#1121 Published v0.6.1 API image omits the default osquery schema file Issue created by pixel8ed The published v0.6.1 API image does not contain the osquery schema file used by its default configuration. The API starts, logs a file-not-found warning, and serves an empty schema catalog. MCP table discovery consequently returns zero tables. Environment • osctrl v0.6.1, commit

e65598fe91422fac7a196a59af638b0397aab41c

. • Published Linux amd64 image

jmpsec/osctrl-api:0.6.1

, digest

sha256:82325aa78540808d35832f14cabcf497d59c748e1c730688700437b7c80f17b4

. • Default schema path;

OSQUERY_TABLES

is unset. • No custom schema file mount. Reproduction 1. Start the published API image with working database/cache configuration and its default schema settings. 2. Startup logs show:

Loading osquery tables from ./data/5.24.0.json
Failed to load osquery tables: open ./data/5.24.0.json: no such file or directory

1. The process working directory is

/opt/osctrl

. Filesystem inspection confirms that

/opt/osctrl/data

and

/opt/osctrl/deploy/osquery/data

are absent. 2. An authenticated

GET /api/v1/osquery/tables

returns HTTP 200 with

[]

. 3. MCP

list_osquery_tables

returns: {"matched":0,"returned":0,"tables":[],"truncated":false} This was observed on both API replicas, including an unfiltered table-list request. Authentication and unrelated MCP reads succeed. Expected behavior The published image should include the versioned schema file referenced by its defaults so schema discovery works without supplying a separate artifact. If an external schema is intentional, the deployment instructions should specify that requirement and the correct path. Packaging and startup behavior • Default schema path resolves to

./data/5.24.0.json

. • API Dockerfile creates

bin

and

config

, copies the executable, and sets `WORKDIR /opt/osctrl`; it does not copy schema data. • API schema initialization replaces a failed load with an empty slice. • The schema exists in the release source tree. The Dockerfile remains unchanged on

develop

at the October 26 check. A published-image smoke test confirming the default file exists and the catalog contains a known table would catch this. The same missing-schema warning appears incidentally in #1066, but that report concerns listener/configuration behavior. This issue isolates the image's missing schema artifact. jmpsec/osctrl