From 7d88cbcd043ffc145c6b723e050994de65faf1c7 Mon Sep 17 00:00:00 2001
From: Adrian Bienkowski <adrian@chainsafe.io>
Date: Fri, 11 Sep 2026 20:52:13 -0400
Subject: [PATCH 01/16] fix: eliminate race conditions in release-go job

- Add conditional 'if: matrix.goarch == amd64' to Docker, SBOM, and Cosign steps
- This ensures these operations run only once in the amd64 matrix job
- Add 'platforms: linux/amd64,linux/arm64' to docker/build-push-action
- buildx now creates a single multi-arch image index in one operation
- This eliminates the race condition where both matrix jobs push to the same tag
- Avoids concurrent SBOM filename collisions and Cosign signature races
- Single-arch binaries still build independently in both matrix jobs (correct)
---
 .github/workflows/release.yml | 30 ++++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 079d162..45ed8bb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -93,38 +93,50 @@ jobs:
             --clobber
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Log in to GHCR
+      # Docker image build, SBOM, and Cosign steps only run in the amd64 job.
+      # buildx handles multi-arch in a single operation (platforms: linux/amd64,linux/arm64).
+      - if: matrix.goarch == 'amd64'
+        name: Log in to GHCR
         uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push Go Docker image
+      - if: matrix.goarch == 'amd64'
+        name: Build and push Go Docker image (multi-arch)
         uses: docker/build-push-action@v7
         with:
           context: go
           file: go/Dockerfile
+          # Multi-arch: buildx creates a single image index for amd64 & arm64.
+          # This eliminates race conditions from matrix jobs pushing to the same tag.
+          # SBOM and Cosign operations then work on the completed index.
+          platforms: linux/amd64,linux/arm64
           push: true
           build-args: |
             VERSION=${{ needs.version.outputs.tag }}
           tags: |
             ghcr.io/chainsafe/docker-socket-policy-go:${{ needs.version.outputs.tag }}
             ghcr.io/chainsafe/docker-socket-policy-go:latest
-      - name: Install syft
+      - if: matrix.goarch == 'amd64'
+        name: Install syft
         run: |
           curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | \
             sh -s -- -b /usr/local/bin v1.42.3
-      - name: Generate SPDX SBOM for Go image
+      - if: matrix.goarch == 'amd64'
+        name: Generate SPDX SBOM for Go image
         run: >
           syft ghcr.io/chainsafe/docker-socket-policy-go:${{ needs.version.outputs.tag }}
           -o spdx-json
           --file docker-socket-policy-go.spdx.json
-      - name: Generate CycloneDX SBOM for Go image
+      - if: matrix.goarch == 'amd64'
+        name: Generate CycloneDX SBOM for Go image
         run: >
           syft ghcr.io/chainsafe/docker-socket-policy-go:${{ needs.version.outputs.tag }}
           -o cyclonedx-json
           --file docker-socket-policy-go.cyclonedx.json
-      - name: Upload Go SBOMs to release
+      - if: matrix.goarch == 'amd64'
+        name: Upload Go SBOMs to release
         run: |
           gh release upload "${{ needs.version.outputs.tag }}" \
             docker-socket-policy-go.spdx.json \
@@ -132,8 +144,10 @@ jobs:
             --clobber
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: sigstore/cosign-installer@v3
-      - name: Sign Go Docker image with Cosign
+      - if: matrix.goarch == 'amd64'
+        uses: sigstore/cosign-installer@v3
+      - if: matrix.goarch == 'amd64'
+        name: Sign Go Docker image with Cosign
         env:
           COSIGN_EXPERIMENTAL: 1
         run: |

From 31296b6025374ed6a420fe731665150cc4e6b4dd Mon Sep 17 00:00:00 2001
From: Adrian Bienkowski <adrian@chainsafe.io>
Date: Fri, 11 Sep 2026 20:54:00 -0400
Subject: [PATCH 02/16] ci: add arm64 Rust binary build with cross-compilation

---
 .cargo/Cross.toml             |  5 ++++
 .github/workflows/release.yml | 48 +++++++++++++++++++++++++++--------
 2 files changed, 42 insertions(+), 11 deletions(-)
 create mode 100644 .cargo/Cross.toml

diff --git a/.cargo/Cross.toml b/.cargo/Cross.toml
new file mode 100644
index 0000000..47c6a55
--- /dev/null
+++ b/.cargo/Cross.toml
@@ -0,0 +1,5 @@
+[build]
+target-dir = "/target"
+
+[target.aarch64-unknown-linux-musl]
+# cross handles sysroot automatically
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 45ed8bb..4cd8065 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -157,51 +157,75 @@ jobs:
   release-rust:
     needs: [version]
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        rust_target: [x86_64-unknown-linux-musl, aarch64-unknown-linux-musl]
+        include:
+          - rust_target: x86_64-unknown-linux-musl
+            arch_name: amd64
+          - rust_target: aarch64-unknown-linux-musl
+            arch_name: arm64
     steps:
       - uses: actions/checkout@v7
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           toolchain: "1.85"
+          targets: ${{ matrix.rust_target }}
+      - name: Install cross
+        run: cargo install cross
       - name: Build Rust binary
-        run: cd rs && cargo build --release
+        run: cd rs && cross build --release --target ${{ matrix.rust_target }}
       - name: Upload Rust binary to release
         run: |
-          cp rs/target/release/docker-socket-policy docker-socket-policy-rs-linux-amd64
+          cp rs/target/${{ matrix.rust_target }}/release/docker-socket-policy docker-socket-policy-rs-linux-${{ matrix.arch_name }}
           gh release upload "${{ needs.version.outputs.tag }}" \
-            docker-socket-policy-rs-linux-amd64 \
+            docker-socket-policy-rs-linux-${{ matrix.arch_name }} \
             --clobber
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Log in to GHCR
+      # Docker image build, SBOM, and Cosign steps only run in the amd64 job.
+      - if: matrix.arch_name == 'amd64'
+        name: Log in to GHCR
         uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push Rust Docker image
+      - if: matrix.arch_name == 'amd64'
+        name: Build and push Rust Docker image (multi-arch)
         uses: docker/build-push-action@v7
         with:
           context: rs
           file: rs/Dockerfile
+          # Multi-arch: buildx creates a single image index for amd64 & arm64.
+          # This eliminates race conditions from matrix jobs pushing to the same tag.
+          # SBOM and Cosign operations then work on the completed index.
+          platforms: linux/amd64,linux/arm64
           push: true
+          build-args: |
+            VERSION=${{ needs.version.outputs.tag }}
           tags: |
             ghcr.io/chainsafe/docker-socket-policy-rs:${{ needs.version.outputs.tag }}
             ghcr.io/chainsafe/docker-socket-policy-rs:latest
-      - name: Install syft
+      - if: matrix.arch_name == 'amd64'
+        name: Install syft
         run: |
           curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | \
             sh -s -- -b /usr/local/bin v1.42.3
-      - name: Generate SPDX SBOM for Rust image
+      - if: matrix.arch_name == 'amd64'
+        name: Generate SPDX SBOM for Rust image
         run: >
           syft ghcr.io/chainsafe/docker-socket-policy-rs:${{ needs.version.outputs.tag }}
           -o spdx-json
           --file docker-socket-policy-rs.spdx.json
-      - name: Generate CycloneDX SBOM for Rust image
+      - if: matrix.arch_name == 'amd64'
+        name: Generate CycloneDX SBOM for Rust image
         run: >
           syft ghcr.io/chainsafe/docker-socket-policy-rs:${{ needs.version.outputs.tag }}
           -o cyclonedx-json
           --file docker-socket-policy-rs.cyclonedx.json
-      - name: Upload Rust SBOMs to release
+      - if: matrix.arch_name == 'amd64'
+        name: Upload Rust SBOMs to release
         run: |
           gh release upload "${{ needs.version.outputs.tag }}" \
             docker-socket-policy-rs.spdx.json \
@@ -209,8 +233,10 @@ jobs:
             --clobber
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: sigstore/cosign-installer@v3
-      - name: Sign Rust Docker image with Cosign
+      - if: matrix.arch_name == 'amd64'
+        uses: sigstore/cosign-installer@v3
+      - if: matrix.arch_name == 'amd64'
+        name: Sign Rust Docker image with Cosign
         env:
           COSIGN_EXPERIMENTAL: 1
         run: |

