| feat(network): initialize guest networking from CNI Guest networking used fixed values before the host could pass its address and DNS information for the selected network slot. The guest resolver therefore could not reflect the CNI network. Add a framed host-agent initialization handshake carrying identity, environment, and guest network settings. Configure or revalidate the guest before starting services, use CNI as the sole DNS source, and close the handshake connection once readiness is established. Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com> | 1 个月前 |
| feat(network): add configurable sandbox policies Sandboxes previously inherited unrestricted network behavior from warm network slots, with no API for per-sandbox ingress or egress controls. Slot reuse could also retain policy and conntrack state across sandbox assignments. Add typed allow and deny configuration across the daemon, runtime service, persistent state, and Python SDK. Validate destinations before slot allocation and apply live changes with batched iptables updates. Compensate persistent state when updates fail, and clear policy and conntrack state before returning slots to the warm pool. Co-authored-by: Yifan Zhao <stopire@gmail.com> Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com> | 1 个月前 |
| docs: improve project documentation Documentation mixed user and developer guidance and still described outdated dependencies, commands, and runtime behavior. Organize documentation by audience, remove obsolete pages and assets, and align setup, template, network, and VMM guidance with the current implementation. Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com> | 1 个月前 |