vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

docs(#14): update network isolation docs - remove stale manager special-case claim

Browse source
This commit is contained in:
damocles 2026-06-03 01:19:55 +02:00 • committed by mara
commit 0ac6028844
1 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/network.md
View file

@ -122,6 +122,21 @@ address arithmetic.
`HOST_BRIDGE=<bridgeName>` via `lifecycle::set_nspawn_flags` when `HOST_BRIDGE=<bridgeName>` via `lifecycle::set_nspawn_flags` when
creating or updating containers. Each agent gets a deterministic IP creating or updating containers. Each agent gets a deterministic IP
derived from its name so the address is reproducible across destroy/recreate. derived from its name so the address is reproducible across destroy/recreate.
This applies uniformly to all containers including the manager — no special
case.
**Why isolation is safe for the manager**: all hive-c0re communication goes
through unix domain sockets (`/run/hive/mcp.sock` for agent requests,
`/run/hive/priv.sock` for privileged ops, per-agent manager sockets).
These are bind-mounted into containers via the nspawn conf. UDS paths
traverse the VFS, not the network stack, so `PRIVATE_NETWORK=1` does not
affect them.
The nix side also enables IP forwarding + NAT (agents reach the internet
through the host) and drops bridge-subnet → loopback traffic (defence-in-depth
against a compromised agent reaching the c0re dashboard HTTP at
`127.0.0.1`). Agents have no legitimate reason to reach the dashboard over
loopback — the hive-c0re admin socket is a UDS, not TCP.
### Prerequisites before flipping on ### Prerequisites before flipping on