pyproject.toml

[project]
name = "containre"
version = "0.2.1"
description = "Sandbox, execution tracer, and flight recorder for potentially dangerous Linux binaries"
readme = "README.md"
requires-python = ">=3.11"
license = { text = "MIT" }
authors = [{ name = "rdk" }]
dependencies = [
    "python-ptrace>=0.9.9",
    "pyyaml>=6.0",
    "jsonschema>=4.18",
    "typer>=0.12",
    "fastapi>=0.139.0",
    "uvicorn[standard]>=0.50.2",
    "capstone>=5.0.9",
    "unicorn>=2.1.4",
    "yara-python>=4.5.4",
    "cryptography>=49.0.0",
]

[project.optional-dependencies]
snapshots = ["zstandard>=0.22"]

[project.scripts]
containre = "containre.cli.main:app"

[dependency-groups]
dev = [
    "httpx>=0.28.1",
    "pytest>=8.0",
    "ruff>=0.15.20",
]

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
packages = ["containre"]

# Ship the JSON-Schema contracts inside the wheel so a pip-installed package can
# validate policies/events (contracts.find_contracts_dir looks in _contracts).
[tool.hatch.build.targets.wheel.force-include]
"contracts" = "containre/_contracts"

[tool.ruff]
line-length = 100
target-version = "py311"

[tool.pytest.ini_options]
testpaths = ["tests"]
addopts = "-ra --strict-markers"
filterwarnings = [
    # Any warning not listed below fails the suite, so new/unexpected warnings surface.
    "error",
    # Our own intentional safety warnings - fired on every LocalRuntime/host-network run
    # and asserted explicitly where it matters (test_units_orchestrator, test_units_docker).
    "ignore::containre.runtime.local.LocalRuntimeIsolationWarning",
    "ignore::containre.runtime.docker.HostNetworkingWarning",
    # Third-party deprecations (Python 3.14 / dependency lag) - not fixable in our tree.
    "ignore::DeprecationWarning:ptrace.tools",
    "ignore::starlette.exceptions.StarletteDeprecationWarning",
]
markers = [
    "unit: pure or low-level tests that do not run specimens under ptrace",
    "localnet: tests that bind or connect loopback sockets",
    "docker: integration tests that need a usable Docker daemon (deselect with -m 'not docker')",
    "specimen: tests that compile and run example specimen binaries under the harness",
]