Repository navigation

feat(docker): enforce pinned Linux egress allowlists - #132

Merged

senamakel merged 184 commits into

tinybox-27-pinned-egress-planfrom

tinybox-27-linux-egress

Oct 23, 2026

Merged

feat(docker): enforce pinned Linux egress allowlists#132
senamakel merged 184 commits into
tinybox-27-pinned-egress-planfrom
tinybox-27-linux-egress

Commits on Oct 23, 2026
- test(host): cover execution location reporting
  
  senamakel
  and
  medullabot
  committed
  aa95b43
- feat(runtime): add HostExecutionLocation capability to Host
  
  senamakel
  and
  medullabot
  committed
  0c53ae8
- feat(local): report local execution location
  
  senamakel
  and
  medullabot
  committed
  d86fa6d
- feat(ssh): report remote execution location for ssh hosts
  
  senamakel
  and
  medullabot
  committed
  6ef019d
- test(sandbox): cover egress controller prepare and cleanup ordering
  
  senamakel
  and
  medullabot
  committed
  171879c
- feat(docker): expose native linux egress controller
  
  senamakel
  and
  medullabot
  committed
  62771b9
- feat(docker): add pluggable egress controller to sandbox
  
  senamakel
  and
  medullabot
  committed
  a259425
- refactor(sandbox): simplify container removal command construction
  
  senamakel
  and
  medullabot
  committed
  261a654
- feat(egress): add host validation hook to docker egress controller
  
  senamakel
  and
  medullabot
  committed
  efeba54
- feat(sandbox): route docker commands through the egress controller
  
  senamakel
  and
  medullabot
  committed
  fac41f0
- feat(sandbox): support allowlist network policy in docker backend
  
  senamakel
  and
  medullabot
  committed
  72d08de
- style: format egress enforcement and sandbox code
  
  senamakel
  and
  medullabot
  committed
  548863d
- fix(egress): return owned stdout from firewall output
  
  senamakel
  and
  medullabot
  committed
  1b7ea68
- fix(sandbox): roll back egress state when container creation fails
  
  senamakel
  and
  medullabot
  committed
  7a460fc
- test(sandbox): cover native controller rejecting hosts without local identity
  
  senamakel
  and
  medullabot
  committed
  ad3750c
- test(sandbox): use std::io::Result in egress resolver stub
  
  senamakel
  and
  medullabot
  committed
  bcce19b
- test(docker): add egress controller imports to live tests
  
  senamakel
  and
  medullabot
  committed
  8acafa7
- test(docker): cover native egress allowlist against raw tcp
  
  senamakel
  and
  medullabot
  committed
  40399c2
- test(docker): cover egress rollback and host-gateway allowlist denial
  
  senamakel
  and
  medullabot
  committed
  8025f57
- docs(specs): document docker allowlist enforcement
  
  senamakel
  and
  medullabot
  committed
  67c9073
- test(sandbox): cover unknown and remote host locations
  
  senamakel
  and
  medullabot
  committed
  2692fff
- test(sandbox): reformat imports and loop array
  
  senamakel
  and
  medullabot
  committed
  a08371e
- test(tinybox-docker): unset proxy vars in live allowlist probes
  
  senamakel
  and
  medullabot
  committed
  71fe942
- test(docker): run pinned allowlist proof in hosted live lane
  
  senamakel
  and
  medullabot
  committed
  7be9921
- test(egress): wire up egress enforcement test module
  
  senamakel
  and
  medullabot
  committed
  c5b304f
- fix(egress): verify docker forward hook is first in the chain
  
  senamakel
  and
  medullabot
  committed
  7e95600
- refactor(sandbox): extract create rollback and network policy helpers
  
  senamakel
  and
  medullabot
  committed
  6172539
- refactor(sandbox): extract egress and failed-create helpers
  
  senamakel
  and
  medullabot
  committed
  01e03ea
- test(tinybox-ssh): bind inner host in name test
  
