Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

feat(supervisor): netlink/syscall network setup so the privileged supervisor needs no workload-image tools

Aberta
  • Algo errado?
#3,280 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
5/5
Tempo estimado
Mais de uma semana
Facilidade para iniciantes
38/100
Tipo de issue
Funcionalidade
Clareza
Razoavelmente clara
Status de atividade
Ativa
Stack de tecnologia
linux, rust
Domínio
networking, security

Direção de pesquisa

Comece lendo crates/openshell-supervisor-process/src/netns/mod.rs, especialmente os pontos de chamada de external ip, nsenter, nft e dmesg, e revise as issues relacionadas #2750, #2382 e #1335. Analise a abordagem proposta com rtnetlink, setns/unshare, nf_tables e NFLOG e, em seguida, verifique os critérios de aceitação no Docker, rootless Podman e Kubernetes. Considera-se concluído quando o modo proxy iniciar em uma imagem Alpine não modificada, sem ferramentas de rede na workload-image, enquanto as imagens que já possuem essas ferramentas mantêm seu comportamento.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

state:triage-needed

User Story

As an OpenShell operator, I want a sandbox to start with the default generic Alpine image in proxy mode without the sandbox image having to ship iproute2/nftables, so that the #3116 Alpine default works on unmodified base images.

Problem Statement

In proxy mode the privileged supervisor sets up the sandbox network namespace by shelling out to tools resolved from the workload image: ip (netns/veth/addr/route — 32 call sites in crates/openshell-supervisor-process/src/netns/mod.rs), nsenter (9), nft (6), and dmesg (bypass monitoring). A bare Alpine image only ships busybox ip (no netns subcommand) and no nftables/iptables, so the supervisor fails at startup with Network namespace creation failed ... iproute2 is installed and the sandbox container exits.

The community base image previously provided these tools; #3116 removes that dependency by defaulting to bare Alpine, which surfaces the gap. Only setns (8 call sites) is already a direct syscall today — namespace/veth/route creation and firewall rules still spawn external binaries.

This is the networking subset of #2750 (make the privileged supervisor independent of workload-image code), scoped down so it can land as a focused change that unblocks #3116.

Impact / Why This Matters

Without this, the #3116 default (bare Alpine) cannot run in proxy mode — the enforced-egress path that Secure Agent Workspace and any default-deny deployment rely on. The current workarounds are to keep shipping iproute2/nftables inside every sandbox image (re-introducing the exact image dependency #3116 removes) or to disable proxy mode (losing egress isolation). Neither is acceptable for a generic default.

Proposed Design

Replace the privileged network setup's external-helper calls with in-process kernel interfaces, so the supervisor is self-contained:

  • Namespace + veth + addresses + routes: route netlink (rtnetlink) plus setns/unshare with FD-owned namespaces (removes the /run/netns requirement).
  • Enter namespaces: setns directly (already used for the enter path).
  • Firewall / bypass rules: nf_tables netlink instead of the nft binary.
  • Bypass monitoring: NFLOG instead of dmesg (also drops the CAP_SYSLOG requirement; see #2382).

The supervisor binary stays musl-static so it carries no dynamic loader or NSS dependency on the workload image. Behavior on base images that already ship iproute2/nftables must be unchanged.

Acceptance Criteria

  • A sandbox created from an unmodified docker.io/library/alpine:* image starts in proxy mode with no ip/nsenter/nft/dmesg executed from the workload image.
  • Network namespace, veth, addressing, and routing are created without spawning ip/nsenter.
  • Bypass-detection firewall rules are programmed without the nft binary.
  • Bypass monitoring works without dmesg / CAP_SYSLOG.
  • Verified on the Docker, rootless Podman, and Kubernetes runtimes.
  • No behavior change for base images that already ship the tools.

Alternatives Considered

  • Mount the tools from a trusted OpenShell image into the sandbox (Phase 1 of #2750): works, but drags dynamic libraries across libc boundaries (glibc tools on musl Alpine) and remains a mount/compatibility burden; the netlink approach removes the dependency entirely.
  • Require the default image to bundle iproute2/nftables: re-introduces the image dependency #3116 removes and bloats the generic default.

Scope

In: the networking subset above.

Out (remains in #2750): the Phase 3 execution boundary (deny execve after startup, unprivileged workload/SSH execution), the Podman health-check and Kubernetes PVC-seeding shells, the hostile-image test suite, and the VM guest path.

Related

  • Sub-task of #2750
  • Unblocks #3116 (proxy-mode networking on a bare Alpine default)
  • Related: #2382 (NFLOG bypass detection), #1335 (nftables migration)
Linguagem predominante
Rust
Estrelas
15.4k
Forks
1.7k
Merge médio
2d 22min
PRs com merge (30d)
352

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de NVIDIA/OpenShell

Todas as issues de NVIDIA/OpenShell

Issues semelhantes

Mais issues de Rust

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.