feat: allow security scan resource overrides

Signed-off-by: zebbern <185730623+zebbern@users.noreply.github.com>

Author: zebbern

docs/components/security.mdx

@@ -7,6 +7,15 @@ Security components wrap popular open-source tools for subdomain discovery, DNS
 
 ---
 
+## Advanced: container resources
+
+Docker-based security components run with tiered default limits (light / standard / heavy). On any Docker security step, enable **Override container resources** in the config panel to set custom `Container memory limit` (e.g. `4g`, `512m`) and/or `Container CPU limit` (e.g. `2`, `0.5`) for that node only. Leave the toggle off to keep defaults.
+
+- Host Docker must have enough RAM/CPU for overrides; OOM kills typically show exit code **137**.
+- Worker caps: `SENTRIS_DOCKER_MAX_MEMORY` (default `8g`) and `SENTRIS_DOCKER_MAX_CPUS` (default `4`) in [`worker/.env`](../../worker/.env.example).
+
+---
+
 ## Subdomain Discovery
 
 ### Subfinder

worker/.env.example

@@ -39,6 +39,10 @@ OPENSEARCH_DASHBOARDS_URL=http://localhost/analytics
 # For multi-instance setups, use 9100 + instanceNum * 100
 # WORKER_HEALTH_PORT=9100
 
+# Docker security component resource caps (optional)
+# SENTRIS_DOCKER_MAX_MEMORY=8g
+# SENTRIS_DOCKER_MAX_CPUS=4
+
 # Kafka / Redpanda configuration for log and event ingestion
 LOG_KAFKA_BROKERS=localhost:9092
 

worker/src/components/security/__tests__/security-component-catalog.spec.ts

@@ -45,6 +45,14 @@ describe('security component catalog', () => {
       expect(runner.memoryLimit).toBe(profile.memoryLimit);
       expect(runner.cpuLimit).toBe(profile.cpuLimit);
       expect(runner.pidsLimit).toBe(profile.pidsLimit);
+
+      const metadata = componentRegistry
+        .listMetadata()
+        .find((entry) => entry.definition.id === componentId);
+      const parameterIds = metadata?.parameters.map((parameter) => parameter.id) ?? [];
+      expect(parameterIds).toContain('overrideContainerResources');
+      expect(parameterIds).toContain('containerMemoryLimit');
+      expect(parameterIds).toContain('containerCpuLimit');
     }
   });
 });

worker/src/components/security/__tests__/security-docker-resources.test.ts

@@ -1,12 +1,20 @@
-import { describe, expect, it } from 'bun:test';
-import type { DockerRunnerConfig } from '@sentris/component-sdk';
+import { afterEach, describe, expect, it } from 'bun:test';
+import { ValidationError, type DockerRunnerConfig } from '@sentris/component-sdk';
 import {
+  getSecurityDockerMaxCpus,
+  getSecurityDockerMaxMemory,
   mergeSecurityDockerRunner,
+  resolveSecurityDockerResourceOverrides,
   SECURITY_DOCKER_RESOURCE_HEAVY,
   SECURITY_DOCKER_RESOURCE_LIGHT,
 } from '../security-docker-resources';
 
 describe('security-docker-resources', () => {
+  afterEach(() => {
+    delete process.env.SENTRIS_DOCKER_MAX_MEMORY;
+    delete process.env.SENTRIS_DOCKER_MAX_CPUS;
+  });
+
   it('mergeSecurityDockerRunner preserves resource limits from the base runner', () => {
     const baseRunner: DockerRunnerConfig = {
       kind: 'docker',
@@ -27,6 +35,86 @@ describe('security-docker-resources', () => {
     expect(merged.command).toEqual(['scan']);
   });
 
