From aff68f5492fd1e3e689ddd016444b3a2c12a96c6 Mon Sep 17 00:00:00 2001 From: claude-hdb Date: Wed, 15 Jul 2026 00:23:58 +0000 Subject: [PATCH] docs(box-design): update isolation-stack names to the 0.4.0 rename MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Snapshots, ownership-rule, and Isolation sections still named the pre-0.4.0 stack (claudenet/claude-dev/claude-isolate) while the rest of the repo — README, host/setup-host.sh, host/box-firewall.sh — uses boxnet/box-net/ box-isolate. Rename the doc references to match ground truth: claudenet→boxnet, claude-dev→box-net (profile), claude-isolate→box-isolate (ACL). Stale wording only; the mechanism described is unchanged. Co-Authored-By: Claude Opus 4.8 --- docs/box-design.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/box-design.md b/docs/box-design.md index d55e7ca..834165a 100644 --- a/docs/box-design.md +++ b/docs/box-design.md @@ -38,7 +38,7 @@ snapshots, not a secrets store: - `box snapshot [label]` — checkpoint after login + clone. - `box new --name --from [/]` — clone an existing box or snapshot (authed state and all). Isolation is preserved: the clone keeps - the `claude-dev` profile + `claudenet` + ACL. + the `box-net` profile + `boxnet` + ACL. - `box restore ` — roll a box back to a checkpoint. Log in once → snapshot → spin up authed boxes from it. @@ -65,7 +65,7 @@ forever — and wrapping them one at a time grows a worse `incus`. The rule: > **box owns a command when it must enforce an invariant Incus cannot see:** > the `user.box=1` boundary (never touch an instance we didn't mint), the -> isolation stack (`claude-dev` profile + `claudenet` + ACL), or the creds-free +> isolation stack (`box-net` profile + `boxnet` + ACL), or the creds-free > snapshot→clone workflow. Everything else is Incus's job. The rule cuts both ways, and that's the point: @@ -95,7 +95,7 @@ warns and proceeds — from there the trust boundary is yours to keep. ## Isolation -Dedicated NAT bridge `claudenet` + Incus `claude-isolate` ACL dropping all +Dedicated NAT bridge `boxnet` + Incus `box-isolate` ACL dropping all RFC1918/CGNAT/link-local egress, plus host-firewall rules blocking instance → host. Entry is `incus exec` over the local socket — no inbound path. The VM is the trust boundary. @@ -104,12 +104,12 @@ the trust boundary. That last clause is the one that was assumed and turned out to be false, so it is spelled out here with the mechanism, and `drill/` tests it on every run. -- **Box → host, LAN, RFC1918, CGNAT, link-local:** the `claude-isolate` ACL. +- **Box → host, LAN, RFC1918, CGNAT, link-local:** the `box-isolate` ACL. - **Box → box: an nftables *bridge-family* rule** (`host/box-firewall.sh`). It cannot be an ACL rule. Two boxes on one bridge share an L2 segment, so their frames are *switched* between bridge ports and never traverse the netfilter path an L3 ACL lives on — the ACL looked airtight (it drops - `10.0.0.0/8`, which contains `claudenet`) while box→box was in fact wide open. + `10.0.0.0/8`, which contains `boxnet`) while box→box was in fact wide open. A live probe found box A's SYN arriving at box B. The bridge family's forward hook fires exactly on port-to-port frames, which on this bridge means box→box and nothing else: gateway traffic and routed egress are delivered locally, not