Blekline | Non-Human Identity & Runtime Enforcement

Track 02 validates Blekline runtime enforcement in Docker before a Kubernetes pilot. Default path is image-only — same binary as production and Track 03.

Image

ghcr.io/blekline/sidecar:0.2.0-nhim

NHIM capabilities (Trust Vault, Lineage Firewall) require the NHIM image above — not a DIY build from the open-source reference sidecar (contracts-level enforcement only).

Quick start

docker pull ghcr.io/blekline/sidecar:0.2.0-nhim

export BLEKLINE_WORKSPACE_TOKEN="blw_..."
export BLEKLINE_SIDECAR_AUTH="$(openssl rand -hex 32)"
export BLEKLINE_VAULT_MASTER_KEY="$(openssl rand -hex 32)"

docker compose up -d

Enterprise sandbox packs include a ready docker-compose.yaml, hardening guide, and digest-pin checklist.

Required secrets

Variable	Purpose
`BLEKLINE_SIDECAR_AUTH`	Bearer token for sidecar ingress (required)
`BLEKLINE_VAULT_MASTER_KEY`	Trust Vault encryption key
`BLEKLINE_WORKSPACE_TOKEN`	Control plane policy + events

See Trust Vault sidecar and Lineage enforcement.

Verify health

# Without auth — expect 401
curl -s -o /dev/null -w "%{http_code}" http://localhost:8787/health

# With auth — expect 200
curl -H "Authorization: Bearer $BLEKLINE_SIDECAR_AUTH" http://localhost:8787/health

Point SDKs and agents at http://localhost:8787/v1. See Ingress proxy for route compatibility.

Mandatory hop pattern

Agent process → POST /v1/enforce-tool-call → (allow) → downstream tool/MCP
                     ↑
              blekline-sidecar (:8787)

Before every tool call, agents must call enforce on the sidecar. Direct downstream access should fail when lineage and network controls are enabled.

Compliance scope

Primary OWASP ASI path: ASI02, ASI03, ASI08. Lineage (ASI01/05/06) when lineage firewall is enabled in policy.

Optional pre-flight: [NHIM audit quickstart](/docs/get-started/nhim-audit-quickstart).

[Eval journey](/docs/get-started/eval-journey) — Track 02 checklist
Kubernetes fleet — production topology
Enterprise deployment — MCP fleet and MDM rollout