From 087e3150a8a13e82b75f443dbf467ec1dc676d81 Mon Sep 17 00:00:00 2001
From: Adrian Bienkowski <adrian@chainsafe.io>
Date: Fri, 11 Sep 2026 20:56:20 -0400
Subject: [PATCH 03/16] ci/docker: enable multi-arch builds (amd64, arm64) for
 all implementations

---
 go/Dockerfile |  6 +++---
 rs/Dockerfile | 11 +++++++----
 ts/Dockerfile |  4 ++--
 3 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/go/Dockerfile b/go/Dockerfile
index 2bed941..3d3ea74 100644
--- a/go/Dockerfile
+++ b/go/Dockerfile
@@ -1,11 +1,11 @@
-FROM --platform=linux/amd64 stagex/pallet-go@sha256:d7e9e39ab6e9c254f5eacf3ae5496024dc95e4deaf1402a67fda96f2da007558 AS build
+FROM stagex/pallet-go@sha256:d7e9e39ab6e9c254f5eacf3ae5496024dc95e4deaf1402a67fda96f2da007558 AS build
 
 ARG VERSION=dev
 
 ENV SOURCE_DATE_EPOCH=1
 ENV CGO_ENABLED=0
 ENV GOOS=linux
-ENV GOARCH=amd64
+ENV GOARCH=${TARGETARCH}
 
 WORKDIR /app
 COPY go.mod go.sum ./
@@ -22,7 +22,7 @@ RUN --network=none \
     -o /docker-socket-policy \
     .
 
-FROM --platform=linux/amd64 stagex/core-filesystem@sha256:cd3a66471ce1f630fa77d5c9bd9829f9f9fab6302a1aaa64d67b74f1f069b750 AS run
+FROM stagex/core-filesystem@sha256:cd3a66471ce1f630fa77d5c9bd9829f9f9fab6302a1aaa64d67b74f1f069b750 AS run
 COPY --from=build /docker-socket-policy /docker-socket-policy
 USER 65532:65532
 ENTRYPOINT ["/docker-socket-policy"]
diff --git a/rs/Dockerfile b/rs/Dockerfile
index 6500975..821a6a7 100644
--- a/rs/Dockerfile
+++ b/rs/Dockerfile
@@ -1,4 +1,4 @@
-FROM --platform=linux/amd64 stagex/pallet-rust@sha256:59d4d0c9e232a05ecb99348f7216b521af1b914a430059dbdb9130018f2afde1 AS build
+FROM stagex/pallet-rust@sha256:59d4d0c9e232a05ecb99348f7216b521af1b914a430059dbdb9130018f2afde1 AS build
 
 ENV SOURCE_DATE_EPOCH=1
 ENV CARGO_TARGET_DIR=/target
@@ -13,13 +13,16 @@ RUN cargo fetch --locked --target "$(uname -m)-unknown-linux-musl" 2>/dev/null |
 COPY src/ src/
 
 RUN --network=none <<-'EOF'
-  set -eux
-  triple="$(uname -m)-unknown-linux-musl"
+  case "${TARGETPLATFORM}" in
+    linux/amd64)  triple="x86_64-unknown-linux-musl" ;;
+    linux/arm64)  triple="aarch64-unknown-linux-musl" ;;
+    *) echo "Unsupported platform: ${TARGETPLATFORM}"; exit 1 ;;
+  esac
   cargo build --frozen --release --target "${triple}"
   install -Dm755 "/target/${triple}/release/docker-socket-policy" /docker-socket-policy
 EOF
 
-FROM --platform=linux/amd64 scratch AS run
+FROM scratch AS run
 COPY --from=build /docker-socket-policy /docker-socket-policy
 USER 65532:65532
 ENTRYPOINT ["/docker-socket-policy"]
diff --git a/ts/Dockerfile b/ts/Dockerfile
index 0a0735e..7b18698 100644
--- a/ts/Dockerfile
+++ b/ts/Dockerfile
@@ -1,4 +1,4 @@
-FROM --platform=linux/amd64 stagex/pallet-nodejs@sha256:2e09e7bc24546c76afeac30a50404ce4b2d44aa48c4d4950c40304d8bf7e057f AS build
+FROM stagex/pallet-nodejs@sha256:2e09e7bc24546c76afeac30a50404ce4b2d44aa48c4d4950c40304d8bf7e057f AS build
 
 ENV SOURCE_DATE_EPOCH=1
 
@@ -10,7 +10,7 @@ COPY . .
 
 RUN npx tsc
 
-FROM --platform=linux/amd64 stagex/core-filesystem@sha256:cd3a66471ce1f630fa77d5c9bd9829f9f9fab6302a1aaa64d67b74f1f069b750 AS run
+FROM stagex/core-filesystem@sha256:cd3a66471ce1f630fa77d5c9bd9829f9f9fab6302a1aaa64d67b74f1f069b750 AS run
 COPY --from=stagex/core-musl@sha256:a06cf7b4a7c57313e21ece02d460b7393eb64e0b3ee1de00e1408392ccf283f3 / /
 COPY --from=stagex/core-libcxx@sha256:414761e604c54982aaf0a33f7aa942652fa3d2de1e4f0802b15fa2413ad7ce71 / /
 COPY --from=stagex/core-libcxxabi@sha256:7b515659b7c073329e2cd09037eb0c8bad0a76acd1947efe22c7071a380f465b / /

From 042c145dca28330603270629c250811e06948fd4 Mon Sep 17 00:00:00 2001
From: Adrian Bienkowski <adrian@chainsafe.io>
Date: Fri, 11 Sep 2026 20:58:33 -0400
Subject: [PATCH 04/16] docs: update reproducible-builds.md for multi-arch
 support (amd64, arm64)

---
 docs/reproducible-builds.md | 54 ++++++++++++++++++++++++++++++-------
 1 file changed, 45 insertions(+), 9 deletions(-)

diff --git a/docs/reproducible-builds.md b/docs/reproducible-builds.md
index 763e77f..ad6ca38 100644
--- a/docs/reproducible-builds.md
+++ b/docs/reproducible-builds.md
@@ -1,6 +1,6 @@
 # Reproducible Builds Verification
 
-This document describes how to verify that docker-socket-policy builds are reproducible and how to verify SBOMs and signatures.
+This document describes how to verify that docker-socket-policy builds are reproducible and how to verify SBOMs and signatures. docker-socket-policy is built for multiple architectures: **amd64** and **arm64**.
 
