Entry-Point Runtime — C / C++

Heuristics the Stella Ops scanner uses to classify a container entry point as a native C / C++ binary, plus the evidence it attaches and the edge cases it guards against. For the shared detector contracts, scoring, and calibration, see the Runtime Detector Overview. This is the “native fallback” family: it should only win after every higher-priority language detector has declined.

Signals to gather

• Dynamically linked ELF (.dynamic) with GLIBC references (GLIBC, GLIBCXX, libstdc++).
• Presence of /lib64/ld-linux-*.so.* loaders.
• Absence of Go/Rust-specific markers.
• Native supervisor binaries (nginx, envoy, custom C services).
• Config files adjacent to the binary (/etc/app.conf, YAML/INI).

Implementation notes

• Treat this detector as the “native fallback”: confirm no higher-priority language matched.
• Collect shared library list to attach as evidence; highlight unusual dependencies.
• Inspect EXPOSE ports and config directories to aid classification.
• Normalise busybox-style symlinks (actual binary often /bin/busybox with applet name).

Evidence & scoring

• Boost for ELF dynamic dependencies and loader presence.
• Add evidence for config files, service managers, or env variables.
• Penalise extremely small binaries without metadata (may be wrappers).
• Ecosystem analyzer enrichment is local-only: when a scan root carries __Datasets/ccpp/conan-center/packages.json or __Datasets/ccpp/vcpkg-index/packages.json, Conan/vcpkg components receive ccpp.registry.origin, ccpp.registry.repository, and ccpp.registry.snapshot metadata. Missing or invalid mirrors leave purl identity unchanged and do not trigger network access.

Edge cases

• Static C binaries may look like Go; rely on build-ID absence and library fingerprints.
• When the binary is part of a supervisor stack (e.g., s6-svscan), delegate classification to the Supervisor detector.
• Windows native services should be handled by PE analysis (see the Runtime Detector Overview).

Related

• Runtime Detector Overview — shared contracts, scoring, calibration.
• Entry-Point Runtime — Go — disambiguating static C from Go binaries.
• Entry-Point Runtime — Rust — the other native sibling.
• Supervisor detector — multi-service native stacks.