+  it('applies user memory override over tier defaults', () => {
+    const baseRunner: DockerRunnerConfig = {
+      kind: 'docker',
+      ...SECURITY_DOCKER_RESOURCE_LIGHT,
+      image: 'example:latest',
+      network: 'bridge',
+      command: [],
+    };
+
+    const merged = mergeSecurityDockerRunner(
+      baseRunner,
+      { command: ['scan'] },
+      {
+        overrideContainerResources: true,
+        containerMemoryLimit: '4g',
+      },
+    );
+
+    expect(merged.memoryLimit).toBe('4g');
+    expect(merged.cpuLimit).toBe('1');
+  });
+
+  it('ignores overrides when toggle is disabled', () => {
+    expect(
+      resolveSecurityDockerResourceOverrides({
+        overrideContainerResources: false,
+        containerMemoryLimit: '4g',
+      }),
+    ).toEqual({});
+  });
+
+  it('requires at least one limit when override is enabled', () => {
+    expect(() =>
+      resolveSecurityDockerResourceOverrides({
+        overrideContainerResources: true,
+      }),
+    ).toThrow(ValidationError);
+  });
+
+  it('rejects invalid memory format', () => {
+    expect(() =>
+      resolveSecurityDockerResourceOverrides({
+        overrideContainerResources: true,
+        containerMemoryLimit: 'lots-of-ram',
+      }),
+    ).toThrow(ValidationError);
+  });
+
+  it('rejects memory above platform cap', () => {
+    process.env.SENTRIS_DOCKER_MAX_MEMORY = '2g';
+
+    expect(() =>
+      resolveSecurityDockerResourceOverrides({
+        overrideContainerResources: true,
+        containerMemoryLimit: '4g',
+      }),
+    ).toThrow(ValidationError);
+  });
+
+  it('rejects cpu above platform cap', () => {
+    process.env.SENTRIS_DOCKER_MAX_CPUS = '2';
+
+    expect(() =>
+      resolveSecurityDockerResourceOverrides({
+        overrideContainerResources: true,
+        containerCpuLimit: '4',
+      }),
+    ).toThrow(ValidationError);
+  });
+
+  it('reads platform caps from env with defaults', () => {
+    expect(getSecurityDockerMaxMemory()).toBe('8g');
+    expect(getSecurityDockerMaxCpus()).toBe('4');
+
+    process.env.SENTRIS_DOCKER_MAX_MEMORY = '6g';
+    process.env.SENTRIS_DOCKER_MAX_CPUS = '3';
+    expect(getSecurityDockerMaxMemory()).toBe('6g');
+    expect(getSecurityDockerMaxCpus()).toBe('3');
+  });
+
   it('defines distinct light and heavy profiles', () => {
     expect(SECURITY_DOCKER_RESOURCE_LIGHT.memoryLimit).not.toBe(
       SECURITY_DOCKER_RESOURCE_HEAVY.memoryLimit,

worker/src/components/security/__tests__/subfinder.test.ts

@@ -1,4 +1,4 @@
-import { it, expect, beforeAll, afterEach, vi } from 'bun:test';
+import { it, expect, beforeAll, afterEach, vi, describe } from 'bun:test';
 import * as sdk from '@sentris/component-sdk';
 import { componentRegistry } from '../../index';
 import type { SubfinderInput, SubfinderOutput } from '../subfinder';
@@ -171,3 +171,51 @@ dockerDescribe('subfinder component', () => {
     }
   });
 });
+
+describe('subfinder container resources', () => {
+  beforeAll(async () => {
+    await import('../../index');
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('passes custom container memory limits to the docker runner', async () => {
+    const component = componentRegistry.get<SubfinderInput, SubfinderOutput>(
+      'sentris.subfinder.run',
+    );
+    if (!component) throw new Error('Component not registered');
+
+    const context = sdk.createExecutionContext({
+      runId: 'test-run',
+      componentRef: 'subfinder-resource-test',
+    });
+
+    const runnerSpy = vi.spyOn(sdk, 'runComponentWithRunner').mockResolvedValue({
+      subdomains: [],
+      rawOutput: '',
+      domainCount: 1,
+      subdomainCount: 0,
+    });
+
+    await component.execute(
+      {
+        inputs: { domains: ['example.com'] },
+        params: {
+          overrideContainerResources: true,
+          containerMemoryLimit: '4g',
+          containerCpuLimit: '2',
+        },
+      },
+      context,
+    );
+
+    const runnerConfig = runnerSpy.mock.calls[0]?.[0];
+    expect(runnerConfig).toBeDefined();
+    if (runnerConfig && runnerConfig.kind === 'docker') {
+      expect(runnerConfig.memoryLimit).toBe('4g');
+      expect(runnerConfig.cpuLimit).toBe('2');
+    }
+  });
+});

worker/src/components/security/amass.ts

@@ -10,7 +10,6 @@ import {
   parameters,
   port,
   param,
-  type DockerRunnerConfig,
   generateFindingHash,
   analyticsResultSchema,
   type AnalyticsResult,
@@ -20,6 +19,7 @@ import {
 import { IsolatedContainerVolume } from '../../utils/isolated-volume';
 import {
   mergeSecurityDockerRunner,
+  securityDockerResourceParameterShape,
   SECURITY_DOCKER_RESOURCE_HEAVY,
 } from './security-docker-resources';
 
@@ -61,6 +61,7 @@ const inputSchema = inputs({
 });
 
 const parameterSchema = parameters({
+  ...securityDockerResourceParameterShape(),
   passive: param(
     z.boolean().default(true).describe('Use passive mode only (no DNS queries, faster)'),
     {
@@ -637,10 +638,14 @@ const definition = (defineComponent as any)({
         customFlags: customFlagArgs,
       });
 
