innerwall-agent

Overview ¶

Command innerwall-agent runs on each workload. It observes flows and programs the host's native firewall from desired state pushed by the control plane. It dials out only, never listens, never self-updates, and fails static: losing the control plane changes nothing on the host (ADR-0011).

Subcommands:

enroll   exchange a provisioning token for a workload credential
renew    rotate the workload credential over mutual TLS
daemon   hold the sync stream, apply policy to the owned nftables table,
         collect and report flows, report inventory, renew
down     the local kill switch: delete the owned nftables table

The daemon re-applies its last acknowledged policy from disk before it dials anything, and leaves the kernel rules in place when it exits; only `down` removes them (ADR-0011).