
Local copy, no network exposure, no new listening port. Ideal for one-off transfers.
cardinal cp app.py web:/app/Run openssh-server as the entrypoint, publish via -p 22:22, require key auth. SFTP inherits SSH's encryption.
Named volumes for ongoing data exchange, or cardinal console for interactive file access over loopback.
Don't publish an exploitable proof of concept before a fix exists. Open a private GitHub security advisory on the repository, or contact the maintainer via the GitHub profile in CONTRIBUTING.md. Include the affected version, reproduction steps, impact, and a minimal non-destructive PoC.
cardinal runs daily govulncheck, gitleaks, and audit scans in CI, and publishes its full security model in SECURITY.md.
Read SECURITY.md