-      const runnerConfig = mergeSecurityDockerRunner(baseRunner, {
-        command: [...(baseRunner.command ?? []), ...amassArgs],
-        volumes: [volume.getVolumeConfig(CONTAINER_INPUT_DIR, true)],
-      });
+      const runnerConfig = mergeSecurityDockerRunner(
+        baseRunner,
+        {
+          command: [...(baseRunner.command ?? []), ...amassArgs],
+          volumes: [volume.getVolumeConfig(CONTAINER_INPUT_DIR, true)],
+        },
+        parsedParams,
+      );
 
       try {
         const result = await runComponentWithRunner(

worker/src/components/security/checkov.ts

@@ -2,7 +2,6 @@ import { z } from 'zod';
 import {
   componentRegistry,
   runComponentWithRunner,
-  type DockerRunnerConfig,
   ContainerError,
   ComponentRetryPolicy,
   defineComponent,
@@ -18,6 +17,7 @@ import {
 import { IsolatedContainerVolume } from '../../utils/isolated-volume';
 import {
   mergeSecurityDockerRunner,
+  securityDockerResourceParameterShape,
   SECURITY_DOCKER_RESOURCE_STANDARD,
 } from './security-docker-resources';
 import { materializeFileBundle } from './bundle-files';
@@ -44,6 +44,7 @@ const inputSchema = inputs({
 });
 
 const parameterSchema = parameters({
+  ...securityDockerResourceParameterShape(),
   framework: param(
     z
       .enum([
@@ -359,11 +360,15 @@ const definition = defineComponent({
         if (flag.length > 0) args.push(flag);
       }
 
-      const runnerConfig = mergeSecurityDockerRunner(baseRunner, {
-        entrypoint: baseRunner.entrypoint,
-        command: [...(baseRunner.command ?? []), ...args],
-        volumes: [volume.getVolumeConfig(INPUT_DIR, true)],
-      });
+      const runnerConfig = mergeSecurityDockerRunner(
+        baseRunner,
+        {
+          entrypoint: baseRunner.entrypoint,
+          command: [...(baseRunner.command ?? []), ...args],
+          volumes: [volume.getVolumeConfig(INPUT_DIR, true)],
+        },
+        parsedParams,
+      );
 
       try {
         const result = await runComponentWithRunner(

worker/src/components/security/dnsx.ts

@@ -2,7 +2,6 @@ import { z } from 'zod';
 import {
   componentRegistry,
   runComponentWithRunner,
-  type DockerRunnerConfig,
   ContainerError,
   ComponentRetryPolicy,
   defineComponent,
@@ -18,6 +17,7 @@ import {
 import { IsolatedContainerVolume } from '../../utils/isolated-volume';
 import {
   mergeSecurityDockerRunner,
+  securityDockerResourceParameterShape,
   SECURITY_DOCKER_RESOURCE_LIGHT,
 } from './security-docker-resources';
 
@@ -66,6 +66,7 @@ const inputSchema = inputs({
 });
 
 const parameterSchema = parameters({
+  ...securityDockerResourceParameterShape(),
   recordTypes: param(z.array(recordTypeEnum).default(['A']), {
     label: 'Record Types',
     editor: 'multi-select',
@@ -650,10 +651,14 @@ const definition = defineComponent({
       const volumeName = await volume.initialize(inputFiles);
       context.logger.info(`[DNSX] Created isolated volume: ${volumeName}`);
 
-      const runnerConfig = mergeSecurityDockerRunner(baseRunner, {
-        command: [...(baseRunner.command ?? []), ...dnsxArgs],
-        volumes: [volume.getVolumeConfig(CONTAINER_INPUT_DIR, true)],
-      });
+      const runnerConfig = mergeSecurityDockerRunner(
+        baseRunner,
+        {
+          command: [...(baseRunner.command ?? []), ...dnsxArgs],
+          volumes: [volume.getVolumeConfig(CONTAINER_INPUT_DIR, true)],
+        },
+        parsedParams,
+      );
 
       rawPayload = await runComponentWithRunner(
         runnerConfig,

worker/src/components/security/ffuf.ts

@@ -2,7 +2,6 @@ import { z } from 'zod';
 import {
   componentRegistry,
   runComponentWithRunner,
-  type DockerRunnerConfig,
   ContainerError,
   ComponentRetryPolicy,
   defineComponent,
@@ -18,6 +17,7 @@ import {
 import { IsolatedContainerVolume } from '../../utils/isolated-volume';
 import {
   mergeSecurityDockerRunner,
+  securityDockerResourceParameterShape,
   SECURITY_DOCKER_RESOURCE_STANDARD,
 } from './security-docker-resources';
 
@@ -51,6 +51,7 @@ const inputSchema = inputs({
 });
 
 const parameterSchema = parameters({
+  ...securityDockerResourceParameterShape(),
   extensions: param(
     z.string().trim().optional().describe('Comma-separated file extensions (e.g., ".php,.html")'),
     {