trending/OpenShell
1
0
Fork 0
mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-11-04 08:25:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

docs(mxc): define the host proxy trust boundary

Browse Source 
Clarify that per-sandbox ports provide routing separation rather than peer authentication, place host-local processes in the trusted computing base, and retain M3 as the stronger source-attribution dependency.

Signed-off-by: Akber Raza <akberr@nvidia.com>
This commit is contained in:
Akber Raza
2026-09-14 18:16:05 -07:00
committed by Drew Newberry
parent 9d2ef7f8d4
commit 1db16e0fa0
2 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/openshell-driver-mxc/README.md
+2
View File
@@ -109,6 +109,8 @@ activity, and correlation-vector links remain available for five seconds so
already in-flight ETW records can arrive, but retired PID evidence cannot resolve
them. Records without matching generation evidence remain unattributed.
Each sandbox receives a distinct listener port through its MXC redirect, but the listener does not authenticate its TCP peer. Processes that can connect directly to gateway-owned loopback ports are part of the trusted Windows host boundary. MXC feedback item M3 tracks stable source attribution for deployments that need a mutually untrusted shared-host boundary.
The MXC credential handoff is also fixed at sandbox creation. The gateway rejects expiring static provider credentials because the in-process MXC driver has no live credential-refresh channel. Dynamic token grants remain request-time operations in the host proxy. Recreate the sandbox after rotating or revoking a non-expiring static credential.
## Prerequisites (live runs)
docs/reference/gateway-config.mdx
+2
View File
@@ -916,6 +916,8 @@ mount setup to bypass that profile.
Attached provider credentials require this governed-egress path. The gateway gives MXC only revision-scoped environment placeholders and keeps real values in the host proxy's endpoint-bound resolver. Provider keys override matching sandbox environment entries case-insensitively. Sandbox creation fails when attached provider material exists but `egress_proxy` is disabled. MXC takes its static provider snapshot at creation and rejects credentials with an expiration timestamp because it has no live refresh channel. Dynamic token grants continue to mint credentials per request in the host proxy. Recreate the sandbox after attaching, detaching, rotating, or revoking a non-expiring static provider credential.
The driver assigns a distinct loopback listener port to each MXC sandbox, but the listener does not authenticate its TCP peer. Treat Windows processes that can connect directly to gateway-owned loopback ports as part of the trusted host boundary.
### MicroVM
Each sandbox runs inside its own libkrun microVM managed by the standalone `openshell-driver-vm` subprocess. Use this driver when you want stronger isolation than container namespaces alone.