  senamakel
  and
  medullabot
  committed
  8b38bda
- test: construct test ip addresses without parsing strings
  
  senamakel
  and
  medullabot
  committed
  360aa64
- chore(deps): update tokio and pin windows-sys to 0.52.0
  
  senamakel
  and
  medullabot
  committed
  6b0e24f
- test(sandbox): cover destroy refusal for persisted allowlist without controller
  
  senamakel
  and
  medullabot
  committed
  043b362
- fix(sandbox): reject destroy for allowlist boxes without egress controller
  
  senamakel
  and
  medullabot
  committed
  3af991c
- fix(limited): silence deprecation warning for async pipe registration
  
  senamakel
  and
  medullabot
  committed
  d5b1cda
- fix(egress): verify docker bridge link before installing firewall
  
  senamakel
  and
  medullabot
  committed
  06e16f0
- test(egress): compare allowlist protocols by slice
  
  senamakel
  and
  medullabot
  committed
  5ce2df0
- fix(egress): restrict allowlist protocols to tcp
  
  senamakel
  and
  medullabot
  committed
  6e3226e
- test: tighten host trait signatures and live docker test setup
  
  senamakel
  and
  medullabot
  committed
  b538f11
- test(sandbox): annotate empty command vector type in assertion
  
  senamakel
  and
  medullabot
  committed
  c92d250
- test(egress): cover native controller allowlist prepare and cleanup
  
  senamakel
  and
  medullabot
  committed
  5e4efd2
- test(egress): assert prepare succeeds before unwrapping
  
  senamakel
  and
  medullabot
  committed
  9a91319
- test(egress): match docker subcommands by position-independent search
  
  senamakel
  and
  medullabot
  committed
  9ec20d5
- fix(egress): route network inspect through rootful docker helper
  
  senamakel
  and
  medullabot
  committed
  1098304
- test(sandbox): cover controller host forwarding and egress rollback
  
  senamakel
  and
  medullabot
  committed
  2feec32
- test(sandbox): tidy host capability assertions and egress rollback check
  
  senamakel
  and
  medullabot
  committed
  f3025bc
- test(egress): rename docker args binding in fake host
  
  senamakel
  and
  medullabot
  committed
  bd643a4
- feat(docker): pin egress hostnames via /etc/hosts
  
  senamakel
  and
  medullabot
  committed
  9cc4e45
- feat(tinybox-docker): expose prepared egress network from sandbox
  
  senamakel
  and
  medullabot
  committed
  4097e7a
- test(egress): cover pinned host mappings and dns blocking
  
  senamakel
  and
  medullabot
  committed
  ad65298
- docs(tinybox-docker): describe egress plan as consumed by the native controller
  
  senamakel
  and
  medullabot
  committed
  83f0a58
- fix(sandbox): skip egress cleanup for non-allowlist boxes
  
  senamakel
  and
  medullabot
  committed
  a7fbda7
- test(sandbox): cover allowlist run args pinning resolved addresses
  
  senamakel
  and
  medullabot
  committed
  6b08860
- fix(egress): skip firewall cleanup when network creation fails
  
  senamakel
  and
  medullabot
  committed
  fa5d1a4
- refactor(sandbox): drop dns pinning and host mappings from docker args
  
  senamakel
  and
  medullabot
  committed
  276c2d7
- fix(sandbox): pin allowlist network dns to loopback
  
  senamakel
  and
  medullabot
  committed
  5aa6143
- docs(specs): clarify docker dns upstream rationale
  
  senamakel
  and
  medullabot
  committed
  af47a8d
- fix(egress): roll back network setup and allow IPv6 neighbour discovery
  
  senamakel
  and
  medullabot
  committed
  2e00f4a
- test(docker): assert firewall rule ordering and published-port reachability
  
  senamakel
  and
  medullabot
  committed
  cf45605
- test(docker): cover ipv6 allowlist egress in live test
  
