OpenShell Networking + Filesystem Isolation

Gateway policy delivery stays separate from sandbox-local enforcement. The supervisor prepares static controls, launches the agent as an unprivileged child, and forces observable egress through the policy proxy.

Standalone HTML/SVG
Generated from repo docs + sandbox code
OpenShell isolation architecture A three-panel architecture diagram showing gateway and sandbox boundaries, network egress enforcement, and filesystem startup isolation. 1. Runtime Boundary Gateway delivers desired state. Sandbox supervisor owns runtime enforcement. 2. Network Egress Enforcement Ordinary traffic is forced through the proxy, evaluated, and either forwarded, denied, logged, or routed to inference.local. 3. Filesystem + Process Startup Static controls are prepared before exec and normally require sandbox recreation to change. CLI / SDK / TUI user-facing API clients Gateway Control Plane sandbox state, policy revisions settings, credentials, inference routes Compute Runtime Docker, Podman, K8s, VM Sandbox workload Supervisor root prelude, policy load, config polling proxy, SSH relay, log push Restricted Agent Child sandbox user + group Landlock, seccomp, netns active OPA policy engine Proxy egress gate Relay connect/exec/fs gRPC / HTTP launch request provisions workload outbound supervisor session config refresh, logs, relays spawn + restrict Agent Process HTTP(S), git, model SDKs env: http_proxy / HTTPS_PROXY Bypass Guards netns + veth route nft rejects non-proxy TCP/UDP Local CONNECT Proxy proxy endpoint inside netns terminates selected TLS/L7 Binary Identity path, sha256, ancestors SSRF Hard Blocks internal IPs unless allowed OPA L4 Decision host, port, binary, policy TLS / L7 Inspection REST, GraphQL, WebSocket method, path, operation, fields External Services allowed upstream traffic credentials resolved only in proxy inference.local special route, not OPA network openshell-router configured model backends Deny / Audit / Log OCSF + structured 403 Policy Proposals L4 denial summaries to gateway ordinary egress bypass attempt allowed + protocol inspect forward special host deny wins L4 DenialEvent Policy YAML filesystem_policy read_only + read_write Supervisor Prelude load + validate policy enrich baseline paths workdir and runtime material Landlock Prepare open PathFds as root build ruleset best_effort or hard_requirement pre_exec Child enter netns/mount ns drop to sandbox user no supervisor identity socket Enforce Controls restrict_self() seccomp filter raw socket and privilege paths blocked Exec Agent restricted runtime undeclared paths denied Read-only paths /usr, /lib, /etc, /app... Read-write paths /sandbox, /tmp, workdir... Runtime enrichment proxy support, GPU devices Blocked by default undeclared filesystem paths Legend client / protocol inspection gateway or supervisor control policy engine / policy data security enforcement / deny path

Network Isolation

  • Traffic is configured for proxy mode in sandbox policy conversion.
  • The child receives proxy environment variables before exec.
  • Network namespace and nftables reject direct TCP/UDP bypass attempts.

Filesystem Isolation

  • Landlock PathFds are opened while the supervisor still has root privileges.
  • The child drops to the sandbox user before Landlock and seccomp enforcement.
  • Read-only, read-write, workdir, and enriched runtime paths define the visible filesystem.

Dynamic Policy

  • Network policy can reload for new connections or safely parsed HTTP requests.
  • Filesystem and process controls are startup-time controls.
  • L4 denials can become pending gateway policy proposals.