feat(sandbox): enforce egress with a privileged agent (ALIEN-1188)

[alongubkin]

A sandbox can opt into privilegedSupervisor: { commandUid: 60001 } to have Alien's agent install its declared egress policy before serving exec requests or starting image code. The agent is the privileged entrypoint; the saved OCI Entrypoint/Cmd, exec requests, and detached jobs run under the declaration-owned non-root uid with zero capabilities and an irreversible privilege drop. Callers cannot select the identity or override the startup policy.

AWS cloud egress stays open and the extra OS capability grant is internal. Before creating worker threads, the supervisor installs a dedicated native IPv4 nftables table selecting the command uid, then reduces its capabilities. Native socket uid matching works on the guest kernel even though the iptables owner extension is unavailable. Root traffic remains available for AWS's internal transport initialization after image restore. Commands inherit seccomp denying IPv6 sockets, io_uring, and alternate syscall ABIs: the real MicroVM has an IPv6 default route, while IPv6/inet netfilter tables are unavailable. Disabling IPv6 globally breaks AWS transport.

allowDomains pins public IPv4 addresses into the built image version, with canonical and dotted hostname aliases. Other services sharing those addresses remain reachable; rebuild and redeploy the image to refresh DNS. Restarting or resuming a session retains the pinned addresses. Restricted policies deny command DNS before accepting loopback or established traffic. No proxy, firewall, or new connector resources are added. Backends without this supervisor path, including Local and Kubernetes, refuse the opt-in at plan time. Raw remote cloud grants are also refused because they permit selecting retained image versions with different security policies; ordinary workload bindings select the active version.

Compatible bundles preserve OCI argv, environment, and working directory in root-owned metadata. Startup refuses older incompatible bundles. The default sandbox base includes nftables; build instructions and policy limits are in crates/alien-sandbox-agent/README.md.

Validation:

• Real ARM64 AWS MicroVM built and restored this agent: exec and saved image command uid 60001, all capability sets zero, no_new_privs enabled; all supervisor threads retain only 00000000000011eb. Caller environment overrides do not change identity or policy. example.com returns HTTP200, 1.1.1.1 times out, IPv6 sockets fail EPERM, and nft flush ruleset fails. Hostname aliases resolve identically. A detached preview service also answers HTTP200 through AWS ingress after restore. All probe resources deleted afterward.
• Explicit Docker network-namespace qualification passes actual IPv4/DNS traffic enforcement, rule/hosts mutation refusal, saved image identity, IPv6 denial, raw socket/TCP repair denial, command timeout kill/reap, and preview replies across the Docker bridge to a non-loopback host client.
• Core, agent, AWS controller, bundle unit, CloudFormation/Terraform sandbox checks and TypeScript workspace build pass. Core schemas and sandbox image artifacts regenerated. Full local generation is limited by the unchanged ARM Docker permissions-generator invocation; core generation succeeded separately. The broader image-shape test needs a native bindings addon unavailable in this worktree.

🤖 Generated with Claude Code

[enclave-ai]

Enclave skipped this draft pull request. It will run automatically when you mark the PR as Ready for review.

[alongubkin]

@greptileai review

[alongubkin]

@greptileai review

[greptile-apps]

Confidence Score: 5/5

[Critical risk] Adds privileged agent enforcement of network egress policy.

The PR appears safe to merge based on this review; no new actionable issue or outstanding previous finding remains.

Summary

This PR adds an opt-in privileged supervisor for AWS sandboxes. It packages the image command for unprivileged execution, installs agent-owned egress rules, and carries the supervisor policy through image creation and updates. The changes since the previous review clarify that refreshing pinned DNS addresses requires a new image version. No new actionable issue was identified; the previous threads are resolved.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  D[Sandbox declaration] --> B[Supervised bundle]
  D --> P[Image build policy]
  B --> I[AWS image version]
  P --> I
  I --> A[Agent startup]
  A --> E[Pin DNS and install egress rules]
  E --> C[Drop command privileges]
  C --> X[Image command and exec requests]
  I --> S[Sessions and resumes]

Loading

_{Reviews (10) · Last reviewed commit: "docs: describe address pinning across im..."}

[alongubkin]

@greptileai review

[alongubkin]

@greptileai review

[alongubkin]

@greptileai review

[alongubkin]

@greptileai review

[alongubkin]

@greptileai review

[alongubkin]

@greptileai review

[alongubkin]

@greptileai review

[alongubkin]

@greptileai review