 ## Prerequisites
 
@@ -30,46 +30,79 @@ Each target builds twice with `--no-cache` and uses `cmp` to confirm bit-identic
 
 ## Verify a Single Build Step by Step
 
+### Build and Verify amd64 Binary
+
 ```bash
-# Build Go binary
+# Build Go binary for amd64
 docker build --no-cache --platform linux/amd64 \
   --build-arg VERSION=$(git describe --tags --always --dirty) \
-  --output type=local,dest=/tmp/build \
+  --output type=local,dest=/tmp/build-amd64 \
   -f go/Dockerfile go/
 
 # Check the binary
-file /tmp/build/docker-socket-policy
+file /tmp/build-amd64/docker-socket-policy
 # Expected: ELF 64-bit LSB executable, x86-64, statically linked
 
 # Generate SBOM
-syft scan /tmp/build/docker-socket-policy -o spdx-json > docker-socket-policy.spdx.json
-syft scan /tmp/build/docker-socket-policy -o cyclonedx-json > docker-socket-policy.cyclonedx.json
+syft scan /tmp/build-amd64/docker-socket-policy -o spdx-json > docker-socket-policy-amd64.spdx.json
+syft scan /tmp/build-amd64/docker-socket-policy -o cyclonedx-json > docker-socket-policy-amd64.cyclonedx.json
+```
+
+### Build and Verify arm64 Binary
+
+```bash
+# Build Go binary for arm64
+docker build --no-cache --platform linux/arm64 \
+  --build-arg VERSION=$(git describe --tags --always --dirty) \
+  --output type=local,dest=/tmp/build-arm64 \
+  -f go/Dockerfile go/
+
+# Check the binary
+file /tmp/build-arm64/docker-socket-policy
+# Expected: ELF 64-bit LSB executable, ARM aarch64, statically linked
+
+# Generate SBOM
+syft scan /tmp/build-arm64/docker-socket-policy -o spdx-json > docker-socket-policy-arm64.spdx.json
+syft scan /tmp/build-arm64/docker-socket-policy -o cyclonedx-json > docker-socket-policy-arm64.cyclonedx.json
 ```
 
 ## Verify SBOMs from a Release
 
+Binary artifacts are available for both amd64 and arm64:
+
 ```bash
 # Download SBOMs from a release
 gh release download v0.1.0 --pattern "*.spdx.json"
 gh release download v0.1.0 --pattern "*.cyclonedx.json"
 
-# Inspect SBOM
+# Available binaries: docker-socket-policy-{go,rs,ts}-linux-{amd64,arm64}
+ls -la docker-socket-policy-*-linux-*
+
+# Inspect SBOM (covers all architectures in the release)
 cat docker-socket-policy-go.spdx.json | jq '.packages[].name'
 ```
 
 ## Verify Docker Image Signatures
 
+Docker images are published as **multi-arch manifest indexes** that automatically select the correct architecture (amd64 or arm64) when pulling:
+
 ```bash
-# Verify Cosign signature (keyless via OIDC)
+# Verify Cosign signature on multi-arch image (verifies entire manifest index)
 cosign verify \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com \
   ghcr.io/chainsafe/docker-socket-policy-go:<version>
+
+# Pull for specific architecture (if you need to override auto-detection)
+docker pull --platform linux/amd64 ghcr.io/chainsafe/docker-socket-policy-go:<version>
+docker pull --platform linux/arm64 ghcr.io/chainsafe/docker-socket-policy-go:<version>
 ```
 
 ## Verify SBOMs Attached to Docker Images
 
+SBOMs are attached to the multi-arch manifest index, covering all architectures:
+
 ```bash
-# List attestations on an image
+# List attestations on the multi-arch image (covers amd64 and arm64)
 cosign verify-attestation \
   --type spdx \
   ghcr.io/chainsafe/docker-socket-policy-go:<version>
@@ -79,6 +112,9 @@ cosign download attestation \
   --type spdx \
   ghcr.io/chainsafe/docker-socket-policy-go:<version> \
   | jq '.payload | @base64d | fromjson'
+
+# If you need the SBOM for a specific architecture image, download from release artifacts
+# Example: docker-socket-policy-go-linux-arm64.spdx.json
 ```
 
 ## Build from Source

From 6105466df78a543efba9a91d1983e0322bb6445a Mon Sep 17 00:00:00 2001
From: Adrian Bienkowski <adrian@chainsafe.io>
Date: Fri, 11 Sep 2026 21:00:12 -0400
Subject: [PATCH 05/16] docs: document multi-arch support and fix static
 linking claims

---
 README.md | 62 +++++++++++++++++++++++++++++++++++++++++--------------
 1 file changed, 47 insertions(+), 15 deletions(-)

diff --git a/README.md b/README.md
index 111733f..73ce79c 100644
--- a/README.md
+++ b/README.md
@@ -19,6 +19,20 @@ Key features:
 
 ## Installation
 
+### Supported Architectures
+
+docker-socket-policy builds and runs on **amd64** (x86-64) and **arm64** (AArch64) Linux architectures:
+
+- **Docker Images**: Multi-arch manifest indexes automatically select the correct architecture when pulling. No platform flag needed:
+  ```bash
+  docker pull ghcr.io/chainsafe/docker-socket-policy-go:latest
+  # Pulls amd64 on x86-64, arm64 on ARM machines
+  ```
+
+- **Prebuilt Binaries**: Both amd64 and arm64 variants are published with each release.
+
+See [docs/reproducible-builds.md](docs/reproducible-builds.md) for verification and per-architecture build instructions.
+
 ### Docker Images
 
 Signed, SBOM-attested images are published to GHCR for all three implementations:
@@ -36,20 +50,37 @@ Every image is Cosign-signed and ships with SPDX + CycloneDX SBOMs attached to t
 
 ### Prebuilt Binaries
 
-Each [release](https://github.com/ChainSafe/docker-socket-policy/releases/latest) attaches a Go binary, a Rust binary, and a TypeScript build archive (plus SBOMs for each):
+Each [release](https://github.com/ChainSafe/docker-socket-policy/releases/latest) attaches binaries for amd64 and arm64 architectures, plus SBOMs for each:
 
+**Go** (statically linked ELF binary):
 ```bash
-# Go (statically linked binary)
-curl -LO https://github.com/ChainSafe/docker-socket-policy/releases/latest/download/docker-socket-policy-go
-chmod +x docker-socket-policy-go
+# amd64
+curl -LO https://github.com/ChainSafe/docker-socket-policy/releases/latest/download/docker-socket-policy-go-linux-amd64
+chmod +x docker-socket-policy-go-linux-amd64
 
-# TypeScript (Node 22+ required; archive includes dist/ and node_modules/)
-# Replace <version> with the tag shown on the releases page, e.g. v0.2.8
-curl -LO https://github.com/ChainSafe/docker-socket-policy/releases/latest/download/docker-socket-policy-ts-<version>.tar.gz
-tar xzf docker-socket-policy-ts-<version>.tar.gz && node dist/index.js
+# arm64
+curl -LO https://github.com/ChainSafe/docker-socket-policy/releases/latest/download/docker-socket-policy-go-linux-arm64
+chmod +x docker-socket-policy-go-linux-arm64
 ```
 
-The Rust binary is also attached to every release; see the release page for the exact asset name.
+**Rust** (statically linked ELF binary with musl):
+```bash
+# amd64
+curl -LO https://github.com/ChainSafe/docker-socket-policy/releases/latest/download/docker-socket-policy-rs-linux-amd64
+chmod +x docker-socket-policy-rs-linux-amd64
+
+# arm64
+curl -LO https://github.com/ChainSafe/docker-socket-policy/releases/latest/download/docker-socket-policy-rs-linux-arm64
+chmod +x docker-socket-policy-rs-linux-arm64
+```
+
+**TypeScript** (Node 22+ required; archive includes dist/, node_modules/, and package files):
+```bash
+# Extract and run (platform-independent Node archive)
+curl -LO https://github.com/ChainSafe/docker-socket-policy/releases/latest/download/docker-socket-policy-ts-<version>.tar.gz
+tar xzf docker-socket-policy-ts-<version>.tar.gz
+node dist/index.js
+```
 
 To build any implementation from source instead, see [Build All](#build-all) below.
 
