From 1db16e0fa0238db885d41e18a6d9b35f5e3df5bc Mon Sep 17 00:00:00 2001 From: Akber Raza Date: Thu, 10 Sep 2026 17:34:06 -0500 Subject: [PATCH] docs(mxc): define the host proxy trust boundary Clarify that per-sandbox ports provide routing separation rather than peer authentication, place host-local processes in the trusted computing base, and retain M3 as the stronger source-attribution dependency. Signed-off-by: Akber Raza --- crates/openshell-driver-mxc/README.md | 2 ++ docs/reference/gateway-config.mdx | 2 ++ 2 files changed, 4 insertions(+) diff --git a/crates/openshell-driver-mxc/README.md b/crates/openshell-driver-mxc/README.md index 1f6080906..2335bb7f3 100644 --- a/crates/openshell-driver-mxc/README.md +++ b/crates/openshell-driver-mxc/README.md @@ -109,6 +109,8 @@ activity, and correlation-vector links remain available for five seconds so already in-flight ETW records can arrive, but retired PID evidence cannot resolve them. Records without matching generation evidence remain unattributed. +Each sandbox receives a distinct listener port through its MXC redirect, but the listener does not authenticate its TCP peer. Processes that can connect directly to gateway-owned loopback ports are part of the trusted Windows host boundary. MXC feedback item M3 tracks stable source attribution for deployments that need a mutually untrusted shared-host boundary. + The MXC credential handoff is also fixed at sandbox creation. The gateway rejects expiring static provider credentials because the in-process MXC driver has no live credential-refresh channel. Dynamic token grants remain request-time operations in the host proxy. Recreate the sandbox after rotating or revoking a non-expiring static credential. ## Prerequisites (live runs) diff --git a/docs/reference/gateway-config.mdx b/docs/reference/gateway-config.mdx index 2ffc42046..12148f2b5 100644 --- a/docs/reference/gateway-config.mdx +++ b/docs/reference/gateway-config.mdx @@ -916,6 +916,8 @@ mount setup to bypass that profile. Attached provider credentials require this governed-egress path. The gateway gives MXC only revision-scoped environment placeholders and keeps real values in the host proxy's endpoint-bound resolver. Provider keys override matching sandbox environment entries case-insensitively. Sandbox creation fails when attached provider material exists but `egress_proxy` is disabled. MXC takes its static provider snapshot at creation and rejects credentials with an expiration timestamp because it has no live refresh channel. Dynamic token grants continue to mint credentials per request in the host proxy. Recreate the sandbox after attaching, detaching, rotating, or revoking a non-expiring static provider credential. +The driver assigns a distinct loopback listener port to each MXC sandbox, but the listener does not authenticate its TCP peer. Treat Windows processes that can connect directly to gateway-owned loopback ports as part of the trusted host boundary. + ### MicroVM Each sandbox runs inside its own libkrun microVM managed by the standalone `openshell-driver-vm` subprocess. Use this driver when you want stronger isolation than container namespaces alone.