Container images · deploy-and-ops

Purpose & architecture

Two minimal, non root, FIPS validated images, each a two stage build with the build context at the repository root.

This page records a pinned branch snapshot. Differences are compared with the audited default branch, not assumed to be chronological improvements. Author claims in the source documentation are retained as claims. Source recovery does not establish successful deployment, scientific validity, or equivalence with another branch.

This source generation

This record follows the deploy-and-ops branch of Janady13/missionmatch at commit bdacd9d0b4d5998d25fc74bf4007f4c3ec538c7a. The snapshot identifies the source inspected in this audit. It is not a statement about which revision is currently running on a device.

Recovered implementation structure

These paths locate the components and entry points represented by this build. The source register contains their inspected revisions.

• .github/workflows/ci.yml
• BUILD_REPORT.md
• CLAUDE.md
• cmd/api/main.go
• cmd/embed-backfill/main.go
• cmd/megamind-gateway/main.go
• cmd/migrate-all-tenants/main.go
• cmd/provision-tenant/main.go
• cmd/sam-sync/main.go
• cmd/staffing-proactive-sync/main.go
• cmd/sync-tenant-identity/main.go
• db/migrations/0020_tenant_directory.sql
• db/queries/candidates.sql
• db/queries/evaluations.sql
• db/queries/opportunity_records.sql
• db/queries/wages.sql
• db/seed/demo_base.sql
• db/seed/demo_gapfillers.sql
• docs/AI_RESEARCH.md
• docs/ARCHITECTURE.md
• docs/MIGRATE_TO_PER_TENANT.md
• docs/MODEL_CARD.md
• docs/RUNBOOK_ONBOARDING.md
• docs/RUNBOOK_OPERATIONS.md
• docs/STACK_DECISIONS.md
• frontend/index.html
• frontend/package.json
• frontend/src/App.tsx
• frontend/src/components/AppShell.tsx
• frontend/src/components/ScreeningResults.tsx
• frontend/src/lib/AuthContext.tsx
• frontend/src/lib/api.ts
• frontend/src/lib/auth.ts
• frontend/src/lib/queries.ts
• frontend/src/lib/types.ts
• frontend/src/main.tsx
• frontend/src/screens/Compliance.tsx
• frontend/src/screens/Dashboard.tsx
• frontend/src/screens/Login.tsx
• frontend/src/screens/Placeholder.tsx
• frontend/src/screens/Settings.tsx
• frontend/src/tools/missionmatch/Candidates.tsx
• frontend/src/tools/missionmatch/CommandCenter.tsx
• frontend/src/tools/missionmatch/WhoCanSupport.tsx
• frontend/src/tools/missionmatch/api.ts
• frontend/src/tools/missionmatch/brand.ts
• frontend/src/tools/screenmatch/CandidateEvaluation.tsx
• frontend/src/tools/screenmatch/ScreeningQueue.tsx
• frontend/src/tools/screenmatch/api.ts
• frontend/src/tools/screenmatch/brand.ts
• frontend/src/tools/screenmatch/queries.ts
• frontend/src/tools/slatematch/Slate.tsx
• frontend/src/tools/slatematch/brand.ts
• go.mod
• infra/docker/README.md
• infra/terraform/README.md
• internal/integration/ai_phase1_integration_test.go
• internal/integration/ai_phase8_integration_test.go
• internal/integration/brain_integration_test.go
• internal/integration/directory_integration_test.go
• internal/integration/megamind_integration_test.go
• internal/integration/pertenant_isolation_integration_test.go
• internal/integration/rls_integration_test.go
• internal/modules/ai/handler.go
• internal/modules/ai/orchestrator.go
• internal/modules/ai/retrieval.go
• internal/modules/ai/safety.go
• internal/modules/ai/safety_test.go
• internal/modules/ai/tag.go
• internal/modules/ai/vectorguard.go
• internal/modules/auth/dto.go
• internal/modules/auth/handler.go
• internal/modules/auth/helpers.go
• internal/modules/auth/service.go
• internal/modules/auth/service_users.go
• internal/modules/awards/handler.go
• internal/modules/awards/service.go
• internal/modules/commandcenter/dto.go
• internal/modules/commandcenter/handler.go
• internal/modules/commandcenter/service.go
• internal/modules/eeo/service.go
• internal/modules/governance/handler.go
• internal/modules/governance/service.go
• internal/modules/matching/convert.go
• internal/modules/matching/dto.go
• internal/modules/matching/engine/engine.go
• internal/modules/matching/engine/frozen_test.go
• internal/modules/matching/engine/types.go
• internal/modules/matching/handler.go
• internal/modules/matching/intel.go
• internal/modules/matching/intelligence/intelligence_test.go
• internal/modules/matching/missioncheck.go
• internal/modules/matching/service.go
• internal/modules/matching/service_test.go
• internal/modules/matching/skillmatcher.go
• internal/modules/matching/slate_service.go
• internal/modules/opportunities/handler.go
• internal/modules/opportunities/service.go
• internal/modules/opportunity_intelligence/service.go
• internal/modules/sourcing/service.go
• internal/modules/staffing/portfolio.go
• internal/modules/staffing/proactive.go
• internal/modules/staffing/service.go
• internal/modules/wages/handler.go
• internal/modules/wages/service.go
• internal/platform/audit/audit.go
• internal/platform/bls/bls_test.go
• internal/platform/bls/profile.go
• internal/platform/config/config.go
• internal/platform/database/database.go
• internal/platform/database/dbgen/candidates.sql.go
• internal/platform/database/dbgen/evaluations.sql.go
• internal/platform/database/dbgen/foundation.sql.go
• internal/platform/database/dbgen/models.go
• internal/platform/database/dbgen/opportunities.sql.go
• internal/platform/database/dbgen/opportunity_records.sql.go
• internal/platform/database/dbgen/querier.go
• internal/platform/database/dbgen/requirements.sql.go
• internal/platform/database/dbgen/sam.sql.go
• internal/platform/database/dbgen/skills.sql.go
• internal/platform/database/dbgen/slates.sql.go
• internal/platform/database/dbgen/staffing.sql.go
• internal/platform/database/dbgen/wages.sql.go
• internal/platform/directory/directory.go
• internal/platform/embeddings/embeddings.go
• internal/platform/embeddings/megamind.go
• internal/platform/inference/client.go
• internal/platform/inference/client_test.go
• internal/platform/scrub/scrub.go
• internal/platform/scrub/scrub_test.go
• internal/platform/security/csrf.go
• internal/platform/security/rbac.go
• internal/platform/security/rbac_middleware.go
• internal/platform/security/rbac_test.go
• internal/platform/sourcing/ingest.go
• internal/platform/tenant/routing_test.go
• internal/platform/tenant/tenant.go
• scripts/backup-tenant.sh
• scripts/ci-local.sh
• scripts/restore-tenant.sh
• sqlc.yaml

