docker hard image

[asmogo]

Description

docker image without /bin/sh built from scratch image.

---

Notes to the reviewers

---

Suggested CHANGELOG Updates

CHANGED

ADDED

REMOVED

FIXED

---

Checklist

• I followed the code style guidelines
• I ran just quick-check before committing
• If the Wallet API was modified (added/removed/changed), I have reflected those changes in the FFI bindings (crates/cdk-ffi)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.18%. Comparing base (2ac4708) to head (ce54475).
⚠️ Report is 46 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2078      +/-   ##
==========================================
+ Coverage   69.08%   70.18%   +1.09%     
==========================================
  Files         352      355       +3     
  Lines       69568    71119    +1551     
==========================================
+ Hits        48064    49914    +1850     
+ Misses      21504    21205     -299     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[prusnak]

Don't we want to create /tmp too and point SQLITE_TMPDIR and TMPDIR there?

Mixing data files and temp files together sounds bad.

[asmogo]

I think you are right. We probably don't have to create the directory at all.
I'm going to update this. Thanks.

[cdk-bot]

Verified findings approved for disclosure:

• README references nonexistent docker-compose.hardened.yaml (low) - Users following the new hardened-image Compose instructions will fail with a missing compose file and have no in-repo compose configuration applying the described hardening flags.

[cdk-bot]

The new hardened-image README section points users to docker-compose -f docker-compose.hardened.yaml up, but this PR only adds Dockerfile.hardened and no docker-compose.hardened.yaml exists in the repository. Users following the documented Compose workflow will hit a missing-file error. Please either add the referenced Compose file with the runtime hardening settings described here, or remove/adjust this paragraph.