OpenShell

mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-18 05:39:50 +08:00

Files

T

John Myers 4ec54503c2 feat(sandbox): log connection attempts that bypass proxy path

Add iptables LOG + REJECT rules inside the sandbox network namespace to
detect and diagnose direct connection attempts that bypass the HTTP
CONNECT proxy. This provides two improvements:

1. Fast-fail UX: applications get immediate ECONNREFUSED instead of a
   30-second timeout when they bypass the proxy
2. Diagnostics: a /dev/kmsg monitor emits structured BYPASS_DETECT
   tracing events with destination, protocol, process identity, and
   actionable hints

Both TCP and UDP bypass attempts are covered (UDP catches DNS bypass).
The feature degrades gracefully if iptables or /dev/kmsg are unavailable.

Closes #268

2026-03-15 12:45:36 -07:00

bring-your-own-container

feat(sandbox): log connection attempts that bypass proxy path

2026-03-15 12:45:36 -07:00

local-inference

refactor: rename navigator- crate prefix to openshell- (#277 )

2026-03-13 02:02:18 -07:00

policy-advisor

ci(release): gate python wheels on e2e for tagged releases (#319 )

2026-03-15 00:39:00 -07:00

private-ip-routing

ci: remove sandbox docker build from publish and e2e workflows (#275 )