Docker runs
gstack /cso now runs your app and six scanners in Docker
The gstack docs used to say /cso had no qualified container images, so audits stayed static. With Docker and a matching profile, comprehensive mode now runs your code and the scanners in containers, and drafts repairs.
Runtimes
Ten runtime images, five stacks on two platforms
Node, Bun, Python, Rails and Postgres apps each get a pinned image, built for both x86 and ARM Linux. The runtime set goes live with a companion promotion change, shipping next to this one.
Scanners
Twelve scanner images, six tools on two platforms
gitleaks, the OSV Scanner, Schemathesis, Semgrep, Trivy and zizmor each come in both Linux builds. The scanner set qualified in an earlier change, while the docs still said it did not exist.
Static
Two cases still fall back to static assessment
A machine without Docker still gets the static audit, with its findings and coverage. So does a repo with no matching profile, and Docker on native Windows is one of those.
Your setup
The full catalog is in the qualification doc
docs/cso-release-qualification.mdand CHANGELOG.mdEvery image digest and release check lives in the /cso qualification doc. Is Docker running on the machine where you run /cso?
