9
2
Fork
You've already forked platform
2

WIP feat/egress-opt-in #286

Closed
vkobel wants to merge 2 commits from vkobel/caution-platform:feat/egress-opt-in into main
pull from: vkobel/caution-platform:feat/egress-opt-in
merge into: caution:main
caution:main
caution:feat/webauthn-discoverable-login
caution:feat/paddle-byoc-subscriptions
caution:anton/feat/multi-user
caution:feat/issue-377-minimal-sentry
caution:fix/issue-191-attestation-endpoint-copy
caution:feat/legal-publish-doc
caution:fix/issue-119-logout-confirmation
caution:fix/paddle-customdata-credit-mint
caution:fix/issue-116-duplicate-ssh-key
caution:fix/issue-265-http-port-private
caution:fix/issue-330-remove-build-binary
caution:fix/issue-307-remove-apps
caution:feat/issue-164-account-id
caution:feat/add-tofu-lockfile-cache
caution:docs/issue-339-install-instructions
caution:fix/issue-336-split-qr-login-tokens
caution:fix/verify-app-source-preflight
caution:fix/many-git-push-deploy
caution:fix/issue-334-email-verification-throttle
caution:fix/issue-273-billing-url
caution:fix/issue-333-final-usage-collection
caution:fix/issue-270-low-credit-email
caution:fix/issue-301-remove-auto-topup
caution:fix/issue-320-byoc-auth-first
caution:fix/issue-348-git-progress-checklist
caution:fix/issue-321-byoc-caution-hcl
caution:fix/issue-332-resource-id-suspension
caution:fix/eif-app-mode-normalization
caution:feat/cli-stagex-container
caution:fix/eif-s3-layer-cache
caution:fix/authz-role-checks
caution:fix/cli-hangs-unsupported-ssh-url
caution:feat/print-platform-commit-dashboard
caution:fix/config-domain-validation
caution:anton/support-ssh-destroy-get
caution:fix/cli-config-dir
caution:feat/publish-build-inputs
caution:feat/locksmith-polishing
caution:fix/procfile-run-command-no-split
caution:anton/byoc-require-login
caution:fix/hcl-init-template
caution:feat/egress-default-deny
caution:ryansquared/hcl
caution:quotas
caution:anton/feat/region-routing-resource-unavailable-alert
caution:fix/attestation-502-dashboard
caution:ryansquared/systemdize
caution:fix/verify-git-credential-hang
caution:anton/fix-low-credits-alert
caution:xenushka/rename-byoc
caution:ryansquared/add-download-eif
caution:add-debug-flag
caution:test/pr1-integration-harness
caution:anton/fix/only-pass-required-env-vars
caution:ryansquared/add-database-bucket

Why

Enclaves currently get unconditional outbound internet. For a confidential-compute platform that's the wrong default — egress should be an explicit, attested choice (it changes the PCR).

What

New egress Procfile field gates the outbound vsock tunnel:

run: /app/server
egress: true # opt in to outbound internet
  • egress: false — no outbound tunnel; inbound ports still reach the app via Caddy.
  • egress: true — restores tunnel + DHCP + DNS (today's behavior).

Plumbed end-to-end: Procfile → manifest → build → run.sh/Terraform → runtime.

rollout (staged, no breakage)

Behind a single DEFAULT_EGRESS const:

  • Phase 1 (this PR): default true (opt-out) + a deprecation warning when unset. Nothing breaks.
  • Phase 2 (later): flip the const to false (opt-in). One-line change.

stuff to note

  • DNS write now gated on udhcpc exit code — no more nameserver 10.0.100.1 after a silent DHCP failure.
  • nitro-enclave.service gets After=/Wants=vsock-network.service so a restart can't race the host proxy.
  • CAUTION_EGRESS is authoritative over the manifest (consistent with e2e/locksmith).

Testing

Unit tests for Procfile parsing, manifest round-trip, cache key, run.sh rendering (DHCP-gated), and Terraform service ordering.

