Documentation
¶
Overview ¶
Package guest holds the files and helpers that run inside the managed VM: the egress firewall baseline, the isolation self-check and the provisioning script.
Index ¶
Constants ¶
const ( StatusPath = "/var/lib/levelrail/isolation-status.json" EgressRulesPath = "/etc/levelrail/lr-egress.nft" CheckScriptPath = "/usr/local/sbin/lr-isolation-check" IsolationUnit = "lr-isolation.service" CheckUnit = "lr-isolation-check.service" )
Guest paths the host side (status reads, S2 and S4) relies on.
const ( // One constant for the firewall and the control plane unit so they cannot drift: // a /15 beside the bridge and the daemon pool, about 500 app networks. DefaultAppNetworkPool = "172.30.0.0/15" )
Defaults block: the only place guest network numbers live.
Variables ¶
This section is empty.
Functions ¶
func EgressRules ¶
EgressRules renders the nftables baseline.
func ProvisionScript ¶
ProvisionScript returns one root shell script: files first, then the firewall, then Docker (so Docker can only start behind the baseline), then the sidecar.
Types ¶
type Check ¶
type Check struct {
Name string `json:"name"`
Result string `json:"result"`
Detail string `json:"detail"`
}
Check is one line of the guest self-check result.
type Options ¶
type Options struct {
HostGateway string // Lima host address as seen from the guest, always dropped.
DNSServers []string // Resolvers that may be reached on port 53 despite the drops.
DockerPool string // The only 172.16/12 slice containers may talk to.
DockerBridge string // docker0 address, inside DockerPool.
DockerPoolBase string // User network pool, inside DockerPool.
AppNetworkPool string // Control plane per-app network block, inside DockerPool and clear of the bridge and pool base.
PublishIP string // Default bind address for published ports.
LANProbe string // Address the self-check expects to be unreachable.
ProbeTimeoutSec int
}
Options tunes the guest baseline. Zero value is invalid, use DefaultOptions.
type Sidecar ¶
type Sidecar struct {
BinaryPath string // Absolute guest path the unit's ExecStart uses.
UnitName string // File name under /etc/systemd/system, ends in .service.
UnitContent string
}
Sidecar is the control plane slot. S2 and S4 supply the binary and unit; when UnitContent is empty the step is skipped.
type Status ¶
type Status struct {
Result string `json:"result"`
BootID string `json:"boot_id"`
CheckedAt string `json:"checked_at"`
Checks []Check `json:"checks"`
}
Status is the parsed self-check file.
func ParseStatus ¶
ParseStatus parses the file read from StatusPath and requires it to belong to the current boot (bootID is /proc/sys/kernel/random/boot_id read over limactl). It only catches stale files: root inside the guest can write any status.
Source Files