  senamakel
  and
  medullabot
  committed
  e76e1eb
- test(docker): fix live egress allowlist probe cleanup
  
  senamakel
  and
  medullabot
  committed
  c6193aa
- docs: document allowlist bridge-to-host exceptions
  
  senamakel
  and
  medullabot
  committed
  735bcae
- refactor(tinybox-docker): extract pinned destination rules into helper
  
  senamakel
  and
  medullabot
  committed
  076be2d
- test(sandbox): assert rollback failure reports its own operation
  
  senamakel
  and
  medullabot
  committed
  c5d229b
- test(sandbox): cover failed create cleanup retaining the record
  
  senamakel
  and
  medullabot
  committed
  4f79487
- test(sandbox): update insert_new call in cleanup retry test
  
  senamakel
  and
  medullabot
  committed
  e78512e
- test(sandbox): recover poisoned lock in failed create cleanup test
  
  senamakel
  and
  medullabot
  committed
  505fdfb
- test(tinybox-docker): fix escaped quotes in live network inspect format
  
  senamakel
  and
  medullabot
  committed
  d1d3c9f
- test(tinybox-docker): extract ipv6 inspect template helper
  
  senamakel
  and
  medullabot
  committed
  e310460
- test(tinybox-docker): read a single line from the published port
  
  senamakel
  and
  medullabot
  committed
  f48aeb9
- test(tinybox-docker): drop unused mut in live docker test
  
  senamakel
  and
  medullabot
  committed
  8d39638
- test(live-docker): serve published port over http
  
  senamakel
  and
  medullabot
  committed
  9dd619d
- test(tinybox-docker): make stream binding mutable in live test
  
  senamakel
  and
  medullabot
  committed
  11a2901
- test(tinybox-docker): read published-port response incrementally
  
  senamakel
  and
  medullabot
  committed
  535cbd1
- test(tinybox-docker): tolerate read timeouts while polling published port
  
  senamakel
  and
  medullabot
  committed
  cbe0bc0
- test(tinybox-docker): collapse match arm onto one line
  
  senamakel
  and
  medullabot
  committed
  5c86897
- test(limited): cover local execution location reporting
  
  senamakel
  and
  medullabot
  committed
  27e867b
- feat(limited): report execution location for limited local host
  
  senamakel
  and
  medullabot
  committed
  f509d91
- test(egress): cover ipv4-mapped ipv6 answers
  
  senamakel
  and
  medullabot
  committed
  9d758b9
- fix(egress): normalize ipv4-mapped addresses in allowlist
  
  senamakel
  and
  medullabot
  committed
  c256479
- test(egress): cover ipv4-mapped answers in native controller
  
  senamakel
  and
  medullabot
  committed
  87e7362
- fix(egress): make ipv4 arm of normalize_ip_address exhaustive
  
  senamakel
  and
  medullabot
  committed
  b697808
- test(docker): assert established input rule precedes drop rules
  
  senamakel
  and
  medullabot
  committed
  94f4bc3
- fix(egress): allow established return traffic to the host
  
  senamakel
  and
  medullabot
  committed
  6127f90
- test(egress): extract input rule assertions into a helper
  
  senamakel
  and
  medullabot
  committed
  c54c060
- docs: clarify egress enforcement comments and contract wording
  
  senamakel
  and
  medullabot
  committed
  50d033d
- test(tinybox-docker): retry reads on connection reset in live test
  
  senamakel
  and
  medullabot
  committed
  704000d
- test(tinybox-docker): start published-port httpd detached via docker exec
  
  senamakel
  and
  medullabot
  committed
  f75425b
- test(tinybox-docker): fix stderr_lossy ownership in live test
  
  senamakel
  and
  medullabot
  committed
  0ffed93
- test(live-docker): serve published port with nc loop
  
  senamakel
  and
  medullabot
  committed
  e3c2f8c
- test(tinybox-docker): simplify published-port probe payload
  
