Repository navigation
feat(docker): plan pinned egress allowlists - #47
Merged
Merged
Conversation
Wire up a new egress test module behind cfg(test) so the egress behaviour can be covered by unit tests. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The egress module is now compiled unconditionally and re-exports its resolver and pinned plan types so callers outside the crate can plan allowlists. The sandbox test for unenforceable allowlists now also asserts that Docker is never invoked, confirming the refusal happens up front. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Add an `# Errors` section to the `EgressResolver::resolve` doc comment noting that it returns an error when the hostname cannot be resolved. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Add tests asserting that public IPv6 resolver answers are accepted into the egress plan and that a resolver error surfaces as a backend failure naming the offending host. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs tinyhumansai#27
Part of tinyhumansai/openhuman#7328
Scope
Adds a public, deterministic planning API that resolves each distinct allowlisted hostname once and retains the resulting host, IP, and TCP port combinations. It rejects empty DNS answers, loopback and metadata answers, and IPv6 link-local addresses that cannot be pinned without an interface scope. The planner is isolated from DNS and covered with fixed resolver fixtures.
Docker creation continues to refuse
NetworkPolicy::Allowlistbefore invoking Docker. This is partial planning and refusal groundwork; resolver-pinned firewall enforcement and a live allow/deny proof remain open. No firewall-mutating test was run on the shared host.Validation
cargo fmt --all -- --checkcargo test -p tinybox-docker egresscargo test -p tinybox-docker allowlistcargo check -p tinybox-dockercargo clippy -p tinybox-docker --all-targets --all-features -- -D warningscargo llvm-cov -p tinybox-docker --lib --summary-only(egress.rs line coverage: 94.74%)