ZeroLog
Geschlossene Vorschau
Zurück zum Newsroom

Übersetzung noch nicht verfügbar. Der Originaltext wird angezeigt.

Sicherheit

19 October: Docker API filter, tighter container egress, Retry-After on rate limits

The Docker API on the host sits behind a filter, outgoing traffic from the default Docker bridge is restricted, and rate-limited pairing endpoints say when to retry.

Nutzerwirkung: Noch nicht bewertet

Added on 23 October 2026 from the repository history. Wording follows commit subjects.

How one outbound connection is judgedA container has no route to the internet except through the egress broker, which knows which container and which owner a connection belongs to. The broker first refuses connections to closed ports such as mail, SMB and telnet, whatever your settings. Then it allows destinations on your allow-list. Otherwise it allows public hosts that are on no blocklist and refuses internal addresses. Unusual traffic patterns are slowed.closedopenyesnoyes (slowed if the pattern isunusual)noYour containerno route to the internetexcept through the brokerEgress brokerknows which containerand which owner1. Is the port closed?mail, SMB, telnet and otherold services: refused, always2. Is the destinationon your allow-list?3. A public host that is onno blocklist? Allowed bydefault.Internal addresses stayrefusedInternetRefused and recorded
Outbound traffic from a workspace. Diagram from the docs.
Text version

Traffic from a workspace leaves through a filtered path. Everything not on the allowed list is dropped and counted.

Security

  • The Docker API is reached through a filter in its own network. The app account no longer holds the Docker key, and docker inspect hides environment values.
  • Outgoing traffic from the default Docker bridge is limited to the worker nodes' remote-desktop ports. Everything else is dropped and counted.
  • The firewall helper accepts a fixed list of commands instead of general sudo iptables.
  • Device claim, pairing, extension redeem and provider-key endpoints send a Retry-After header with 429 responses.

Correction to the entry about per-account memory encryption (dated 20 October): the encryption code went live on 19 October at 17:17 UTC.

Auch Korrekturen gehören hierher. Feed · Doku · X · Recht & Datenschutz