From b15e0e973cce9014cf5353de068ae6c835cd479d Mon Sep 17 00:00:00 2001 From: iris Date: Sat, 15 Aug 2026 11:46:26 +0200 Subject: [PATCH] docs(network): dedupe UDS control-plane explanation --- docs/network.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/docs/network.md b/docs/network.md index f538bf95..39f24c1e 100644 --- a/docs/network.md +++ b/docs/network.md @@ -245,12 +245,11 @@ wiring is runtime: It is ordered `before` the harness (`hive-ag3nt`), the matrix daemon, and `tea-login` so the resolver is correct before the first DNS lookup. -**Why isolation is safe**: all hive-c0re communication goes -through unix domain sockets (`/run/hive/mcp.sock` for agent requests, -`/run/hive/priv.sock` for privileged ops). -These are bind-mounted into containers via the nspawn conf. UDS paths -traverse the VFS, not the network stack, so `PRIVATE_NETWORK=1` does not -affect them. +**Why isolation is safe**: hive-c0re's control-plane sockets are unix +domain sockets bind-mounted into containers, not network listeners — see +the *Control plane (no network)* bullet under [Network +map](#network-map) above. `PRIVATE_NETWORK=1` has no effect on a path +that never touches the network stack. The nix side also enables IP forwarding + NAT (agents reach the internet through the host) and drops bridge-subnet → loopback traffic (defence-in-depth