@@ -188,12 +219,13 @@ docker pull attacker/malware:latest  # denied: image not in allowlist
 | `--log-file` | `/var/log/docker-socket-policy.log` | Audit log path |
 | `--readonly` | `false` | Enable read-only mode |
 
-> The TypeScript implementation listens on TCP only (`--listen-tcp`); it does not
-> implement `--listen-socket`. All three implementations connect to the Docker
-> daemon over a Unix socket only: Go and Rust treat `--docker-host` as a Unix
-> socket path, and TypeScript additionally rejects `tcp://`/`http://` schemes
-> outright. Connecting to the daemon over TCP would bypass the socket's
-> user/group ownership, which is the security boundary.
+> **Unix socket security boundary**: Go and Rust support `--listen-socket` for
+> binding to a Unix socket, enabling socket-level access control via file
+> permissions and Unix groups. TypeScript does not implement `--listen-socket`
+> and listens on TCP only (`--listen-tcp`). All three implementations connect
+> to the Docker daemon over Unix sockets exclusively; they reject `tcp://` and
+> `http://` schemes for `--docker-host`. TCP connections would bypass socket
+> ownership-based access control, breaking the security model.
 
 ### Systemd Socket Activation
 

From 4273fa6139bd8c01a45bb70c7fe8113bd35e83a1 Mon Sep 17 00:00:00 2001
From: Adrian Bienkowski <adrian@chainsafe.io>
Date: Sat, 12 Sep 2026 08:05:39 -0400
Subject: [PATCH 06/16] fix: handle native docker build fallback for
 TARGETPLATFORM/TARGETARCH (reproducible-build)

---
 go/Dockerfile |  3 ++-
 rs/Dockerfile | 19 +++++++++++++++++--
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/go/Dockerfile b/go/Dockerfile
index 3d3ea74..de35cfb 100644
--- a/go/Dockerfile
+++ b/go/Dockerfile
@@ -5,7 +5,8 @@ ARG VERSION=dev
 ENV SOURCE_DATE_EPOCH=1
 ENV CGO_ENABLED=0
 ENV GOOS=linux
-ENV GOARCH=${TARGETARCH}
+# TARGETARCH is set by docker buildx; fallback to native arch for docker build
+ENV GOARCH=${TARGETARCH:-$(go env GOARCH)}
 
 WORKDIR /app
 COPY go.mod go.sum ./
diff --git a/rs/Dockerfile b/rs/Dockerfile
index 821a6a7..f738da8 100644
--- a/rs/Dockerfile
+++ b/rs/Dockerfile
@@ -13,11 +13,26 @@ RUN cargo fetch --locked --target "$(uname -m)-unknown-linux-musl" 2>/dev/null |
 COPY src/ src/
 
 RUN --network=none <<-'EOF'
-  case "${TARGETPLATFORM}" in
+  # Detect target platform: TARGETPLATFORM is set by buildx, fallback to native arch for docker build
+  if [ -n "${TARGETPLATFORM}" ]; then
+    platform="${TARGETPLATFORM}"
+  else
+    # Native build: detect machine architecture
+    machine_arch=$(uname -m)
+    case "${machine_arch}" in
+      x86_64)  platform="linux/amd64" ;;
+      aarch64) platform="linux/arm64" ;;
+      *) echo "Unsupported native architecture: ${machine_arch}"; exit 1 ;;
+    esac
+  fi
+  
+  # Map platform to Rust target triple
+  case "${platform}" in
     linux/amd64)  triple="x86_64-unknown-linux-musl" ;;
     linux/arm64)  triple="aarch64-unknown-linux-musl" ;;
-    *) echo "Unsupported platform: ${TARGETPLATFORM}"; exit 1 ;;
+    *) echo "Unsupported platform: ${platform}"; exit 1 ;;
   esac
+  
   cargo build --frozen --release --target "${triple}"
   install -Dm755 "/target/${triple}/release/docker-socket-policy" /docker-socket-policy
 EOF

From 35170f10beb27ffd24c41859b8cd7c92f3aa68ca Mon Sep 17 00:00:00 2001
From: Adrian Bienkowski <adrian@chainsafe.io>
Date: Sat, 12 Sep 2026 08:08:50 -0400
Subject: [PATCH 07/16] fix: properly detect architecture in native docker
 build for go/Dockerfile

---
 go/Dockerfile | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/go/Dockerfile b/go/Dockerfile
index de35cfb..39203ab 100644
--- a/go/Dockerfile
+++ b/go/Dockerfile
@@ -5,8 +5,6 @@ ARG VERSION=dev
 ENV SOURCE_DATE_EPOCH=1
 ENV CGO_ENABLED=0
 ENV GOOS=linux
-# TARGETARCH is set by docker buildx; fallback to native arch for docker build
-ENV GOARCH=${TARGETARCH:-$(go env GOARCH)}
 
 WORKDIR /app
 COPY go.mod go.sum ./
@@ -14,14 +12,27 @@ RUN go mod download
 
 COPY . .
 
-RUN --network=none \
-  go build \
+RUN --network=none <<-'EOF'
+  # Detect target architecture: TARGETARCH is set by buildx, fallback to native arch for docker build
+  if [ -n "${TARGETARCH}" ]; then
+    goarch="${TARGETARCH}"
+  else
+    # Native build: detect machine architecture
+    case "$(uname -m)" in
+      x86_64)  goarch="amd64" ;;
+      aarch64) goarch="arm64" ;;
+      *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;;
+    esac
+  fi
+  
+  GOARCH="${goarch}" go build \
     -mod=mod \
     -trimpath \
     -buildvcs=false \
     -ldflags="-s -w -buildid= -X main.Version=${VERSION}" \
     -o /docker-socket-policy \
     .
+EOF
 
 FROM stagex/core-filesystem@sha256:cd3a66471ce1f630fa77d5c9bd9829f9f9fab6302a1aaa64d67b74f1f069b750 AS run
 COPY --from=build /docker-socket-policy /docker-socket-policy

From 1a0bf791afd282c3d62b054049416e673046d7cd Mon Sep 17 00:00:00 2001
From: Adrian Bienkowski <adrian@chainsafe.io>
Date: Sat, 12 Sep 2026 10:09:18 -0400
Subject: [PATCH 08/16] fix: use sh -c to prevent variable expansion during
 dockerfile parse (not heredoc)

---
 go/Dockerfile | 4 ++--
 rs/Dockerfile | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/go/Dockerfile b/go/Dockerfile
index 39203ab..1e63bfa 100644
--- a/go/Dockerfile
+++ b/go/Dockerfile
@@ -12,7 +12,7 @@ RUN go mod download
 
 COPY . .
 