### Why Enclaves currently get **unconditional** outbound internet. For a confidential-compute platform that's the wrong default — egress should be an explicit, attested choice (it changes the PCR). ### What New `egress` Procfile field gates the outbound vsock tunnel: ``` run: /app/server egress: true # opt in to outbound internet ``` - `egress: false` — no outbound tunnel; inbound `ports` still reach the app via Caddy. - `egress: true` — restores tunnel + DHCP + DNS (today's behavior). Plumbed end-to-end: Procfile → manifest → build → `run.sh`/Terraform → runtime. ### rollout (staged, no breakage) Behind a single `DEFAULT_EGRESS` const: - **Phase 1 (this PR):** default `true` (opt-out) + a deprecation warning when unset. Nothing breaks. - **Phase 2 (later):** flip the const to `false` (opt-in). One-line change. ### stuff to note - DNS write now gated on `udhcpc` exit code — no more `nameserver 10.0.100.1` after a silent DHCP failure. - `nitro-enclave.service` gets `After=`/`Wants=vsock-network.service` so a restart can't race the host proxy. - `CAUTION_EGRESS` is authoritative over the manifest (consistent with `e2e`/`locksmith`). ### Testing Unit tests for Procfile parsing, manifest round-trip, cache key, `run.sh` rendering (DHCP-gated), and Terraform service ordering.
Phase 1 keeps egress opt-out via DEFAULT_EGRESS const (flip to false later),
with a deprecation warning when the Procfile omits the field. Gate the enclave
DNS write on udhcpc success, order nitro-enclave.service after the host vsock
proxy, and make CAUTION_EGRESS authoritative over the manifest.
vkobel changed title from (削除) feat/egress-opt-in (削除ここまで) to WIP feat/egress-opt-in 2026年06月12日 17:31:20 +02:00

Going to keep this open for a bit as this week I plan to move towards a new caution.hcl Procfile format and I'd like to set up ingress {} and egress {} blocks similar to the tofu conf

Going to keep this open for a bit as this week I plan to move towards a new `caution.hcl` Procfile format and I'd like to set up `ingress {}` and `egress {}` blocks similar to the tofu conf
vkobel closed this pull request 2026年06月22日 21:56:04 +02:00
Author
Owner
Copy link

Replaced by #316

Replaced by https://codeberg.org/caution/platform/pulls/316

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
No reviewers
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
Component/Enclave-Builder
This issue affects Enclave Builder (git-push and CLI)
Component/Infrastructure
This issue affects generic Caution hosted infra components
Deploy/BYOC
Relates to Caution Bring-your-own-compute
Deploy/Full-managed
Relates to Caution fully managed cloud
Deploy/Self-hosted
Relates to Caution deployed on self-hosted infra
Interface/API
This issue affects the API
Interface/CLI
This issue affects the command line interface
Interface/Git
This issue affects the Git `push` interface
Interface/Web
This issue affects the web dashboard
Kind/Bug
Something is not working
Kind/Documentation
Documentation changes
Kind/Enhancement
Improve existing functionality
Kind/Feature
New functionality
Kind/Security
This is security issue
Kind/Testing
Issue or pull request related to testing
Priority
Critical
 The priority is critical
Priority
High
 The priority is high
Priority
Low
 The priority is low
Priority
Medium
 The priority is medium
Reviewed
Confirmed
 Issue has been confirmed
Reviewed
Duplicate
 This issue or pull request already exists
Reviewed
Invalid
 Invalid issue
Reviewed
Won't Fix
 This issue won't be fixed
Status
Abandoned
 Somebody has started to work on this but abandoned work
Status
Blocked
 Something is blocking this issue or pull request
Status
Need More Info
 Feedback is required to reproduce issue or to continue work
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
caution/platform!286
Reference in a new issue
caution/platform
No description provided.
Delete branch "vkobel/caution-platform:feat/egress-opt-in"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?