default_policy.yaml

version: "1"
labels:
  disallow:
  - com.swipely.iam-docker.iam-profile
  - com.swipely.iam-docker.msi-explicit-identity
  - AGENT_FILL
env_keys:
  disallow:
  - IAM_ROLE
  - MSI_IDENTITY
  - LD_PRELOAD
  - AGENT_FILL
volumes:
  # Does not fit with stateless design
  disallowed: true
ports:
  required: false
  # Inclusive range for non-privileged ports
  range: '1025-65535'
size:
  # In MB
  max: 1500
  warning: 500
healthcheck:
  # Causes contention between orchestrator and Docker engine health status
  disallowed: true;
layers:
  max: 100
  warning: 20