-RUN --network=none <<-'EOF'
+RUN --network=none sh -c '
   # Detect target architecture: TARGETARCH is set by buildx, fallback to native arch for docker build
   if [ -n "${TARGETARCH}" ]; then
     goarch="${TARGETARCH}"
@@ -32,7 +32,7 @@ RUN --network=none <<-'EOF'
     -ldflags="-s -w -buildid= -X main.Version=${VERSION}" \
     -o /docker-socket-policy \
     .
-EOF
+'
 
 FROM stagex/core-filesystem@sha256:cd3a66471ce1f630fa77d5c9bd9829f9f9fab6302a1aaa64d67b74f1f069b750 AS run
 COPY --from=build /docker-socket-policy /docker-socket-policy
diff --git a/rs/Dockerfile b/rs/Dockerfile
index f738da8..89a240b 100644
--- a/rs/Dockerfile
+++ b/rs/Dockerfile
@@ -12,7 +12,7 @@ RUN cargo fetch --locked --target "$(uname -m)-unknown-linux-musl" 2>/dev/null |
 
 COPY src/ src/
 
-RUN --network=none <<-'EOF'
+RUN --network=none sh -c '
   # Detect target platform: TARGETPLATFORM is set by buildx, fallback to native arch for docker build
   if [ -n "${TARGETPLATFORM}" ]; then
     platform="${TARGETPLATFORM}"
@@ -35,7 +35,7 @@ RUN --network=none <<-'EOF'
   
   cargo build --frozen --release --target "${triple}"
   install -Dm755 "/target/${triple}/release/docker-socket-policy" /docker-socket-policy
-EOF
+'
 
 FROM scratch AS run
 COPY --from=build /docker-socket-policy /docker-socket-policy

From 0a917c4e6ea39717780adbe6278367818f5311d3 Mon Sep 17 00:00:00 2001
From: Adrian Bienkowski <adrian@chainsafe.io>
Date: Sat, 12 Sep 2026 10:10:14 -0400
Subject: [PATCH 09/16] fix: use backslash continuation instead of sh -c for
 proper variable handling

---
 go/Dockerfile | 25 ++++++++++---------------
 rs/Dockerfile | 40 ++++++++++++++++------------------------
 2 files changed, 26 insertions(+), 39 deletions(-)

diff --git a/go/Dockerfile b/go/Dockerfile
index 1e63bfa..30edb23 100644
--- a/go/Dockerfile
+++ b/go/Dockerfile
@@ -12,27 +12,22 @@ RUN go mod download
 
 COPY . .
 
-RUN --network=none sh -c '
-  # Detect target architecture: TARGETARCH is set by buildx, fallback to native arch for docker build
-  if [ -n "${TARGETARCH}" ]; then
-    goarch="${TARGETARCH}"
-  else
-    # Native build: detect machine architecture
-    case "$(uname -m)" in
-      x86_64)  goarch="amd64" ;;
-      aarch64) goarch="arm64" ;;
-      *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;;
-    esac
-  fi
-  
-  GOARCH="${goarch}" go build \
+RUN --network=none \
+  goarch="${TARGETARCH}" && \
+  if [ -z "$goarch" ]; then \
+    case "$(uname -m)" in \
+      x86_64)  goarch="amd64" ;; \
+      aarch64) goarch="arm64" ;; \
+      *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;; \
+    esac \
+  fi && \
+  GOARCH="$goarch" go build \
     -mod=mod \
     -trimpath \
     -buildvcs=false \
     -ldflags="-s -w -buildid= -X main.Version=${VERSION}" \
     -o /docker-socket-policy \
     .
-'
 
 FROM stagex/core-filesystem@sha256:cd3a66471ce1f630fa77d5c9bd9829f9f9fab6302a1aaa64d67b74f1f069b750 AS run
 COPY --from=build /docker-socket-policy /docker-socket-policy
diff --git a/rs/Dockerfile b/rs/Dockerfile
index 89a240b..b042f89 100644
--- a/rs/Dockerfile
+++ b/rs/Dockerfile
@@ -12,30 +12,22 @@ RUN cargo fetch --locked --target "$(uname -m)-unknown-linux-musl" 2>/dev/null |
 
 COPY src/ src/
 
-RUN --network=none sh -c '
-  # Detect target platform: TARGETPLATFORM is set by buildx, fallback to native arch for docker build
-  if [ -n "${TARGETPLATFORM}" ]; then
-    platform="${TARGETPLATFORM}"
-  else
-    # Native build: detect machine architecture
-    machine_arch=$(uname -m)
-    case "${machine_arch}" in
-      x86_64)  platform="linux/amd64" ;;
-      aarch64) platform="linux/arm64" ;;
-      *) echo "Unsupported native architecture: ${machine_arch}"; exit 1 ;;
-    esac
-  fi
-  
-  # Map platform to Rust target triple
-  case "${platform}" in
-    linux/amd64)  triple="x86_64-unknown-linux-musl" ;;
-    linux/arm64)  triple="aarch64-unknown-linux-musl" ;;
-    *) echo "Unsupported platform: ${platform}"; exit 1 ;;
-  esac
-  
-  cargo build --frozen --release --target "${triple}"
-  install -Dm755 "/target/${triple}/release/docker-socket-policy" /docker-socket-policy
-'
+RUN --network=none \
+  platform="${TARGETPLATFORM}" && \
+  if [ -z "$platform" ]; then \
+    case "$(uname -m)" in \
+      x86_64)  platform="linux/amd64" ;; \
+      aarch64) platform="linux/arm64" ;; \
+      *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;; \
+    esac \
+  fi && \
+  case "$platform" in \
+    linux/amd64)  triple="x86_64-unknown-linux-musl" ;; \
+    linux/arm64)  triple="aarch64-unknown-linux-musl" ;; \
+    *) echo "Unsupported platform: $platform"; exit 1 ;; \
+  esac && \
+  cargo build --frozen --release --target "$triple" && \
+  install -Dm755 "/target/$triple/release/docker-socket-policy" /docker-socket-policy
 
 FROM scratch AS run
 COPY --from=build /docker-socket-policy /docker-socket-policy

From aecaa76de0b92839adece25a23bf63a4bbf13d8f Mon Sep 17 00:00:00 2001
From: Adrian Bienkowski <adrian@chainsafe.io>
Date: Sat, 12 Sep 2026 10:15:36 -0400
Subject: [PATCH 10/16] fix: use /bin/bash -c with proper quoting for shell
 conditionals in RUN

---
 go/Dockerfile | 12 +++++++-----
 rs/Dockerfile | 16 +++++++++-------
 2 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/go/Dockerfile b/go/Dockerfile
index 30edb23..bde166b 100644
--- a/go/Dockerfile
+++ b/go/Dockerfile
@@ -12,22 +12,24 @@ RUN go mod download
 
 COPY . .
 
