[senamakel]

Refs #27
Part of tinyhumansai/openhuman#7328

Stacked on PR #131 (tinybox-27-metadata-ip-alias), which carries the earlier TinyBox #27 phases.

Scope

Adds opt-in native Linux Docker Engine allowlist enforcement through NativeLinuxDockerEgressController. The controller resolves and pins every hostname once, creates a per-box bridge, verifies the bridge in the local namespace and both IPv4/IPv6 FORWARD-to-DOCKER-USER hooks, inspects the assigned IPAM subnets, then installs default-drop firewall rules before docker run. It refuses and rolls back if any pinned destination falls inside the new Docker bridge subnet, preventing on-link ARP routing around the intended gateway path.

The filter permits only pinned TCP destination IP/port pairs. It allows established/related return traffic for host-initiated connections, including published-port requests. New traffic from the managed bridge to the Docker host is dropped, except IPv6 Neighbor Solicitation needed for address resolution. Metadata and loopback destinations are refused by the planner and explicit firewall rules; other link-local destinations can be allowed by the pin plan. IPv6 link-local destinations (fe80::/10) are refused as Unsupported because the current pinning model cannot preserve an interface scope ID; IPv4 link-local destinations remain eligible for explicit allowlisting.

Each prepare attempt gets a fresh token stored as a Docker network label and incorporated into its firewall chain names. Cleanup verifies the network owner, scope, and attempt labels and preflights all chain markers before changing firewall state. If a process exits after exclusive chain creation but before writing its marker, a later cleanup can reclaim that chain only when the matching network labels prove its attempt, the chain is empty, and no firewall hook references it. Nonempty or unverified orphan chains are left untouched. Setup rollback tracks only chains this attempt created, so marker-install failure cannot flush another chain. Failed rollback keeps a retryable record; ordinary network-create conflicts do not trigger cleanup of another box's resources. Ambiguous create transport failures are reconciled only when inspected owner, scope, and attempt labels match the current attempt; nonzero Docker command results preserve the original error without reconciliation.

The chain marker uses a length-delimited SHA-256 token over namespace, box ID, and attempt (sha2 is a direct dependency for this purpose). The sandbox applies each controller Docker-argv rewrite once through ControllerHost; run_docker no longer applies it a second time. A non-idempotent test controller pins this contract.

Pinned hostname/IP pairs are added to the container's static /etc/hosts; container DNS points only to its own loopback resolver, with no Docker embedded DNS forwarding fallback. This uses Docker's per-container DNS setting as documented in Docker networking, and addresses the container-network DNS forwarding issue described in Moby GHSA-mq39-4gv4-mvpx. Unlisted names do not resolve through an upstream service.

Docker Desktop, Windows, remote/unknown hosts, rootless daemons, and unavailable or unverifiable firewall support remain Unsupported. Native filter behavior tests are Linux-only; non-Linux targets test refusal before host commands. The default Docker sandbox continues to refuse allowlists without an explicitly installed controller.

Verification

Fake-Host tests cover pinned rule construction and ordering, cleanup ownership and retry, empty orphan recovery and nonempty orphan refusal after restart, bridge-link and firewall-hook verification, marker-install rollback, TCP-only rules, DNS arguments, persisted allowlist destroy refusal, IPv4 and IPv6 subnet-overlap rejection with network rollback, and create-response reconciliation for current-attempt, old-attempt, absent, foreign, malformed, and unavailable inspection results. A non-idempotent controller test confirms exactly one argv rewrite.

The live proof runs only in the hosted Ubuntu Docker job. It checks an allowlisted hostname over IPv4 and probes the resolved IPv6 literal directly, blocks a different raw TCP port, blocks an explicitly allowed host-gateway listener, blocks unlisted DNS and raw UDP/53, verifies a published-port TCP response, and checks that forbidden listeners were not hit. Every successfully created test box is destroyed even if a probe or assertion fails. No firewall-mutating test was run on the shared development host; hosted Ubuntu is the only real firewall proof.

Local validation: formatting, strict workspace Clippy, cargo test --all-features, and cargo doc --no-deps --all-features with RUSTDOCFLAGS=-D warnings pass. Focused egress tests pass (27/27). cargo llvm-cov --package tinybox-docker --lib reports egress_enforcement.rs at 91.75% line coverage (845/921). The full scripts/check-coverage.sh local run hit a Rust 1.99.1 compiler ICE (no resolution for an import) during coverage compilation; the hosted exact-head coverage job will provide the full-workspace result. Windows-target compilation, cargo-deny, and all-target build passed on the immediately preceding implementation head.

