2.9 KiB
Network preservation during guarded runtime migration
The version-4 endpoint policy supports existing authenticated app gates, IPv4/IPv6 publications, DNS-SD, FIPS transport and website listeners, and retained containers whose payload runs outside their keeper's service cgroup. It is installed only with independently reviewed namespace and endpoint appointments. Shipping these modules does not itself activate isolation.
Authority and lifetime
- App gates remain managed authentication endpoints. The network owner supplies bounded PROXY-v2 peer metadata; ordinary application headers are not authority for the original caller address. A missing gate never becomes raw runtime access.
- Runtime publications require an exact approved projection and a listening
socket pinned with
pidfd_getfd. PID, start time, cgroup, namespace, descriptor and socket identity are checked before admission and during use. - A retained-container producer additionally binds its full container ID, image ID, complete configuration digest, stable keeper unit/invocation, actual payload scope and principal. Node labels are bounded data, not a built-in deployment inventory. Neither container names nor image names alone establish ownership.
- Runtime discovery re-registers qualified producers against the previous generation. It does not start containers, change stop/uninstall decisions, or replace an old producer with an arbitrary new process.
- Listener leases use bounded, ordered descriptor chunks so a complete admitted listener set can exceed one SCM_RIGHTS message without silently dropping ports.
Sandbox view
The network owner and registration service use ProtectHome=tmpfs, with the
explicit read-only /run/user/1000 bind required to authenticate the runtime
user manager. Operator home directories and other users' runtime directories
remain hidden. ProtectHome=yes made the required private bus unreachable in
the composed service context; removing home protection is not the remedy.
Qualification boundary
The disposable PID1 composition exercised 28 routes and 285 listener sockets, real authenticated HTTP/TLS over IPv4/IPv6, DNS-SD, a real relay, opaque FIPS transport forwarding, recreated-container re-registration, and retained-container restart without changing its ID. It also checked actual service mount views: the appointed user-manager socket was visible while operator-home and other-user canaries remained hidden and intact outside those views.
The fixture uses a private runtime UID mapping to avoid consuming the live developer user's inotify quota. Host limits and account/subuid configuration are unchanged. Its WAN, backend image, certificates and native test entry points are synthetic. These results do not establish production time/history admission, same-artifact node migration, physical networking, or signed release acceptance. Those remain separate steps in the guarded delivery workflow.