-RUN --network=none \
-  goarch="${TARGETARCH}" && \
+RUN --network=none /bin/bash -c '\
+  set -e; \
+  goarch="${TARGETARCH}"; \
   if [ -z "$goarch" ]; then \
     case "$(uname -m)" in \
       x86_64)  goarch="amd64" ;; \
       aarch64) goarch="arm64" ;; \
       *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;; \
-    esac \
-  fi && \
+    esac; \
+  fi; \
   GOARCH="$goarch" go build \
     -mod=mod \
     -trimpath \
     -buildvcs=false \
     -ldflags="-s -w -buildid= -X main.Version=${VERSION}" \
     -o /docker-socket-policy \
-    .
+    . \
+'
 
 FROM stagex/core-filesystem@sha256:cd3a66471ce1f630fa77d5c9bd9829f9f9fab6302a1aaa64d67b74f1f069b750 AS run
 COPY --from=build /docker-socket-policy /docker-socket-policy
diff --git a/rs/Dockerfile b/rs/Dockerfile
index b042f89..3ea0641 100644
--- a/rs/Dockerfile
+++ b/rs/Dockerfile
@@ -12,22 +12,24 @@ RUN cargo fetch --locked --target "$(uname -m)-unknown-linux-musl" 2>/dev/null |
 
 COPY src/ src/
 
-RUN --network=none \
-  platform="${TARGETPLATFORM}" && \
+RUN --network=none /bin/bash -c '\
+  set -e; \
+  platform="${TARGETPLATFORM}"; \
   if [ -z "$platform" ]; then \
     case "$(uname -m)" in \
       x86_64)  platform="linux/amd64" ;; \
       aarch64) platform="linux/arm64" ;; \
       *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;; \
-    esac \
-  fi && \
+    esac; \
+  fi; \
   case "$platform" in \
     linux/amd64)  triple="x86_64-unknown-linux-musl" ;; \
     linux/arm64)  triple="aarch64-unknown-linux-musl" ;; \
     *) echo "Unsupported platform: $platform"; exit 1 ;; \
-  esac && \
-  cargo build --frozen --release --target "$triple" && \
-  install -Dm755 "/target/$triple/release/docker-socket-policy" /docker-socket-policy
+  esac; \
+  cargo build --frozen --release --target "$triple"; \
+  install -Dm755 "/target/$triple/release/docker-socket-policy" /docker-socket-policy \
+'
 
 FROM scratch AS run
 COPY --from=build /docker-socket-policy /docker-socket-policy

From 02586cd6b99739d9671b4f9c430ac43d5dd8e631 Mon Sep 17 00:00:00 2001
From: Adrian Bienkowski <adrian@chainsafe.io>
Date: Sat, 12 Sep 2026 10:17:14 -0400
Subject: [PATCH 11/16] fix: use heredoc with quoted EOF to prevent variable
 expansion at parse time

---
 go/Dockerfile | 36 ++++++++++++++++++------------------
 rs/Dockerfile | 36 ++++++++++++++++++------------------
 2 files changed, 36 insertions(+), 36 deletions(-)

diff --git a/go/Dockerfile b/go/Dockerfile
index bde166b..14b8bd3 100644
--- a/go/Dockerfile
+++ b/go/Dockerfile
@@ -12,24 +12,24 @@ RUN go mod download
 
 COPY . .
 
-RUN --network=none /bin/bash -c '\
-  set -e; \
-  goarch="${TARGETARCH}"; \
-  if [ -z "$goarch" ]; then \
-    case "$(uname -m)" in \
-      x86_64)  goarch="amd64" ;; \
-      aarch64) goarch="arm64" ;; \
-      *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;; \
-    esac; \
-  fi; \
-  GOARCH="$goarch" go build \
-    -mod=mod \
-    -trimpath \
-    -buildvcs=false \
-    -ldflags="-s -w -buildid= -X main.Version=${VERSION}" \
-    -o /docker-socket-policy \
-    . \
-'
+RUN --network=none /bin/bash << 'EOFBUILD'
+set -e
+goarch="${TARGETARCH}"
+if [ -z "$goarch" ]; then
+  case "$(uname -m)" in
+    x86_64)  goarch="amd64" ;;
+    aarch64) goarch="arm64" ;;
+    *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;;
+  esac
+fi
+GOARCH="$goarch" go build \
+  -mod=mod \
+  -trimpath \
+  -buildvcs=false \
+  -ldflags="-s -w -buildid= -X main.Version=${VERSION}" \
+  -o /docker-socket-policy \
+  .
+EOFBUILD
 
 FROM stagex/core-filesystem@sha256:cd3a66471ce1f630fa77d5c9bd9829f9f9fab6302a1aaa64d67b74f1f069b750 AS run
 COPY --from=build /docker-socket-policy /docker-socket-policy
diff --git a/rs/Dockerfile b/rs/Dockerfile
index 3ea0641..39e9da4 100644
--- a/rs/Dockerfile
+++ b/rs/Dockerfile
@@ -12,24 +12,24 @@ RUN cargo fetch --locked --target "$(uname -m)-unknown-linux-musl" 2>/dev/null |
 
 COPY src/ src/
 
-RUN --network=none /bin/bash -c '\
-  set -e; \
-  platform="${TARGETPLATFORM}"; \
-  if [ -z "$platform" ]; then \
-    case "$(uname -m)" in \
-      x86_64)  platform="linux/amd64" ;; \
-      aarch64) platform="linux/arm64" ;; \
-      *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;; \
-    esac; \
-  fi; \
-  case "$platform" in \
-    linux/amd64)  triple="x86_64-unknown-linux-musl" ;; \
-    linux/arm64)  triple="aarch64-unknown-linux-musl" ;; \
-    *) echo "Unsupported platform: $platform"; exit 1 ;; \
-  esac; \
-  cargo build --frozen --release --target "$triple"; \
-  install -Dm755 "/target/$triple/release/docker-socket-policy" /docker-socket-policy \
-'
+RUN --network=none /bin/bash << 'EOFBUILD'
+set -e
+platform="${TARGETPLATFORM}"
+if [ -z "$platform" ]; then
+  case "$(uname -m)" in
+    x86_64)  platform="linux/amd64" ;;
+    aarch64) platform="linux/arm64" ;;
+    *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;;
+  esac
+fi
+case "$platform" in
+  linux/amd64)  triple="x86_64-unknown-linux-musl" ;;
+  linux/arm64)  triple="aarch64-unknown-linux-musl" ;;
+  *) echo "Unsupported platform: $platform"; exit 1 ;;
+esac
+cargo build --frozen --release --target "$triple"
+install -Dm755 "/target/$triple/release/docker-socket-policy" /docker-socket-policy
+EOFBUILD
 
 FROM scratch AS run
 COPY --from=build /docker-socket-policy /docker-socket-policy

From 09e48ff3a3207d75a2634e865da63bc98a82f16d Mon Sep 17 00:00:00 2001
From: Adrian Bienkowski <adrian@chainsafe.io>
Date: Sat, 12 Sep 2026 10:39:01 -0400
Subject: [PATCH 12/16] debug: add diagnostic logging for
 TARGETARCH/TARGETPLATFORM and uname -m

---
 go/Dockerfile | 3 +++
 rs/Dockerfile | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/go/Dockerfile b/go/Dockerfile
index 14b8bd3..24e017e 100644
--- a/go/Dockerfile
+++ b/go/Dockerfile
@@ -14,6 +14,8 @@ COPY . .
 