The Tokio lockfile is updated to 1.53.3 for RUSTSEC-2026-0386 (fixed starting at 1.53.3).

[tinysweeper]

Tiny Sweeper review

Reviewed head: 1923fefc18cb5c2fbae9bca28a4eb9687a8f6c3d

Findings

No active actionable findings.

Resolved this pass

• Match the drop rule against iptables -S output format
• Verify the unconditional final DROP, not the owner marker
• Match the drop rule against iptables -S output format
• Verify the unconditional final DROP, not the owner marker
• Verify the unconditional final DROP, not the owner marker
• Match the drop rule against iptables -S output format
• Verify the unconditional final DROP, not the owner marker

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 24 of 25 files; not reviewed: Cargo.lock.

Diagnostics and supporting details

Full summary

Pull request purpose (title): feat(docker): enforce pinned Linux egress allowlists. The whole-pull-request change adds an opt-in native Linux Docker Engine egress controller that resolves and pins allowlist destinations once, creates a per-box bridge, verifies the local bridge and IPv4/IPv6 DOCKER-USER/INPUT hooks plus Docker-assigned IPAM subnets, and installs default-drop filters before the workload starts; setup failure rolls back owned resources and retains a retryable record when cleanup also fails. The change also adds a HostExecutionLocation capability to the Host trait so the controller can refuse hosts that do not attest to local execution, normalizes IPv4-mapped IPv6 resolver answers and refuses IPv6 link-local targets, routes every controller Docker command through a single ControllerHost argv rewrite, and updates the contract and runtime specs. The default Docker sandbox still has no controller and refuses allowlists. The latest-push delta is unavailable, so the whole-pull-request diff is described rather than presented as a push delta.

Unreviewed paths

• Cargo.lock

Review snapshot

Change surface	Files	Review signal	Count
Production	12	Active findings	0
Tests	8	Noted findings	0
Documentation	3	Resolved findings	7
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: Test coverage is assessed from changed tests and lane evidence; execution is not claimed without trusted check data.

What changed

Latest-push delta: unavailable. The review state has the prior reviewed head (a7daa81) and rendered evidence but no trusted base-to-head diff comparison, so the whole-pull-request diff is described below rather than presented as a push delta.

Features

• Added — DockerEgressController trait and NativeLinuxDockerEgressController: Provides an installable controller that validates a local rootful Linux Engine, pins resolver answers, verifies the created network, its IPAM subnets, and the bridge link, rejects pinned destinations inside Docker-assigned subnets, and installs default-drop IPv4/IPv6 filters, failing as ConstraintNotEnforced/Unsupported on unsupported or unverifiable configurations; setup failure triggers native cleanup and returns a distinct rollback operation when cleanup also fails. (crates/tinybox-docker/src/egress_enforcement.rs, crates/tinybox-docker/src/lib.rs pub use oneshot::{)
• Modified — DockerSandbox allowlist enforcement, argv binding, and rollback: Allowlist boxes run only with an installed controller; the host is wrapped in ControllerHost so every docker command is rewritten by the controller exactly once via docker_argv, network preparation precedes docker run, and failed args, name conflicts, and run failures route through rollback that cleans egress state and retains the record when cleanup fails. Destroy refuses persisted allowlist boxes without a controller before touching Docker. (crates/tinybox-docker/src/sandbox/mod.rs impl Sandbox for DockerSandbox {, crates/tinybox-docker/src/sandbox/mod.rs impl DockerSandbox {, crates/tinybox-docker/src/sandbox/args.rs pub(super) fn run()
• Added — HostExecutionLocation capability on the Host trait: Hosts state where commands run; LocalHost, LimitedLocalHost, and JailLocalHost report Local, SshHost reports Remote, and custom hosts default to Unknown, letting the native controller refuse hosts that do not attest to local execution. (crates/tinybox-core/src/runtime/mod.rs pub trait Host: std::fmt::Debug + Send + Sync + 'static {, crates/tinybox-host/src/local/mod.rs impl Host for LocalHost {, crates/tinybox-host/src/limited/mod.rs impl Host for LimitedLocalHost {, crates/tinybox-host/src/limited/jailed.rs impl Host for JailLocalHost {, crates/tinybox-ssh/src/host/mod.rs impl Host for SshHost {)
• Modified — Egress planner answer normalization and IPv6 link-local refusal: Resolver answers given as IPv4-mapped IPv6 are normalized to IPv4 before forbidden-address checks and rule generation, so mapped metadata or loopback addresses are still evaluated and permitted destinations install IPv4 rules; IPv6 link-local destinations are refused as Unsupported because the pinning model cannot preserve an interface scope. (crates/tinybox-docker/src/egress.rs fn normalize_host(host: &str) -> String {, crates/tinybox-docker/src/egress.rs pub fn plan_egress_allowlist(, crates/tinybox-docker/src/egress_tests.rs fn allows_private_addresses_when_the_policy_does_not_forbid_them())
• Modified — Jailed native pipe registration without unsafe code: The deprecated AsyncFd constructor is retained under an explicit allow because the workspace forbids unsafe code; the owned std::fs::File is moved directly into AsyncFd so its descriptor stays valid until AsyncFd is dropped. (crates/tinybox-host/src/limited/jailed.rs fn async_pipe(file: std::fs::File) -> Result<AsyncPipe> {)
• Modified — Specification updates for allowlist status: The contract and runtime spec document that Docker enforces Allowlist only with the explicitly installed native controller on a verified local rootful Linux Engine, that pinned addresses rather than DNS answers are authorized, that only container-local loopback is the DNS upstream, and that other backends and daemon configurations continue to refuse. (docs/specs/contract-1-19.md least 19, which `tinybox_bus::is_compatible` already enforces., docs/specs/tinybox-runtime.md composition in M4. ADR 0004 records the tradeoff.)

