dckcandClaude Opus 5.5
7bf6eb44c7
A vat granted a host (PUT /<vat>?egress=<host> on the admin socket) gets Egress as its globalOutbound, with the host in ctx.props where the vat can't change it. Egress forwards matching requests, WebSocket upgrades included, to the switchboard and refuses the rest with a 403; with no grant, fetch still throws. The switchboard is a separate workerd: a Switchboard DO that calls fetch and returns the response, so a 101's webSocket passes through. toybox reaches it over a unix socket in HTTP proxy style, which keeps the full URL, scheme included. Its network service is the outer fence, with TLS trusting the browser CAs; systemd units for it join toybox's, and only the toybox group can open its socket. The loaded Worker is now named by vat and incarnation, not by code hash: the same code with a different grant must not share a Worker. The new incarnation table sits beside the old ones; vats installed before it read as incarnation 0 with no grant. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
37 lines
1.5 KiB
Cap'n Proto
37 lines
1.5 KiB
Cap'n Proto
# toybox: vats whose code is installed at runtime, each a Durable Object facet.
|
|
#
|
|
# Sockets have no address here: whoever starts workerd hands them in
|
|
# (-S name=fd from systemd, or -s name=addr), so holding a socket is the
|
|
# authority it grants. `state` is likewise overridden with -d state=<dir>,
|
|
# and the switchboard's address with -e switchboard=<addr>.
|
|
using Workerd = import "/workerd/workerd.capnp";
|
|
|
|
const config :Workerd.Config = (
|
|
services = [
|
|
(name = "main", worker = .supervisor),
|
|
(name = "nowhere", network = (allow = [])),
|
|
# the way out: see switchboard.capnp
|
|
(name = "switchboard", external = (address = "unix:switchboard.sock", http = (style = proxy))),
|
|
(name = "state", disk = (path = "state", writable = true)),
|
|
],
|
|
sockets = [
|
|
# reach a running vat by name
|
|
(name = "http", http = (), service = (name = "main", entrypoint = "Public")),
|
|
# install code into a vat and (re)start it
|
|
(name = "admin", http = (), service = (name = "main", entrypoint = "Admin")),
|
|
],
|
|
);
|
|
|
|
const supervisor :Workerd.Worker = (
|
|
compatibilityDate = "2026-10-01",
|
|
modules = [(name = "supervisor.js", esModule = embed "supervisor.js")],
|
|
durableObjectNamespaces = [(className = "Vat", uniqueKey = "toybox-vat", enableSql = true)],
|
|
durableObjectStorage = (localDisk = "state"),
|
|
bindings = [
|
|
(name = "VATS", durableObjectNamespace = "Vat"),
|
|
(name = "LOADER", workerLoader = ()),
|
|
(name = "SWITCHBOARD", service = "switchboard"),
|
|
],
|
|
globalOutbound = "nowhere",
|
|
);
|