Enclaves are now hermetic by default — outbound access only when the HCL config declares network.egress rules. Empty/absent ⇒ no internet, but still reachable on ingress ports.
A single flag (network.egress_enabled()) gates two points:
- Enclave run.sh (attestable): the outbound tunnel block is compiled into the EIF only when egress is enabled; otherwise a hermetic resolver remains. Affects PCRs.
- Host user-data.sh: the vsock↔internet proxy runs only when egress is enabled.
Same flag flows through build and deploy paths so PCRs reproduce. Ingress untouched.
Also fixes pre-existing test-compile breakage from the HCL merge (caution-config / enclave-builder / api).
TODO (out of scope):
- Per-CIDR/port enforcement at the security group (today: all-or-nothing)
- In-enclave firewall enforcing specific egress targets
- Live Nitro e2e test of hermeticity
Enclaves are now hermetic by default — outbound access only when the HCL config declares network.egress rules. Empty/absent ⇒ no internet, but still reachable on ingress ports.
A single flag (network.egress_enabled()) gates two points:
- Enclave run.sh (attestable): the outbound tunnel block is compiled into the EIF only when egress is enabled; otherwise a hermetic resolver remains. Affects PCRs.
- Host user-data.sh: the vsock↔internet proxy runs only when egress is enabled.
Same flag flows through build and deploy paths so PCRs reproduce. Ingress untouched.
Also fixes pre-existing test-compile breakage from the HCL merge (caution-config / enclave-builder / api).
TODO (out of scope):
- [ ] Per-CIDR/port enforcement at the security group (today: all-or-nothing)
- [ ] In-enclave firewall enforcing specific egress targets
- [ ] Live Nitro e2e test of hermeticity