Tests

• unit — Uses scripted and fake hosts to cover rollback, record retention, and host-capability forwarding paths, including rollback and attempt-token retention when egress cleanup fails.: Exercises the new sandbox rollback and rewrite contracts; no lane reports execution or passing results. (crates/tinybox-docker/src/sandbox/mod_tests.rs impl Host for ScriptedHost {, crates/tinybox-docker/src/sandbox/mod_tests.rs struct ScriptedHost {)
• unit — Asserts allowlist run args pin every resolved address with --dns 127.0.0.1 and IPv4/IPv6 --add-host formatting.: Backs the argument-construction claims; execution is not reported by the trusted evidence. (crates/tinybox-docker/src/sandbox/mod_tests.rs use std::sync::{, crates/tinybox-docker/src/sandbox/args.rs pub(super) fn run()
• unit — Assertions that LocalHost reports Local execution location, that LimitedLocalHost reports Local, that JailLocalHost attests Local, and that SshHost reports Remote while its inner recording host defaults to Unknown.: Directly tests the new locality capability on each shipped host implementation; execution is not reported by the trusted evidence. (crates/tinybox-host/src/local/mod_tests.rs fn it_reports_its_name() {, crates/tinybox-host/src/limited/jailed_tests.rs impl tinybox_jail::JailBackend for FixtureBackend {, crates/tinybox-ssh/src/host/mod_tests.rs fn last_argv(inner: &RecordingHost) -> Vec<String> {)
• unit — A fake native host models the Docker and firewall command surface to exercise default-drop verification, including the case where the owner-marker DROP exists but the expected final -A <chain> -j DROP is missing.: The answered tests lane reports this pins the default-drop verification and resolves the earlier disputed finding; execution is not reported by the trusted evidence. (crates/tinybox-docker/src/egress_enforcement_tests.rs, crates/tinybox-docker/src/egress_enforcement.rs)

Before merge

None.

How this fits together

flowchart LR
  n0["PinnedEgressTarget<br/>changed"]:::changed
  n1["normalize_host<br/>changed"]:::changed
  n2["plan_egress_allowlist<br/>changed"]:::changed
  n3["...sses_when_the_policy_does_not_forbid_them<br/>changed"]:::changed
  n4["io"]:::impacted
  n5["StaticResolver"]:::impacted
  n6["EgressResolver"]:::impacted
  n7["addresses"]:::impacted
  n8["clone"]:::impacted
  n2 -->|uses| n0
  n2 -->|calls| n1
  n2 -->|uses| n6
  n2 -->|calls| n8
  n3 -->|calls| n2
  n3 -->|tests| n2
  n3 -->|calls| n7
  n3 -->|tests| n7
  n5 -->|implements| n6
  n6 -->|uses| n4
  n7 -->|calls| n5
  n7 -->|uses| n5
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff

