qbit-document-generation/renderer/DEPLOYMENT.md

Renderer boundary and qualification

The Java distribution and a local Linux/amd64 OCI image candidate have been built. The2026-10-31 image build ran all70 trusted repository renderer tests and recorded exact source/base/final hashes in ../../qbit-documents/artifacts/renderer-image-20261031-0024/README.md. No final renderer container ran, no runtime was installed, and no hostile containment, deployment or printing was qualified. qualification.json deliberately has qualified: false and no accepted image/evidence identifier. A host RenderPort implementation must fail closed until it has an approved immutable image and matching deployment qualification evidence.

The image build requires immutable BUILD_IMAGE and JAVA_IMAGE arguments; there are no floating defaults. Use a reviewed Maven/JDK build image and the reviewed Temurin Java 21.0.13+9 noble runtime described below, with its font/AWT native libraries. Preserve separate dependency JARs and their license resources. Record an SBOM, vulnerability review, exact source/artifact hashes and final image digest. Build-time runtime assertions do not enforce digest selection; release tooling must reject floating references.

Reviewed runtime image correction (2026-10-31)

The original0024 image and its vulnerability scan remain immutable historical evidence. Its Ubuntu26.04 base included vulnerable libbrotli1 and an unused /usr/bin/pebble Go executable. The replacement uses the official Temurin noble image; no package manager upgrade, cross-distribution package copy, binary deletion or vulnerability ignore is needed.

For Linux/amd64 the reviewed JAVA_IMAGE is:

eclipse-temurin:21.0.13_9-jre-noble@sha256:db724162e4ff5f71fa0a2815026314d9e5e0e9a139f49be1d4717e6930e93341

The official multi-architecture index observed during review was sha256:03fedab2c0d7355868b5ba5330d64088b956a0bfac48f904e5c57207e261e2c9. Only the stated amd64 manifest was inspected; other architectures require their own inventory and runtime proof.

A disposable, non-root, read-only, network-disabled, capability-free base inspection recorded Ubuntu24.04.5, Java21.0.13+9-LTS, libbrotli11.1.0-2ubuntu0.1, libfreetype62.13.2+dfsg-1ubuntu0.2, fontconfig2.15.0-1.1ubuntu2 and no Pebble executable. The official Temurin image definition supplies the distribution and native font dependencies. Ubuntu USN-8956-1 identifies1.1.0-2ubuntu0.1 as the noble Brotli fix.

The Dockerfile fails the build unless the supplied base has the reviewed Java/Ubuntu family, at least that vendor Brotli fix, and no Pebble at the former location or on PATH. These assertions do not replace the immutable image reference: the digest fixes all actual package bytes, while the guards reject accidental reuse of the older runtime family. A future digest/version change requires a fresh inventory and review.

The corrected final image build, scan and trusted PDF/ZPL/font corpus are pending. The base inspection proves package identity only; it does not qualify the final renderer, hostile inputs, gVisor deployment or the rest of the host contract below.

The trusted host creates one disposable sandbox per request. Its fixed argument vector must include the equivalent of:

docker create --name <fresh-attempt-name> --pull=never
  --runtime=runsc --network=none --read-only --user=65532:65532
  --cap-drop=ALL --security-opt=no-new-privileges:true --ipc=none
  --pids-limit=64 --memory=536870912 --memory-swap=536870912 --cpus=1
  --ulimit cpu=15:15 --ulimit nofile=64:64
  --tmpfs=/tmp:rw,noexec,nosuid,nodev,size=67108864,mode=1777
  --env=QQQ_RENDERER_MODE=container --log-driver=none
  --label io.qrun.renderer.owner=<deployment-id>
  --label io.qrun.renderer.attempt=<attempt-id>
  -i <approved-renderer-image>@sha256:<digest>

This is a reviewed launch contract, not a command run in this session. A runtime merely named runsc is not evidence of its binary or configuration. The renderer never receives the Docker socket, host mounts, application credentials, object-store URLs, database access or a network namespace with external connectivity.

Attach with fixed argv, send the single bounded JSON line, and enforce a 30-second external deadline plus stdout/stderr budgets outside the worker JVM. On cancellation or error, terminate the entire container, not just the client/JVM. Do not accept output before a zero process exit, protocol validation and verified cleanup. A host audit/journal must durably record intent before creation, exact owned container identity and cleanup outcome. A separate deployment reaper must recover abandoned containers after host/coordinator death, verify owner and attempt labels, and remove only the inspected immutable container ID. The scripting worker's analogous lifecycle is implemented separately; do not make document generation depend on the scripting QBit to acquire this operational boundary.

The host adapter must authorize every retained asset and pinned revision before supplying bytes, validate input and output bounds, maintain user/tenant provenance, and hand generated bytes through retained-file quarantine/audit APIs. A compromised worker can lie about hashes and output safety. Independently enforce the restricted ZPL grammar before printing; do not parse hostile PDFs inside the QQQ application JVM. Qualify an isolated PDF inspection/intake path and viewer policy appropriate for retained generated content.

Required disposable-lab evidence includes actual cgroup memory/CPU/PID limits; host crash and daemon disconnect recovery; output flooding/cancellation; template loops; malformed font/image inputs; filesystem/network/secret isolation; PDF active-content policy; strict ZPL output policy; and no cross-invocation state. RLIMIT_CPU is per process and does not by itself prove aggregate invocation CPU accounting. Post-render page limits do not prevent earlier layout exhaustion. The outer OS budget remains mandatory.

Qualification must also measure concurrency, cold start, large tables, long text, locale/RTL/font coverage and the real production document corpus. Printer/scanner tests are separate from software encode/decode checks. Neither a successful local verify nor an image build grants a production qualification identifier.

Corrected candidate verification (2026-10-31)

New immutable review artifact: qbit-documents/artifacts/renderer-image-20261031-0059. Linux70 tests and three final-image trusted catalog/PDF/ZPL smoke requests passed. Local scan now31 OS findings (27medium4low), nohigh/critical orPebble,17JavaJARs with0 scanner findings. Actual Java21.0.13 entry guard passed. No malicious inputs, deployment or qualified-runtime ID. Full source/base/image hashes, provenance, synthetic outputs and exact limits are recorded in artifact README; original0024 remains immutable.