App network isolation - #52572
Draft
agners wants to merge 4 commits into
Draft
Conversation
Apps that use host networking can now be switched to an isolated network endpoint (macvlan) from the network card on the Configuration tab, when the Supervisor reports network_isolation_available. The card gains a toggle, an interface select populated from the network_isolation_capable host interfaces, and an IPv4 address field. Saving posts the network_isolation option and suggests an app restart, same as port changes. The info tab shows the assigned IP while the app is running. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The Supervisor now reports network_isolation_mac, a stable MAC derived from the static IP that is known as soon as isolation is configured. Show it next to the IP on the app info tab, including while the app is stopped, so users can create router or firewall rules before the first start. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Display the saved endpoint MAC below the IP address field of the isolated network access section, so users can set up router or firewall rules right where they configure the endpoint. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add an info alert to the isolated network access section covering what users should know about the implementation: the app appears as a separate device, IPv6 is automatic via SLAAC, the host and the app cannot reach each other on the isolated network by design (Supervisor communication like ingress is unaffected), and apps that introspect host interfaces may behave differently. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Breaking change
Proposed change
Adds a new option to enable app network isolation (home-assistant/supervisor#6937).
Screenshots
Type of change
Additional information
Checklist
If user exposed functionality or configuration variables are added/changed:
To help with the load of incoming pull requests: