stackrox · janisz · Apr 15, 2026 · Apr 14, 2026 · Apr 15, 2026
diff --git a/Makefile b/Makefile
@@ -490,7 +490,14 @@ main-build-dockerized: build-volumes
 main-build-nodeps:
 	$(GOBUILD) \
 		central \
-		operator/cmd
+		compliance/cmd/compliance \
+		config-controller \
+		migrator \
+		operator/cmd \
+		sensor/admission-control \
+		sensor/kubernetes \
+		sensor/upgrader \
+		compliance/virtualmachines/roxagent
 	mv bin/linux_$(GOARCH)/cmd bin/linux_$(GOARCH)/stackrox-operator
 ifndef CI
 	CGO_ENABLED=0 $(GOBUILD) roxctl
@@ -661,6 +668,7 @@ docker-build-roxctl-image:
 .PHONY: copy-go-binaries-to-image-dir
 copy-go-binaries-to-image-dir:
 	cp bin/linux_$(GOARCH)/central image/rhel/bin/central
+	cp bin/linux_$(GOARCH)/config-controller image/rhel/bin/config-controller
 ifdef CI
 	cp bin/linux_amd64/roxctl image/rhel/bin/roxctl-linux-amd64
 	cp bin/linux_arm64/roxctl image/rhel/bin/roxctl-linux-arm64
@@ -675,9 +683,12 @@ ifneq ($(HOST_OS),linux)
 endif
 	cp bin/$(HOST_OS)_amd64/roxctl image/rhel/bin/roxctl-$(HOST_OS)-amd64
 endif
-	# Note: migrator, kubernetes-sensor, sensor-upgrader, admission-control, compliance, and roxagent
-	# are no longer separate binaries - they're consolidated into central via BusyBox-style dispatch.
-	# The Dockerfiles create symlinks to central for these components.
+	cp bin/linux_$(GOARCH)/migrator image/rhel/bin/migrator
+	cp bin/linux_$(GOARCH)/kubernetes        image/rhel/bin/kubernetes-sensor
+	cp bin/linux_$(GOARCH)/upgrader          image/rhel/bin/sensor-upgrader
+	cp bin/linux_$(GOARCH)/admission-control image/rhel/bin/admission-control
+	cp bin/linux_$(GOARCH)/compliance        image/rhel/bin/compliance
+	cp bin/linux_$(GOARCH)/roxagent          image/rhel/bin/roxagent
 	# Workaround to bug in lima: https://github.com/lima-vm/lima/issues/602
 	find image/rhel/bin -not -path "*/.*" -type f -exec chmod +x {} \;
 

diff --git a/central/main.go b/central/main.go
@@ -5,7 +5,6 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
-	"path/filepath"
 	"syscall"
 	"time"
 
@@ -231,21 +230,19 @@ import (
 	"github.com/stackrox/rox/pkg/sync"
 	"github.com/stackrox/rox/pkg/utils"
 	pkgVersion "github.com/stackrox/rox/pkg/version"
-
-	// BusyBox-style consolidation - import app packages
-	complianceapp "github.com/stackrox/rox/compliance/cmd/compliance/app"
-	roxagentapp "github.com/stackrox/rox/compliance/virtualmachines/roxagent/app"
-	configcontrollerapp "github.com/stackrox/rox/config-controller/app"
-	migratorapp "github.com/stackrox/rox/migrator/app"
-	roxctlapp "github.com/stackrox/rox/roxctl/app"
-	admissioncontrolapp "github.com/stackrox/rox/sensor/admission-control/app"
-	kubernetessensorapp "github.com/stackrox/rox/sensor/kubernetes/app"
-	sensorupgraderapp "github.com/stackrox/rox/sensor/upgrader/app"
 )
 
 var (
 	log = logging.CreateLogger(logging.CurrentModule(), 0)
 
+	authProviderBackendFactories = map[string]authproviders.BackendFactoryCreator{
+		oidc.TypeName:                oidc.NewFactory,
+		"auth0":                      oidc.NewFactory, // legacy
+		saml.TypeName:                saml.NewFactory,
+		authProviderUserpki.TypeName: authProviderUserpki.NewFactoryFactory(tlsconfig.ManagerInstance()),
+		iap.TypeName:                 iap.NewFactory,
+	}
+
 	imageIntegrationContext = sac.WithGlobalAccessScopeChecker(context.Background(),
 		sac.AllowFixedScopes(
 			sac.AccessModeScopeKeys(storage.Access_READ_ACCESS, storage.Access_READ_WRITE_ACCESS),
@@ -281,7 +278,7 @@ func runSafeMode() {
 	log.Info("Central terminated")
 }
 
-func centralRun() {
+func main() {
 	defer utils.IgnoreError(log.InnerLogger.Sync)
 
 	premain.StartMain()
@@ -561,17 +558,6 @@ func startGRPCServer() {
 	// Create the registry of applied auth providers.
 	registry := authProviderRegistry.Singleton()
 