Behavior & verification limits

Read-only source inspection. No native engine, generator, database, payment, or production service was executed.

Original project documentation

The following documentation is preserved as a dated source account. Claims in it retain the source’s wording and must be read alongside the implementation notes above.

Container images

Two minimal, non root, FIPS validated images, each a two stage build with the build context at the repository root.

• Dockerfile.mm-api builds cmd/api (the API server, port 8080).
• Dockerfile.megamind-gateway builds cmd/megamind-gateway (the stateless inference proxy, port 8090).

Build

docker build -f infra/docker/Dockerfile.mm-api          -t mm-api:local .
docker build -f infra/docker/Dockerfile.megamind-gateway -t megamind-gateway:local .

Each build cross compiles the binary with the validated FIPS module (CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOFIPS140=v1.0.0, identical to the Makefile build target) and FAILS the build unless the artifact carries the stamp (go version -m /out/<bin> | grep -q GOFIPS140=v1.0.0, the same assertion as make verify-fips). So a non FIPS binary can never be packaged.

Verify the FIPS stamp inside the built image

The in build gate already guarantees it, but to confirm on the shipped image:

docker run --rm --entrypoint /busybox/sh mm-api:local -c 'true'   # distroless has no shell; instead:
# extract and check on the host:
id=$(docker create mm-api:local) && docker cp "$id":/mm-api /tmp/mm-api && docker rm "$id"
go version -m /tmp/mm-api | grep GOFIPS140        # expect: GOFIPS140=v1.0.0

The running container also defaults GODEBUG=fips140=on (stamped in by GOFIPS140=v1.0.0) and runs the in process FIPS guard plus the PBKDF2 self test at boot, so a non FIPS runtime fails closed before serving.

Base image digests (pinned)

Both Dockerfiles pin the builder and the runtime base by sha256 digest. Re resolve them (and let Renovate or Dependabot, which both understand FROM ...@sha256, open re pin pull requests):

# golang:1.26.4 (multi arch index)
tok=$(curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:library/golang:pull" | jq -r .token)
curl -sI -H "Authorization: Bearer $tok" -H "Accept: application/vnd.oci.image.index.v1+json" https://registry-1.docker.io/v2/library/golang/manifests/1.26.4 | grep -i docker-content-digest

# gcr.io/distroless/static-debian12:nonroot
tok=$(curl -s "https://gcr.io/v2/token?scope=repository:distroless/static-debian12:pull" | jq -r .token)
curl -sI -H "Authorization: Bearer $tok" -H "Accept: application/vnd.oci.image.index.v1+json" https://gcr.io/v2/distroless/static-debian12/manifests/nonroot | grep -i docker-content-digest

After any base bump, re run make verify-fips and rebuild the image so the in build stamp gate runs again.

Runtime hardening (orchestration layer)

The Dockerfile sets the non root numeric user; the read only root filesystem, the writable /tmp tmpfs, and dropping all Linux capabilities are enforced by the pod spec (a container image cannot set them itself), per the NIST 800-171 baseline. Run both images with:

securityContext:            # pod
  runAsNonRoot: true
  runAsUser: 65532
  runAsGroup: 65532
  fsGroup: 65532
  seccompProfile: { type: RuntimeDefault }
containers:
  - name: mm-api
    securityContext:        # container
      readOnlyRootFilesystem: true
      allowPrivilegeEscalation: false
      privileged: false
      capabilities: { drop: [ALL] }
    volumeMounts:
      - { name: tmp, mountPath: /tmp }
volumes:
  - name: tmp
    emptyDir: { medium: Memory }

Neither entrypoint writes to disk outside /tmp (no os.Create, WriteFile, or MkdirAll in the request path), so /tmp is the only writable mount required.

Notes

- distroless static, NOT scratch: the app makes verify full TLS connections (managed Postgres, the cloud secret store, the object store), so the ca-certificates bundle in static is load bearing. - Never set GODEBUG=fips140=only in a production image or pod; the Go docs call it best effort and crash by design. It belongs only in a dedicated CI probing stage. - The gateway image proxies Ollama over MEGAMIND_OLLAMA_URL (set at deploy); it carries no model and no Python.

Equations in this build

8 linked mathematical records. Each opens its notation, interpretation and source.