feat(sandbox): add Platform network mode for restricted K8s platforms#12
Closed
Ladas wants to merge 6 commits into
Closed
feat(sandbox): add Platform network mode for restricted K8s platforms#12Ladas wants to merge 6 commits into
Ladas wants to merge 6 commits into
Conversation
Add NetworkMode::Platform variant and NetworkEnforcementMode proto enum. In Platform mode, the supervisor skips network namespace creation and binds the CONNECT proxy to loopback. No elevated capabilities required, compatible with restricted-v2 SCC and restricted Pod Security Standard. Default (zero value = NAMESPACE) preserves current behavior. Ref: NVIDIA#899
Platform mode needs sockets to reach the loopback CONNECT proxy. Ref: NVIDIA#899
In Platform mode: - Network namespace creation is skipped (no CAP_SYS_ADMIN/NET_ADMIN) - Bypass monitor is skipped (gated on netns.is_some()) - CONNECT proxy binds to 127.0.0.1:3128 instead of veth host IP - TLS state and OPA engine still initialized for L7 inspection - Baseline path enrichment includes proxy paths Ref: NVIDIA#899
HTTP_PROXY and HTTPS_PROXY set to 127.0.0.1:3128 in Platform mode so cooperative processes route through the OPA-enforced CONNECT proxy. Ref: NVIDIA#899
… mode Platform mode sandbox pods: - Zero capabilities, drop ALL (restricted-v2 compatible) - No runAsUser: 0 (image default non-root user preserved) - Supervisor still sideloaded via emptyDir + init container Namespace mode preserves current behavior (SYS_ADMIN, NET_ADMIN, SYS_PTRACE, SYSLOG, runAsUser: 0). Ref: NVIDIA#899
- Proto conversion: NetworkEnforcementMode::Platform -> NetworkMode::Platform - Default: zero proto value -> NetworkMode::Proxy (backward compatible) - Platform mode preserves proxy config for loopback CONNECT proxy - Policy round-trip: serialize/deserialize preserves network_enforcement - Policy validation: Platform mode passes restrictive validation Ref: NVIDIA#899
This was referenced Jun 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add
NetworkMode::Platformthat enables the OpenShell supervisor to runwithout any elevated capabilities on Kubernetes platforms enforcing the
restricted Pod Security Standard (including OpenShift's
restricted-v2SCC).Platform Mode keeps Landlock filesystem isolation, seccomp syscall filtering,
OPA policy evaluation, credential injection, and L7 inspection via a loopback
CONNECT proxy. It replaces the network namespace (which requires
CAP_SYS_ADMINCAP_NET_ADMIN) with Kubernetes NetworkPolicy for L3/L4 egress control.What changes
Platformvariant toNetworkModeenumNetworkEnforcementModeproto enum toSandboxPolicy(field 6, backward-compatible)127.0.0.1:3128) instead of veth host IPdrop: ["ALL"]) in Platform moderunAsUser: 0in Platform mode (image default non-root)Capabilities eliminated
CAP_SYS_ADMINunshare(CLONE_NEWNET), nosetns()CAP_NET_ADMINCAP_SYS_PTRACE/proc/<pid>/exeCAP_SYSLOGrunAsUser: 0best_effortWhat still works
restrict_self()viano_new_privs)Security trade-off
Processes ignoring
HTTP_PROXYcan attempt direct connections. NetworkPolicyat the CNI level is the only enforcement for non-cooperative traffic (L3/L4).
Follow-up PRs will add Landlock TCP port restriction (ABI v4) to make the
proxy mandatory at the kernel level.
Related
docs/research/openshell-platform-mode-spec.mddocs/research/openshell-network-enforcement-analysis.mdAssisted-By: Claude Code