Plan hardening: socket-proxy allowlist, gateway load test, offline verify

- The compose server NEVER sees the raw Docker socket (plan risk #5):
  tecnativa/docker-socket-proxy on an isolated engine_net with exactly
  CONTAINERS/POST/EXEC/DELETE/VERSION allowed; server reaches it via
  DOCKER_HOST. DockerDriver honors DOCKER_HOST (connect_to). Proven by a
  REAL proxy test: full sandbox lifecycle works through the allowlist
  while /networks, /secrets, and /images all 403 — the blast-radius cap
  if the server is ever owned. (This also fixes compose deployments,
  where sandbox provisioning previously had no engine access at all.)
- Gateway load test (plan P6): 40 concurrent SSE streams against one
  server — every run completes with the full §13 event vocabulary,
  every journal strictly monotonic, every resumeFrom=0 replay byte-equal
  to its live stream
- release.yml: SBOMs (syft, spdx-json) for all four images shipped
  INSIDE the signed bundle; final verification now runs in a
  --network none container — proving the customer's verify path needs
  no internet, not just claiming it

159 Rust tests.

Co-Authored-By: Claude Fable 5 <[email protected]>

This commit is contained in:

Omar Sobh

2026-06-10 10:50:55 -05:00

co-authored by

Claude Fable 5

parent ceca21ca79

commit a26939d7bc

7 changed files with 390 additions and 3 deletions

									
										crates/tc-sandbox/Cargo.toml
									
		+1
		
												View File
												
				@@ -26,6 +26,7 @@ k8s = ["dep:kube", "dep:k8s-openapi", "dep:rustls"]

				k8s-tests = ["k8s"]

				[dev-dependencies]

				reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }

				[lints]

				workspace = true