OCI isolation and egress

Runtime stack

OCI is the plugin package. Podman supplies image storage and lifecycle mechanics. gVisor/runsc mediates the workload’s Linux system-call surface. Host remains the policy and reconciliation authority.

The release adapter runs runsc with --network=none and --host-uds=open. The OCI spec mounts only a generation-private bootstrap directory containing that generation’s HPP/2 socket and optional egress socket. Plugins run as fixed non-root UID/GID 65532.

External HTTPS and WSS

A grant for net.connect(host,port) creates a private path:

Direct TLS over a generation-private network pathHost grants a destination, not an arbitrary forwarding API.

01PluginHTTPS or WSS client

→

02Loopback shimInside the image

→

03Private UDSMode 0600

→

04Egress bridgePinned address + budgets

→

05Exact originApproved host : port

NetworkThe OCI sandbox itself runs with network=none.

ConfidentialityTLS remains end-to-end; Host copies opaque bytes.

The shim has no ambient network authority. The bridge is not shared, resolves and pins the destination address, rejects private/link-local/metadata targets, and enforces connection and byte budgets. It copies opaque bytes; it does not terminate TLS, inspect payloads, or accept arbitrary Host URLs.

Therefore a plugin approved for a Binance WSS destination can keep an endless subscription, subject to lifecycle and resource budgets. REST and WSS to the same external origin still require the manifest’s exact approved destinations. Host is not a full-permission local proxy.