 RUN --network=none /bin/bash << 'EOFBUILD'
 set -e
+echo "[DEBUG] TARGETARCH=${TARGETARCH}"
+echo "[DEBUG] uname -m=$(uname -m)"
 goarch="${TARGETARCH}"
 if [ -z "$goarch" ]; then
   case "$(uname -m)" in
@@ -22,6 +24,7 @@ if [ -z "$goarch" ]; then
     *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;;
   esac
 fi
+echo "[DEBUG] Detected goarch=$goarch"
 GOARCH="$goarch" go build \
   -mod=mod \
   -trimpath \
diff --git a/rs/Dockerfile b/rs/Dockerfile
index 39e9da4..8929953 100644
--- a/rs/Dockerfile
+++ b/rs/Dockerfile
@@ -14,6 +14,8 @@ COPY src/ src/
 
 RUN --network=none /bin/bash << 'EOFBUILD'
 set -e
+echo "[DEBUG] TARGETPLATFORM=${TARGETPLATFORM}"
+echo "[DEBUG] uname -m=$(uname -m)"
 platform="${TARGETPLATFORM}"
 if [ -z "$platform" ]; then
   case "$(uname -m)" in
@@ -22,6 +24,7 @@ if [ -z "$platform" ]; then
     *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;;
   esac
 fi
+echo "[DEBUG] Detected platform=$platform"
 case "$platform" in
   linux/amd64)  triple="x86_64-unknown-linux-musl" ;;
   linux/arm64)  triple="aarch64-unknown-linux-musl" ;;

From 455df548c610752447d022a9b8797d3431ee2eae Mon Sep 17 00:00:00 2001
From: Adrian Bienkowski <adrian@chainsafe.io>
Date: Sat, 12 Sep 2026 10:42:52 -0400
Subject: [PATCH 13/16] fix: docker heredoc syntax - add -c flag to /bin/bash
 for heredoc support

---
 go/Dockerfile | 2 +-
 rs/Dockerfile | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/go/Dockerfile b/go/Dockerfile
index 24e017e..19f2753 100644
--- a/go/Dockerfile
+++ b/go/Dockerfile
@@ -12,7 +12,7 @@ RUN go mod download
 
 COPY . .
 
-RUN --network=none /bin/bash << 'EOFBUILD'
+RUN --network=none /bin/bash -c << 'EOFBUILD'
 set -e
 echo "[DEBUG] TARGETARCH=${TARGETARCH}"
 echo "[DEBUG] uname -m=$(uname -m)"
diff --git a/rs/Dockerfile b/rs/Dockerfile
index 8929953..9d4d76c 100644
--- a/rs/Dockerfile
+++ b/rs/Dockerfile
@@ -12,7 +12,7 @@ RUN cargo fetch --locked --target "$(uname -m)-unknown-linux-musl" 2>/dev/null |
 
 COPY src/ src/
 
-RUN --network=none /bin/bash << 'EOFBUILD'
+RUN --network=none /bin/bash -c << 'EOFBUILD'
 set -e
 echo "[DEBUG] TARGETPLATFORM=${TARGETPLATFORM}"
 echo "[DEBUG] uname -m=$(uname -m)"

From 2e65c7e8c542faf9065b9a09f48acbd3b1f4b26e Mon Sep 17 00:00:00 2001
From: Adrian Bienkowski <adrian@chainsafe.io>
Date: Sat, 12 Sep 2026 10:58:37 -0400
Subject: [PATCH 14/16] fix: use single-quoted bash -c with line continuations
 instead of heredoc

---
 go/Dockerfile | 29 ++++++++++++++---------------
 rs/Dockerfile | 41 ++++++++++++++++++++---------------------
 2 files changed, 34 insertions(+), 36 deletions(-)

diff --git a/go/Dockerfile b/go/Dockerfile
index 19f2753..10b7c9a 100644
--- a/go/Dockerfile
+++ b/go/Dockerfile
@@ -12,27 +12,26 @@ RUN go mod download
 
 COPY . .
 
-RUN --network=none /bin/bash -c << 'EOFBUILD'
-set -e
-echo "[DEBUG] TARGETARCH=${TARGETARCH}"
-echo "[DEBUG] uname -m=$(uname -m)"
-goarch="${TARGETARCH}"
-if [ -z "$goarch" ]; then
-  case "$(uname -m)" in
-    x86_64)  goarch="amd64" ;;
-    aarch64) goarch="arm64" ;;
-    *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;;
-  esac
-fi
-echo "[DEBUG] Detected goarch=$goarch"
+RUN --network=none /bin/bash -c '\
+set -e; \
+echo "[DEBUG] TARGETARCH=${TARGETARCH}"; \
+echo "[DEBUG] uname -m=$(uname -m)"; \
+goarch="${TARGETARCH}"; \
+if [ -z "$goarch" ]; then \
+  case "$(uname -m)" in \
+    x86_64)  goarch="amd64" ;; \
+    aarch64) goarch="arm64" ;; \
+    *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;; \
+  esac; \
+fi; \
+echo "[DEBUG] Detected goarch=$goarch"; \
 GOARCH="$goarch" go build \
   -mod=mod \
   -trimpath \
   -buildvcs=false \
   -ldflags="-s -w -buildid= -X main.Version=${VERSION}" \
   -o /docker-socket-policy \
-  .
-EOFBUILD
+  .'
 
 FROM stagex/core-filesystem@sha256:cd3a66471ce1f630fa77d5c9bd9829f9f9fab6302a1aaa64d67b74f1f069b750 AS run
 COPY --from=build /docker-socket-policy /docker-socket-policy
diff --git a/rs/Dockerfile b/rs/Dockerfile
index 9d4d76c..35cb239 100644
--- a/rs/Dockerfile
+++ b/rs/Dockerfile
@@ -12,27 +12,26 @@ RUN cargo fetch --locked --target "$(uname -m)-unknown-linux-musl" 2>/dev/null |
 
 COPY src/ src/
 
-RUN --network=none /bin/bash -c << 'EOFBUILD'
-set -e
-echo "[DEBUG] TARGETPLATFORM=${TARGETPLATFORM}"
-echo "[DEBUG] uname -m=$(uname -m)"
-platform="${TARGETPLATFORM}"
-if [ -z "$platform" ]; then
-  case "$(uname -m)" in
-    x86_64)  platform="linux/amd64" ;;
-    aarch64) platform="linux/arm64" ;;
-    *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;;
-  esac
-fi
-echo "[DEBUG] Detected platform=$platform"
-case "$platform" in
-  linux/amd64)  triple="x86_64-unknown-linux-musl" ;;
-  linux/arm64)  triple="aarch64-unknown-linux-musl" ;;
-  *) echo "Unsupported platform: $platform"; exit 1 ;;
-esac
-cargo build --frozen --release --target "$triple"
-install -Dm755 "/target/$triple/release/docker-socket-policy" /docker-socket-policy
-EOFBUILD
+RUN --network=none /bin/bash -c '\
+set -e; \
+echo "[DEBUG] TARGETPLATFORM=${TARGETPLATFORM}"; \
+echo "[DEBUG] uname -m=$(uname -m)"; \
+platform="${TARGETPLATFORM}"; \
+if [ -z "$platform" ]; then \
+  case "$(uname -m)" in \
+    x86_64)  platform="linux/amd64" ;; \
+    aarch64) platform="linux/arm64" ;; \
+    *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;; \
+  esac; \
+fi; \
+echo "[DEBUG] Detected platform=$platform"; \
+case "$platform" in \
+  linux/amd64)  triple="x86_64-unknown-linux-musl" ;; \
+  linux/arm64)  triple="aarch64-unknown-linux-musl" ;; \
+  *) echo "Unsupported platform: $platform"; exit 1 ;; \
+esac; \
+cargo build --frozen --release --target "$triple"; \
+install -Dm755 "/target/$triple/release/docker-socket-policy" /docker-socket-policy'
 
 FROM scratch AS run
 COPY --from=build /docker-socket-policy /docker-socket-policy

