Re: Add Dockerfile for OSS Scanner

On Sat, Oct 17, 2026 at 09:16:58PM +0530, Ayush Tiwari wrote:
> On Sat, 17 Oct 2026 at 21:06, Noah Misch <noah(at)leadboat(dot)com> wrote:
> > # The tests that try each of TestAio::supported_io_methods() would fail if
> > # run, since oss-scanner seccomp blocks io_uring. Speculate that having the
> > # io_uring code in the binary, visible to the scanner's other analyses, is
> > # more valuable than having those tests pass. If the scanner execution
> > # environment relaxes restrictions, this build will be ready.
>
> Could we add docker default seccomp block io_uring instead of
> oss-scaner does? Else it seems like our file limitation.

No, I think the comment more accurately describes the separation of concerns.
oss-scanner chooses how to configure docker. It currently chooses a way that
includes this seccomp restriction, and it could choose differently. Whether
that's an explicit choice or a docker default, the part PostgreSQL controls
experiences it the same way.

> There's a tiny typo present in both patches:
> "opts to runs" -> "opts to run".

Fixed. Thanks.