[LXC] Enforce the deny-all-except-proxy network policy (model 2) - #798

Open

Darren Hoehna (dhoehna) wants to merge 17 commits into

mainfrom

user/dahoehna/lxc-network-model2

Commits on Aug 9, 2026

[LXC] Scrub and apply proxy env vars through the shared helper

Darren Hoehna (dhoehna)
and
Copilot
committed
d0705a0
Correct the LXC client note: the integration is planned, not wired

Darren Hoehna (dhoehna)
and
Copilot
committed
b74f5bf
[LXC] Pin the proxy hostname instead of rewriting the URL host

Darren Hoehna (dhoehna)
and
Copilot
committed
40514a6
Drop a dead bracket guard and document why unbracketing is load-bearing

Darren Hoehna (dhoehna)
and
Copilot
committed
764900b
[LXC] Make an unpinnable proxy address unrepresentable

Darren Hoehna (dhoehna)
and
Copilot
committed
bf37b12
[LXC] Update proxy address spec for the unpinnable-address fix

Darren Hoehna (dhoehna)
and
Copilot
committed
445ea2e
[LXC] Fail closed when firewall rules cannot be scoped to the container
Darren Hoehna (dhoehna)
committed
91b3760
[LXC] Spec the fail-closed contract for unscopeable firewall rules
Darren Hoehna (dhoehna)
committed
a3d82c0
[LXC] Hook the firewall chain onto the bridge port so it actually filters

Darren Hoehna (dhoehna)
and
Copilot
committed
47e00a9
[LXC] Spec the FORWARD hook contract and assert enforcement end to end

Darren Hoehna (dhoehna)
and
Copilot
committed
3a05f6a
[LXC] Make deny rules win over allow rules and fail closed on an unresolvable block

Darren Hoehna (dhoehna)
and
Copilot
committed
792d1ae
[LXC] Spec deny precedence and assert an overlapping allow cannot defeat a block
Darren Hoehna (dhoehna)
committed
988b609
[LXC] Correct the network policy docs and make the E2E suite gate in CI
Darren Hoehna (dhoehna)
committed
8595d5d
[LXC] Set FORWARD to ACCEPT in CI so only MXC rules can block

Darren Hoehna (dhoehna)
and
Copilot
committed
4ed9d4d
Keep Bubblewrap startable when no veth exists to scope the chain to

Darren Hoehna (dhoehna)
and
Copilot
committed
76eb242
Cover the Bubblewrap veth declaration so deleting it fails a test

Darren Hoehna (dhoehna)
and
Copilot
committed
3dd4196
Pin the negative case of the missing-veth accessor

Darren Hoehna (dhoehna)
and
Copilot
committed
c098239

Navigation Menu

Uh oh!

[LXC] Enforce the deny-all-except-proxy network policy (model 2) - #798

[LXC] Enforce the deny-all-except-proxy network policy (model 2)#798
Darren Hoehna (dhoehna) wants to merge 17 commits into
mainfrom
user/dahoehna/lxc-network-model2

Commits on Aug 9, 2026

[LXC] Scrub and apply proxy env vars through the shared helper

Correct the LXC client note: the integration is planned, not wired

[LXC] Pin the proxy hostname instead of rewriting the URL host

Drop a dead bracket guard and document why unbracketing is load-bearing

[LXC] Make an unpinnable proxy address unrepresentable

[LXC] Update proxy address spec for the unpinnable-address fix

[LXC] Fail closed when firewall rules cannot be scoped to the container

[LXC] Spec the fail-closed contract for unscopeable firewall rules

[LXC] Hook the firewall chain onto the bridge port so it actually filters

[LXC] Spec the FORWARD hook contract and assert enforcement end to end

[LXC] Make deny rules win over allow rules and fail closed on an unresolvable block

[LXC] Spec deny precedence and assert an overlapping allow cannot defeat a block

[LXC] Correct the network policy docs and make the E2E suite gate in CI

[LXC] Set FORWARD to ACCEPT in CI so only MXC rules can block

Keep Bubblewrap startable when no veth exists to scope the chain to

Cover the Bubblewrap veth declaration so deleting it fails a test

Pin the negative case of the missing-veth accessor