dckcandClaude Opus 5.5
7bf6eb44c7
A vat granted a host (PUT /<vat>?egress=<host> on the admin socket) gets Egress as its globalOutbound, with the host in ctx.props where the vat can't change it. Egress forwards matching requests, WebSocket upgrades included, to the switchboard and refuses the rest with a 403; with no grant, fetch still throws. The switchboard is a separate workerd: a Switchboard DO that calls fetch and returns the response, so a 101's webSocket passes through. toybox reaches it over a unix socket in HTTP proxy style, which keeps the full URL, scheme included. Its network service is the outer fence, with TLS trusting the browser CAs; systemd units for it join toybox's, and only the toybox group can open its socket. The loaded Worker is now named by vat and incarnation, not by code hash: the same code with a different grant must not share a Worker. The new incarnation table sits beside the old ones; vats installed before it read as incarnation 0 with no grant. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
20 lines
674 B
Desktop File
20 lines
674 B
Desktop File
[Unit]
|
|
Description=toybox vats (workerd)
|
|
Requires=toybox.socket toybox-switchboard.socket
|
|
After=toybox-switchboard.socket
|
|
|
|
[Service]
|
|
ExecStart=/opt/toybox/node_modules/workerd/bin/workerd serve --experimental /opt/toybox/config.capnp -S http=3 -S admin=4 -d state=/var/lib/toybox -e switchboard=unix:/run/toybox/switchboard.sock
|
|
DynamicUser=yes
|
|
# to open the switchboard socket
|
|
SupplementaryGroups=toybox
|
|
StateDirectory=toybox
|
|
# no network but the sockets handed in, and the switchboard's
|
|
PrivateNetwork=yes
|
|
RestrictAddressFamilies=AF_UNIX
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
SystemCallFilter=@system-service
|
|
# not MemoryDenyWriteExecute: V8's JIT needs W+X
|