Allow-listed egress for jobs (network "egress") issue #55 open andymccall opened this · 2 comments
Decided (Andy, 2026-10-15): the path is vsock, no host network. The VM keeps no network card; flow-init offers a proxy on 127.0.0.1 that relays over Firecracker's vsock to the runner, which checks the CONNECT host against the pipeline's allow-list, logs it and connects out. No root, no taps, no host setup on Earth or plex. Tools use HTTPS_PROXY. Scheduled after issue #56.
andymccall referenced by change ea81796bb757 on main ·
Done and proved live (2026-10-16 ~04:15). Code: 6acaa634 (flow-core parsing and hashing, the runner proxy, flow-init vsock relay, egress = true under [runner], the egress label; spec 4.3.1); hub pinned at f9ee5850. Earth runner redeployed with egress = true; plex-1 redeployed with the same flow and flow-init (egress off there). Proof: andymccall/egress-proof run issue #4 on earth-1, all green: allowed (CONNECT index.crates.io:443 -> 200, logged "egress: allowed index.crates.io:443"), tls (a TLS handshake with index.crates.io through the tunnel, certificate verified, GET /config.json -> HTTP 200 with the JSON), refused (CONNECT example.com:443 -> 403, logged "egress: refused example.com:443: not in the sandbox’s egress allow-list"). Not in this change: the hub showing a run’s allowed hosts, and egress for the syscall runtime.
Jobs have no network device today (pipeline.rs refuses "egress"; m0.md: Firecracker boots with no NIC), so a job cannot reach a cloud API: needed by andymccall/oxygenhub-gcp to deploy with OpenTofu. Andy chose allow-listed egress (2026-10-15): the micro-VM gets a network device that reaches only an egress proxy on the runner host (CONNECT for TLS by SNI/host, no MITM), which lets through the hosts the job names and logs every connection to the job log. The pipeline names hosts: network "egress" { allow "*.googleapis.com" "registry.opentofu.org" }. Off unless the site allows it (hub setting, per repository or organisation); the hub shows a run's allowed hosts. DNS resolved by the proxy, not the guest. Syscall runtime: same proxy via a network namespace. Tests: an allowed host is reached, any other is refused and logged.