Loading

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The answered critique lane reports the change is small and self-consistent, with the async_pipe descriptor-lifetime claim holding and the scoped #[allow(deprecated)], and that JailLocalHost now attests HostExecutionLocation::Local matching the trait default's documented contract.
• Lane summary: The file is a test-only addition (a sibling `#[cfg(test)] #[path]` suite for `egress_enforcement`), and its fakes are only ever exercised on the paths those tests drive. The two earlier findings do not survive inspection of the current code: the fake's `-S` branch emits exactly the `-A FORWARD -j DOCKER-USER` / `-A FORWARD -j DOCKER-FORWARD` lines that `validate_host` looks for, and the `missing_final_drop` branch regenerates the `git ls-files`-equivalent chain dump without the unconditional trailing `-A <chain> -j DROP` that `install_family` verifies, so the final-DROP check is genuinely what fails that test. I found no defect in the new test file worth blocking on; the two prior concerns are dropped.

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The answered security lane reports no untrusted input, auth, or process-boundary change is introduced and finds no defects in its group; it notes the earlier DROP-rule and owner-marker verification concerns are now covered.
• Lane summary: This file adds test-only fakes and assertions for the native Docker egress controller; it introduces no production code paths, no new network or subprocess behaviour, and no untrusted input reaching a sink. The two earlier findings are not raised again: the drop-rule matching concern was disputed and no current-head evidence establishes it, and the unconditional-final-DROP concern is now directly covered by the fake host's `missing_final_drop` path and the `owner_marker_drop_does_not_satisfy_default_drop_verification` test. Nothing reportable remains.

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The answered tests lane reports the final-DROP verification is anchored on the expected literal -A <chain> -j DROP as the last rule in each custom chain, resolving the earlier high finding about the owner marker satisfying default-drop verification and folding in the earlier iptables -S parsing finding.
• Lane summary: The prior disputed finding is resolved by current-head evidence: `install_family` now checks the last rule of each custom chain against the exact string `-A {chain} -j DROP` rather than accepting the owner marker's `-j DROP`, and `PreparedNativeHost` plus the new test `owner_marker_drop_does_not_satisfy_default_drop_verification` exercise that distinction by emitting the marker line while omitting the final drop. The other prior finding is not re-raised, since I cannot establish from this diff that the cleanup-path ownership scan misparses `iptables -S` output. I found no new reportable defect in the added enforcement code or its tests. (1 earlier finding(s) still open)

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The answered commits lane reports no sensitive content in committed files, and notes two earlier findings still open.
• Lane summary: No sensitive content in committed files. (2 earlier finding(s) still open)

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The answered description lane reports the PR description covers the egress controller, the argv-rewrite fix, and the live proof, and that the drop-rule/hook verification logic quoted in the diff is consistent with iptables -S output.
• Lane summary: This revision adds the previously missing test module for the native Docker egress controller and the new fake-host coverage for ownership reconciliation, subnet-overlap rollback, and default-drop verification. The two concerns I raised before are now addressed on the current head: the drop check parses `iptables -S` output as written (`-A <chain> -j DROP`) instead of the arptables-style form, and the new `owner_marker_drop_does_not_satisfy_default_drop_verification` test pins the behaviour that the comment-bearing owner marker cannot stand in for the unconditional final DROP. I found no new defect that this diff introduces.

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.019452
• Tokens: 771228 input · 5543 output · 218752 cached · 799 embedding
• Updated: 2026-10-23T18:36:42Z
• Continuity: summary cache chain restarted at the storage ceiling.

Head	State	Pass summary
234e47bae758	ready for maintainer review	0 active finding(s), 5 resolved finding(s) (at 2026-10-23T17:58:41Z)
68ce7422a0a5	ready for maintainer review	0 active finding(s), 5 resolved finding(s) (at 2026-10-23T18:00:16Z)
fd6b8912156f	ready for maintainer review	0 active finding(s), 8 resolved finding(s) (at 2026-10-23T18:25:46Z)
a7daa817d178	ready for maintainer review	0 active finding(s), 5 resolved finding(s) (at 2026-10-23T18:34:23Z)
1923fefc18cb	ready for maintainer review	0 active finding(s), 7 resolved finding(s) (at 2026-10-23T18:36:42Z)

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d28329fd-fe45-4df3-8d39-19e9039c0135

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T18:39:46.875194Z	1923fef	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[tinysweeper]

Requesting changes: 2 lane(s) blocking, worst finding is high.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

Diagnostics

Total spend: $0.0024

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7be9921765

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".