EXTENSIONS

Take a single base OCI image identifier and emit its security-patched counterpart under the HiveMQ naming convention (<registry>/<namespace>/<flattened>:<tag>-hivemq-patched-<date>). A pure logic model (`plan` generates the security-upgrade Dockerfile + derives the re-homed target; `verify` asserts the expected fixed package versions) plus a bundled workflow that orchestrates a container CLI wrapper around it: plan, build the multi-arch image, verify the expected versions on every platform of it, then push. Two workflow variants ship: the Apple @hivemq/container engine (self-hosted macOS) and @hivemq/docker (standard Linux/GitHub-hosted runners). Motivated by PLT-941 (openssl CVE-2026-45447): own the patch cadence instead of waiting on upstream base rebuilds. Registry credentials are injected from a swamp vault at run time and never persisted in a committed instance.

Thin swamp wrapper around Apple's `container` CLI (a macOS container platform — Linux containers in lightweight VMs on Apple Silicon, no Docker daemon). Image-lifecycle subset: `build`, `run`, `image push`, `registry login` — each method mirrors a `container` subcommand so workflows can drive the build/run/publish lifecycle without bespoke shell steps. Verified against container CLI 1.0.0: no `manifest` subcommand, so a single multi-arch image is built with repeated `--arch` and pushed whole with `image push`.

Run Claude Code (and other workloads) inside a macOS apple/container sandbox.

Run Claude Code (and other workloads) inside a macOS apple/container sandbox.