-	// Initialize auth provider backend factories. This must be done here (not at package level)
-	// because tlsconfig.ManagerInstance() requires certificate files that may not be available
-	// for all entry points in the consolidated binary.
-	authProviderBackendFactories := map[string]authproviders.BackendFactoryCreator{
-		oidc.TypeName:                oidc.NewFactory,
-		"auth0":                      oidc.NewFactory, // legacy
-		saml.TypeName:                saml.NewFactory,
-		authProviderUserpki.TypeName: authProviderUserpki.NewFactoryFactory(tlsconfig.ManagerInstance()),
-		iap.TypeName:                 iap.NewFactory,
-	}
-
 	// env.EnableOpenShiftAuth signals the desire but does not guarantee Central
 	// is configured correctly to talk to the OpenShift's OAuth server. If this
 	// is the case, we can be setting up an auth providers which won't work.
@@ -1079,33 +1065,3 @@ func waitForTerminationSignal() {
 	}
 	log.Info("Central terminated")
 }
-
-func main() {
-	// BusyBox-style dispatcher: check how we were called
-	binaryName := filepath.Base(os.Args[0])
-
-	switch binaryName {
-	case "central":
-		centralRun()
-	case "migrator":
-		migratorapp.Run()
-	case "compliance":
-		complianceapp.Run()
-	case "kubernetes-sensor":
-		kubernetessensorapp.Run()
-	case "sensor-upgrader":
-		sensorupgraderapp.Run()
-	case "admission-control":
-		admissioncontrolapp.Run()
-	case "config-controller":
-		configcontrollerapp.Run()
-	case "roxagent":
-		roxagentapp.Run()
-	case "roxctl":
-		roxctlapp.Run()
-	default:
-		// Default to central if called with unknown name
-		log.Warnf("Unknown binary name %q, defaulting to central mode", binaryName)
-		centralRun()
-	}
-}
diff --git a/compliance/cmd/compliance/app/app.go b/compliance/cmd/compliance/app/app.go
diff --git a/compliance/cmd/compliance/main.go b/compliance/cmd/compliance/main.go
@@ -1,7 +1,43 @@
 package main
 
-import "github.com/stackrox/rox/compliance/cmd/compliance/app"
+import (
+	"context"
+
+	"github.com/stackrox/rox/compliance"
+	"github.com/stackrox/rox/compliance/node"
+	"github.com/stackrox/rox/compliance/node/index"
+	"github.com/stackrox/rox/compliance/node/inventory"
+	"github.com/stackrox/rox/pkg/continuousprofiling"
+	"github.com/stackrox/rox/pkg/env"
+	"github.com/stackrox/rox/pkg/logging"
+	"github.com/stackrox/rox/pkg/memlimit"
+	"github.com/stackrox/rox/pkg/retry/handler"
+)
+
+func init() {
+	memlimit.SetMemoryLimit()
+}
+
+var (
+	log = logging.LoggerForModule()
+)
 
 func main() {
-	app.Run()
+	if err := continuousprofiling.SetupClient(continuousprofiling.DefaultConfig()); err != nil {
+		log.Errorf("unable to start continuous profiling: %v", err)
+	}
+
+	np := &node.EnvNodeNameProvider{}
+	cfg := index.DefaultNodeIndexerConfig()
+
+	scanner := inventory.NewNodeInventoryComponentScanner(np)
+	scanner.Connect(env.NodeScanningEndpoint.Setting())
+	cachedNodeIndexer := index.NewCachingNodeIndexer(cfg, env.NodeIndexCacheDuration.DurationSetting(), env.NodeIndexCachePath.Setting())
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	umhNodeInv := handler.NewUnconfirmedMessageHandler(ctx, "node-inventory", env.NodeScanningAckDeadlineBase.DurationSetting())
+	umhNodeIndex := handler.NewUnconfirmedMessageHandler(ctx, "node-index", env.NodeScanningAckDeadlineBase.DurationSetting())
+	c := compliance.NewComplianceApp(np, scanner, cachedNodeIndexer, umhNodeInv, umhNodeIndex)
+	c.Start()
 }
@@ -1,7 +1,36 @@
 package main
 
-import "github.com/stackrox/rox/compliance/virtualmachines/roxagent/app"
+import (
+	"context"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/stackrox/rox/compliance/virtualmachines/roxagent/cmd"
+	"github.com/stackrox/rox/pkg/logging"
+)
+
+var log = logging.LoggerForModule()
 
 func main() {
-	app.Run()
+	// Create a context that is cancellable on the usual command line signals. Double
+	// signal forcefully exits.
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go func() {
+		sigC := make(chan os.Signal, 1)
+		signal.Notify(sigC, syscall.SIGINT, syscall.SIGTERM)
+		sig := <-sigC
+		log.Errorf("%s caught, shutting down...", sig)
+		// Cancel the main context.
+		cancel()
+		go func() {
+			// A second signal will forcefully quit.
+			<-sigC
+			os.Exit(1)
+		}()
+	}()
+	if err := cmd.RootCmd(ctx).Execute(); err != nil {
+		log.Fatal(err)
+	}
 }