  senamakel
  and
  medullabot
  committed
  1eedbc9
- test(tinybox-docker): cover both listener probe ports in allowlist
  
  senamakel
  and
  medullabot
  committed
  a292574
- test(tinybox-docker): cover additional allowlist probe port
  
  senamakel
  and
  medullabot
  committed
  40e98f7
- test(docker): cover cleanup refusing a foreign network owner
  
  senamakel
  and
  medullabot
  committed
  42a115b
- test(egress): cover network scope and chain owner tokens
  
  senamakel
  and
  medullabot
  committed
  8445400
- fix(egress): scope firewall chain cleanup to the owning box
  
  senamakel
  and
  medullabot
  committed
  510a171
- test(docker): track deleted iptables chains in egress test host
  
  senamakel
  and
  medullabot
  committed
  3c8a1a5
- test(egress): track created firewall chains in prepared host
  
  senamakel
  and
  medullabot
  committed
  b75f26c
- fix(tinybox-docker): scope owner tokens and tighten egress deny rules
  
  senamakel
  and
  medullabot
  committed
  d46f959
- test(tinybox-docker): track firewall chains per iptables variant
  
  senamakel
  and
  medullabot
  committed
  8ce6b3c
- test(egress): import deny_rules in enforcement tests
  
  senamakel
  and
  medullabot
  committed
  6fc2345
- test(egress): simplify destination assertions in metadata deny test
  
  senamakel
  and
  medullabot
  committed
  973d525
- test(egress): cover scope token sha256 identity
  
  senamakel
  and
  medullabot
  committed
  cd2dfd5
- style: fix indentation and import ordering
  
  senamakel
  and
  medullabot
  committed
  e3e777a
- refactor(egress): build scope tokens and fake output without intermediate allocations
  
  senamakel
  and
  medullabot
  committed
  c613673
- refactor(egress): replace fmt::Write hex formatting with direct push
  
  senamakel
  and
  medullabot
  committed
  4c0db33
- refactor(egress): hoist hex table to module scope
  
  senamakel
  and
  medullabot
  committed
  96cd674
- test(tinybox-docker): cover busybox nc ipv6 flag handling
  
  senamakel
  and
  medullabot
  committed
  8fe4d5c
- test(live-docker): drop ipv6 flag from listener probe
  
  senamakel
  and
  medullabot
  committed
  69b5a7d
- test(egress): cover chain marker install failure rollback
  
  senamakel
  and
  medullabot
  committed
  9a1af48
- test(egress): fix chain owner token comparison in native host
  
  senamakel
  and
  medullabot
  committed
  46b0dd1
- fix(egress): track chains created during a failed setup attempt
  
  senamakel
  and
  medullabot
  committed
  2f39145
- test(docker): track owner-marked chains in egress enforcement fake
  
  senamakel
  and
  medullabot
  committed
  4381551
- test(egress): clone firewall when removing chain in test host
  
  senamakel
  and
  medullabot
  committed
  14f9e9a
- fix(egress): use cleanup_native on setup failure
  
  senamakel
  and
  medullabot
  committed
  8c9ab9d
- fix(egress): clean up only chains owned by the failed attempt
  
  senamakel
  and
  medullabot
  committed
  2b5bc49
- test(egress): gate native controller tests to linux
  
  senamakel
  and
  medullabot
  committed
  11c48e2
- chore(egress): allow too_many_lines on install_family
  
  senamakel
  and
  medullabot
  committed
  c6f01d0
- test(egress): gate linux-only helpers behind cfg
  
  senamakel
  and
  medullabot
  committed
  67eb415
- fix(docker): reject IPv6 link-local egress targets and reconcile ambiguous network creates
  
  senamakel
  and
  medullabot
  committed
  51f20dc
- test(egress): cover ambiguous network create with absent or foreign network
  
  senamakel
  and
  medullabot
  committed
  bbc20ec
- test(tinybox-docker): model network create outcomes with an enum
  
