From 0ac602884419d4d278488c03b57e41e402fc6105 Mon Sep 17 00:00:00 2001 From: damocles Date: Wed, 3 Jun 2026 01:19:55 +0200 Subject: [PATCH] docs(#14): update network isolation docs - remove stale manager special-case claim --- docs/network.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/docs/network.md b/docs/network.md index e7bb1f87..1b74a7e3 100644 --- a/docs/network.md +++ b/docs/network.md @@ -122,6 +122,21 @@ address arithmetic. `HOST_BRIDGE=` via `lifecycle::set_nspawn_flags` when creating or updating containers. Each agent gets a deterministic IP derived from its name so the address is reproducible across destroy/recreate. +This applies uniformly to all containers including the manager — no special +case. + +**Why isolation is safe for the manager**: all hive-c0re communication goes +through unix domain sockets (`/run/hive/mcp.sock` for agent requests, +`/run/hive/priv.sock` for privileged ops, per-agent manager sockets). +These are bind-mounted into containers via the nspawn conf. UDS paths +traverse the VFS, not the network stack, so `PRIVATE_NETWORK=1` does not +affect them. + +The nix side also enables IP forwarding + NAT (agents reach the internet +through the host) and drops bridge-subnet → loopback traffic (defence-in-depth +against a compromised agent reaching the c0re dashboard HTTP at +`127.0.0.1`). Agents have no legitimate reason to reach the dashboard over +loopback — the hive-c0re admin socket is a UDS, not TCP. ### Prerequisites before flipping on