heavy-duty/box
7
0
Fork 1
Code Issues 9 Pull requests Projects Releases 4 Packages Wiki Activity Actions

Restricted incus tier: per-user projects converged onto hardened boxnet (#74) #75

Merged
dan-claude-bot merged 10 commits from feat/restricted-tier into main 2026-07-18 13:21:16 +00:00
Conversation 5 Commits 10 Files changed 14 +27
1 changed files with 27 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit f7b93a91cd - Show all commits

27
docs/plans/2026-07-18-restricted-tier.md Normal file
View file

@ -0,0 +1,27 @@
# Restricted incus tier — implementation plan (issue #74)
claude-bot-andresmgsl commented 2026-07-18 01:29:43 +00:00 (Migrated from github.com)
Review
Copy link

On a shared boxnet this contract is now doing tenant isolation, not just defense-in-depth. Note that of these four, only security.port_isolation (L2) and the nft bridge drop actually stop box→box — the ACL is L3/L4 and, per profiles/box-net.yaml's own comment, was silently bypassed at L2. So the multi-tenant boundary rests on those two mechanisms. Worth stating that explicitly here.

On a shared `boxnet` this contract is now doing *tenant* isolation, not just defense-in-depth. Note that of these four, only `security.port_isolation` (L2) and the nft bridge drop actually stop box→box — the ACL is L3/L4 and, per `profiles/box-net.yaml`'s own comment, was silently bypassed at L2. So the multi-tenant boundary rests on those two mechanisms. Worth stating that explicitly here.
claude-bot-andresmgsl commented 2026-07-18 01:29:43 +00:00 (Migrated from github.com)
Review
Copy link

This widens access to include boxnet but (per #74) incusbr-<uid> stays in the access list too. Does the convergence also remove/repoint the auto default profile so a restricted user can't incus launch onto their unhardened incusbr-<uid>, skipping the box-net contract entirely? If not, the isolation stack is opt-in for anyone with raw incus in their project. Please spell out how the per-user bridge is neutralized — and whether the widened restricted.networks.access survives an incus-user re-sync.

This widens access to include `boxnet` but (per #74) `incusbr-<uid>` stays in the access list too. Does the convergence also remove/repoint the auto default profile so a restricted user can't `incus launch` onto their unhardened `incusbr-<uid>`, skipping the box-net contract entirely? If not, the isolation stack is opt-in for anyone with raw `incus` in their project. Please spell out how the per-user bridge is neutralized — and whether the widened `restricted.networks.access` survives an incus-user re-sync.
claude-bot-andresmgsl commented 2026-07-18 01:29:43 +00:00 (Migrated from github.com)
Review
Copy link

For criteria (a)–(f), please include an active cross-user probe, not just "user A can't see user B's instances": from restricted user A's box, ARP/SYN/broadcast at user B's box on the same boxnet subnet, and assert silence. The single-owner drill already trusts port_isolation; multi-tenant is exactly where an L2 gap would bite, and #74's own reachability claim is the thing under test.

For criteria (a)–(f), please include an *active cross-user* probe, not just "user A can't see user B's instances": from restricted user A's box, ARP/SYN/broadcast at user B's box on the same `boxnet` subnet, and assert silence. The single-owner drill already trusts `port_isolation`; multi-tenant is exactly where an L2 gap would bite, and #74's own reachability claim is the thing under test.
claude-bot-andresmgsl commented 2026-07-18 01:29:43 +00:00 (Migrated from github.com)
Review
Copy link

CI (.github/workflows/ci.yml) explicitly does not run the drill or the multiuser rehearsal — ubuntu-latest can't reliably nest Incus + /dev/kvm. So "Test suite expansion + CI wiring" needs a concrete story: a self-hosted runner, or gated/manual drill jobs with shellcheck-only on GH-hosted. Otherwise "wired into CI" overstates what actually gates a merge.

CI (`.github/workflows/ci.yml`) explicitly does *not* run the drill or the multiuser rehearsal — `ubuntu-latest` can't reliably nest Incus + `/dev/kvm`. So "Test suite expansion + CI wiring" needs a concrete story: a self-hosted runner, or gated/manual drill jobs with shellcheck-only on GH-hosted. Otherwise "wired into CI" overstates what actually gates a merge.
> **Status: placeholder.** This PR is a work in progress; the design below is being
> validated by a live multi-user rehearsal before the implementation lands. Do not
> review yet — the PR stays in draft until the rehearsal passes.
## Scope
Deliver the restricted (`incus`-group) tier described in #74:
- A restricted user can `box new/list/shell/snapshot/rm` **their own** boxes.
- Their boxes ride a network carrying box's full isolation contract
(ACL, `dns.mode=none`, resolver pin, `security.port_isolation`, nft box↔box drop).
- No cross-user visibility. Admin tier unchanged.
- The admin-side convergence is a documented, idempotent command — not manual
per-user `incus project set`.
## Planned shape (subject to rehearsal)
- `box grant <user>` / `box revoke <user>` — admin convergence hook per #74
option 1: widen `restricted.networks.access` to include `boxnet` and install
the `box-net` profile into the user's `user-<uid>` project.
- CLI awareness of running inside a restricted project.
- `drill/multiuser.sh` rehearsal criteria (a)–(f) green on a real multi-user host.
- Test suite expansion + CI wiring.
Tracking issue: heavy-duty/box#74.