  senamakel
  and
  medullabot
  committed
  95dcde9
- test(egress): reformat network create failure check
  
  senamakel
  and
  medullabot
  committed
  1e317f5
- test(egress): cover network inspect outcomes in rollback tests
  
  senamakel
  and
  medullabot
  committed
  da175d8
- fix(egress): reconcile failed docker network creation
  
  senamakel
  and
  medullabot
  committed
  0995ddc
- fix(egress): report docker stderr when network inspection fails
  
  senamakel
  and
  medullabot
  committed
  800c922
- fix(egress): require the final drop rule in each chain
  
  senamakel
  and
  medullabot
  committed
  ded8757
- test(sandbox): cover docker argv rewriting for non-idempotent controllers
  
  senamakel
  and
  medullabot
  committed
  42161c9
- refactor(sandbox): drop unused docker argv rewriting
  
  senamakel
  and
  medullabot
  committed
  eab6f87
- test(egress): cover pinned targets inside auto-selected subnets
  
  senamakel
  and
  medullabot
  committed
  5473691
- fix(egress): reject allowlist targets inside the docker network subnet
  
  senamakel
  and
  medullabot
  committed
  2407dd9
- test(egress): tighten assertion for iptables rule commands
  
  senamakel
  and
  medullabot
  committed
  4df125e
- test(tinybox-docker): silence dead code warnings on non-linux
  
  senamakel
  and
  medullabot
  committed
  281cc29
- test(sandbox): use assert_ne for docker command count
  
  senamakel
  and
  medullabot
  committed
  48382a6
- docs(egress): document ipam subnet refusal for pinned destinations
  
  senamakel
  and
  medullabot
  committed
  7706604
- test(egress): cover owner marker restore when chain delete fails
  
  senamakel
  and
  medullabot
  committed
  aa97407
- test(egress): guard fail_chain_delete_once with a mutex
  
  senamakel
  and
  medullabot
  committed
  c30bcce
- fix(egress): restore ownership marker when chain deletion fails
  
  senamakel
  and
  medullabot
  committed
  27fea97
- test(egress): fix host mutability in enforcement tests
  
  senamakel
  and
  medullabot
  committed
  877357c
- style(tinybox-docker): reformat egress enforcement code
  
  senamakel
  and
  medullabot
  committed
  3d88625
- test(egress): gate chain delete retry test to linux
  
  senamakel
  and
  medullabot
  committed
  fb45030
- chore: add rustc ice reports
  
  senamakel
  and
  medullabot
  committed
  fed0596
- chore: remove rustc ice dump files
  
  senamakel
  and
  medullabot
  committed
  7a33ef7
- chore: add rustc ice report
  
  senamakel
  and
  medullabot
  committed
  1035a75
- chore: remove stray rustc ICE dump file
  
  senamakel
  and
  medullabot
  committed
  234e47b
- test(limited): cover jailed local host execution location
  
  senamakel
  and
  medullabot
  committed
  8b01db2
- feat(host): report local execution location for jailed host
  
  senamakel
  and
  medullabot
  committed
  68ce742
- test(egress): assert same-owner network conflict is not removed
  
  senamakel
  and
  medullabot
  committed
  df370e8
- fix(egress): return original error on network create failure
  
  senamakel
  and
  medullabot
  committed
  74f7388
- test(egress): capture iptables-restore scripts in prepared host
  
  senamakel
  and
  medullabot
  committed
  302ab4a
- test(egress): cover atomic chain creation and restart-safe cleanup
  
  senamakel
  and
  medullabot
  committed
  1ec263e
- fix(egress): create firewall chains atomically with owner marker
  
  senamakel
  and
  medullabot
  committed
  8de0a4e
- fix(egress): append owner marker without flushing the chain
  
  senamakel
  and
  medullabot
  committed
  d138253
- test(egress): assert per-chain restore scripts and binaries
  