From bf6694b556c9fbfd507c2316b67dba083c9a5f8d Mon Sep 17 00:00:00 2001
From: Adrian Bienkowski <adrian@chainsafe.io>
Date: Sat, 12 Sep 2026 11:12:42 -0400
Subject: [PATCH 15/16] fix: use SHELL directive to set bash as default shell
 for RUN commands

---
 go/Dockerfile | 41 +++++++++++++++++++++--------------------
 rs/Dockerfile | 41 +++++++++++++++++++++--------------------
 2 files changed, 42 insertions(+), 40 deletions(-)

diff --git a/go/Dockerfile b/go/Dockerfile
index 10b7c9a..4596264 100644
--- a/go/Dockerfile
+++ b/go/Dockerfile
@@ -6,32 +6,33 @@ ENV SOURCE_DATE_EPOCH=1
 ENV CGO_ENABLED=0
 ENV GOOS=linux
 
+SHELL ["/bin/bash", "-c"]
+
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
 
-RUN --network=none /bin/bash -c '\
-set -e; \
-echo "[DEBUG] TARGETARCH=${TARGETARCH}"; \
-echo "[DEBUG] uname -m=$(uname -m)"; \
-goarch="${TARGETARCH}"; \
-if [ -z "$goarch" ]; then \
-  case "$(uname -m)" in \
-    x86_64)  goarch="amd64" ;; \
-    aarch64) goarch="arm64" ;; \
-    *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;; \
-  esac; \
-fi; \
-echo "[DEBUG] Detected goarch=$goarch"; \
-GOARCH="$goarch" go build \
-  -mod=mod \
-  -trimpath \
-  -buildvcs=false \
-  -ldflags="-s -w -buildid= -X main.Version=${VERSION}" \
-  -o /docker-socket-policy \
-  .'
+RUN --network=none set -e; \
+    echo "[DEBUG] TARGETARCH=${TARGETARCH}"; \
+    echo "[DEBUG] uname -m=$(uname -m)"; \
+    goarch="${TARGETARCH}"; \
+    if [ -z "$goarch" ]; then \
+      case "$(uname -m)" in \
+        x86_64)  goarch="amd64" ;; \
+        aarch64) goarch="arm64" ;; \
+        *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;; \
+      esac; \
+    fi; \
+    echo "[DEBUG] Detected goarch=$goarch"; \
+    GOARCH="$goarch" go build \
+      -mod=mod \
+      -trimpath \
+      -buildvcs=false \
+      -ldflags="-s -w -buildid= -X main.Version=${VERSION}" \
+      -o /docker-socket-policy \
+      .
 
 FROM stagex/core-filesystem@sha256:cd3a66471ce1f630fa77d5c9bd9829f9f9fab6302a1aaa64d67b74f1f069b750 AS run
 COPY --from=build /docker-socket-policy /docker-socket-policy
diff --git a/rs/Dockerfile b/rs/Dockerfile
index 35cb239..13b4b10 100644
--- a/rs/Dockerfile
+++ b/rs/Dockerfile
@@ -5,6 +5,8 @@ ENV CARGO_TARGET_DIR=/target
 ENV CARGO_INCREMENTAL=0
 ENV RUSTFLAGS="-C codegen-units=1 -C target-feature=+crt-static -C strip=symbols --remap-path-prefix=/app=. --remap-path-prefix=/target=target"
 
+SHELL ["/bin/bash", "-c"]
+
 WORKDIR /app
 COPY Cargo.toml Cargo.lock ./
 RUN mkdir src && echo "fn main() {}" > src/main.rs
@@ -12,26 +14,25 @@ RUN cargo fetch --locked --target "$(uname -m)-unknown-linux-musl" 2>/dev/null |
 
 COPY src/ src/
 
-RUN --network=none /bin/bash -c '\
-set -e; \
-echo "[DEBUG] TARGETPLATFORM=${TARGETPLATFORM}"; \
-echo "[DEBUG] uname -m=$(uname -m)"; \
-platform="${TARGETPLATFORM}"; \
-if [ -z "$platform" ]; then \
-  case "$(uname -m)" in \
-    x86_64)  platform="linux/amd64" ;; \
-    aarch64) platform="linux/arm64" ;; \
-    *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;; \
-  esac; \
-fi; \
-echo "[DEBUG] Detected platform=$platform"; \
-case "$platform" in \
-  linux/amd64)  triple="x86_64-unknown-linux-musl" ;; \
-  linux/arm64)  triple="aarch64-unknown-linux-musl" ;; \
-  *) echo "Unsupported platform: $platform"; exit 1 ;; \
-esac; \
-cargo build --frozen --release --target "$triple"; \
-install -Dm755 "/target/$triple/release/docker-socket-policy" /docker-socket-policy'
+RUN --network=none set -e; \
+    echo "[DEBUG] TARGETPLATFORM=${TARGETPLATFORM}"; \
+    echo "[DEBUG] uname -m=$(uname -m)"; \
+    platform="${TARGETPLATFORM}"; \
+    if [ -z "$platform" ]; then \
+      case "$(uname -m)" in \
+        x86_64)  platform="linux/amd64" ;; \
+        aarch64) platform="linux/arm64" ;; \
+        *) echo "Unsupported native architecture: $(uname -m)"; exit 1 ;; \
+      esac; \
+    fi; \
+    echo "[DEBUG] Detected platform=$platform"; \
+    case "$platform" in \
+      linux/amd64)  triple="x86_64-unknown-linux-musl" ;; \
+      linux/arm64)  triple="aarch64-unknown-linux-musl" ;; \
+      *) echo "Unsupported platform: $platform"; exit 1 ;; \
+    esac; \
+    cargo build --frozen --release --target "$triple"; \
+    install -Dm755 "/target/$triple/release/docker-socket-policy" /docker-socket-policy
 
 FROM scratch AS run
 COPY --from=build /docker-socket-policy /docker-socket-policy

From 21cd4afc248bde7253a6a5fcfc8e3019f4fdd359 Mon Sep 17 00:00:00 2001
From: Adrian Bienkowski <adrian@chainsafe.io>
Date: Sat, 12 Sep 2026 11:19:41 -0400
Subject: [PATCH 16/16] fix: use /bin/sh instead of /bin/bash - stagex images
 use busybox

---
 go/Dockerfile | 2 +-
 rs/Dockerfile | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/go/Dockerfile b/go/Dockerfile
index 4596264..f032c9c 100644
--- a/go/Dockerfile
+++ b/go/Dockerfile
@@ -6,7 +6,7 @@ ENV SOURCE_DATE_EPOCH=1
 ENV CGO_ENABLED=0
 ENV GOOS=linux
 
-SHELL ["/bin/bash", "-c"]
+SHELL ["/bin/sh", "-c"]
 
 WORKDIR /app
 COPY go.mod go.sum ./
diff --git a/rs/Dockerfile b/rs/Dockerfile
index 13b4b10..14c2036 100644
--- a/rs/Dockerfile
+++ b/rs/Dockerfile
@@ -5,7 +5,7 @@ ENV CARGO_TARGET_DIR=/target
 ENV CARGO_INCREMENTAL=0
 ENV RUSTFLAGS="-C codegen-units=1 -C target-feature=+crt-static -C strip=symbols --remap-path-prefix=/app=. --remap-path-prefix=/target=target"
 
-SHELL ["/bin/bash", "-c"]
+SHELL ["/bin/sh", "-c"]
 
 WORKDIR /app
 COPY Cargo.toml Cargo.lock ./