  senamakel
  and
  medullabot
  committed
  88a2343
- test(egress): reformat restore program assertion
  
  senamakel
  and
  medullabot
  committed
  dbcccc6
- test(egress): assert no inspect runs on network name conflict
  
  senamakel
  and
  medullabot
  committed
  d435d30
- test(egress): reformat inspect assertion to match rustfmt
  
  senamakel
  and
  medullabot
  committed
  a7d4238
- refactor(egress): key firewall chains by per-attempt token
  
  senamakel
  and
  medullabot
  committed
  d517027
- fix(egress): label egress networks with the attempt token
  
  senamakel
  and
  medullabot
  committed
  d9fa023
- fix(egress): include attempt label in network inspect format
  
  senamakel
  and
  medullabot
  committed
  f82ebf6
- fix(docker): verify egress network ownership before cleanup
  
  senamakel
  and
  medullabot
  committed
  c15a250
- refactor(egress): remove redundant network existence check
  
  senamakel
  and
  medullabot
  committed
  1efe331
- test(egress): split restart cleanup coverage into empty and nonempty cases
  
  senamakel
  and
  medullabot
  committed
  087c771
- fix(egress): match attempt label when reconciling ambiguous network creates
  
  senamakel
  and
  medullabot
  committed
  2df862a
- test(egress): cover ambiguous create preserving older attempt network
  
  senamakel
  and
  medullabot
  committed
  39fec21
- test(egress): inline attempt label and mark prepared hosts mutable
  
  senamakel
  and
  medullabot
  committed
  87febd7
- test(egress): fix mutability of prepared host bindings
  
  senamakel
  and
  medullabot
  committed
  68d7897
- test(egress): fix mutability of prepared host bindings in tests
  
  senamakel
  and
  medullabot
  committed
  d19c9fd
- docs(egress_enforcement): describe per-attempt chain ownership
  
  senamakel
  and
  medullabot
  committed
  484de6d
- test(docker): track chains with rules in egress enforcement fake host
  
  senamakel
  and
  medullabot
  committed
  a87f185
- test(egress): reuse resolved firewall binary in chain bookkeeping
  
  senamakel
  and
  medullabot
  committed
  813a341
- test(egress): reuse firewall value when clearing chain state
  
  senamakel
  and
  medullabot
  committed
  dc13f6a
- style(tinybox-docker): reformat egress enforcement code
  
  senamakel
  and
  medullabot
  committed
  9e089c6
- test(egress): remove duplicate firewall lookup in prepared host
  
  senamakel
  and
  medullabot
  committed
  ab87d25
- test(egress): mark chains as owned in cleanup ownership test
  
  senamakel
  and
  medullabot
  committed
  df474af
- test(egress): rename marker failure test to describe rollback
  
  senamakel
  and
  medullabot
  committed
  fd6b891
- test(egress): cover cleanup when no orphaned chains exist
  
  senamakel
  and
  medullabot
  committed
  f60d878
- test(egress): relax iptables chain count assertion
  
  senamakel
  and
  medullabot
  committed
  c51b031
- test(egress): cover rollback failure when owned network removal fails
  
  senamakel
  and
  medullabot
  committed
  e8023a0
- test(egress): inject one-shot network removal failure
  
  senamakel
  and
  medullabot
  committed
  a2566e9
- test(egress): report prepare result and commands on rollback failure
  
  senamakel
  and
  medullabot
  committed
  ff5bbd6
- test(egress): match simulated lost response in rollback assertion
  
  senamakel
  and
  medullabot
  committed
  a7daa81
- test(egress): gate network removal assertion to linux
  
  senamakel
  and
  medullabot
  committed
  aece4b6
- test(egress): fix indentation of linux cfg attribute
  
  senamakel
  and
  medullabot
  committed
  3bd7f10
- test(egress): gate no_matching_hooks field to linux
  
  senamakel
  and
  medullabot
  committed
  1923fef

Commits

Commits on Oct 23, 2026