[{"data":1,"prerenderedAt":788},["ShallowReactive",2],{"doc-\u002Fdocs\u002Fsecurity":3},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":5,"title":7,"description":8,"body":9,"_type":782,"_id":783,"_source":784,"_file":785,"_stem":786,"_extension":787},"\u002Fsecurity","",false,"Security & OCI Sandboxing","3-layer defense-in-depth isolation, host blocking middleware, and pluggable OCI runtime strategies.",{"type":10,"children":11,"toc":775},"root",[12,20,33,37,44,49,88,232,235,241,246,402,409,422,590,593,599,604,769],{"type":13,"tag":14,"props":15,"children":17},"element","h1",{"id":16},"security-oci-sandboxing",[18],{"type":19,"value":7},"text",{"type":13,"tag":21,"props":22,"children":23},"p",{},[24,31],{"type":13,"tag":25,"props":26,"children":28},"code",{"className":27},[],[29],{"type":19,"value":30},"prototype",{"type":19,"value":32}," enforces multi-layer isolation to prevent containerized workloads from accessing the host management control plane or local network services.",{"type":13,"tag":34,"props":35,"children":36},"hr",{},[],{"type":13,"tag":38,"props":39,"children":41},"h2",{"id":40},"️-3-layer-defense-in-depth-model",[42],{"type":19,"value":43},"🛡️ 3-Layer Defense-in-Depth Model",{"type":13,"tag":21,"props":45,"children":46},{},[47],{"type":19,"value":48},"Isolation is enforced across network boundaries, application HTTP middleware, and kernel capability controls.",{"type":13,"tag":50,"props":51,"children":55},"pre",{"className":52,"code":53,"language":54,"meta":5,"style":5},"language-mermaid shiki shiki-themes github-dark github-dark github-light","graph LR\n    L1[\"1. Network: 127.0.0.1 + Null-Route\"] --> L2[\"2. Host Middleware: Block Gateway\"]\n    L2 --> L3[\"3. Kernel: CapDrop ALL + no-new-privs\"]\n","mermaid",[56],{"type":13,"tag":25,"props":57,"children":58},{"__ignoreMap":5},[59,70,79],{"type":13,"tag":60,"props":61,"children":64},"span",{"class":62,"line":63},"line",1,[65],{"type":13,"tag":60,"props":66,"children":67},{},[68],{"type":19,"value":69},"graph LR\n",{"type":13,"tag":60,"props":71,"children":73},{"class":62,"line":72},2,[74],{"type":13,"tag":60,"props":75,"children":76},{},[77],{"type":19,"value":78},"    L1[\"1. Network: 127.0.0.1 + Null-Route\"] --> L2[\"2. Host Middleware: Block Gateway\"]\n",{"type":13,"tag":60,"props":80,"children":82},{"class":62,"line":81},3,[83],{"type":13,"tag":60,"props":84,"children":85},{},[86],{"type":19,"value":87},"    L2 --> L3[\"3. Kernel: CapDrop ALL + no-new-privs\"]\n",{"type":13,"tag":89,"props":90,"children":91},"table",{},[92,117],{"type":13,"tag":93,"props":94,"children":95},"thead",{},[96],{"type":13,"tag":97,"props":98,"children":99},"tr",{},[100,107,112],{"type":13,"tag":101,"props":102,"children":104},"th",{"align":103},"left",[105],{"type":19,"value":106},"Layer",{"type":13,"tag":101,"props":108,"children":109},{"align":103},[110],{"type":19,"value":111},"Threat Mitigated",{"type":13,"tag":101,"props":113,"children":114},{"align":103},[115],{"type":19,"value":116},"Technical Enforcement",{"type":13,"tag":118,"props":119,"children":120},"tbody",{},[121,160,195],{"type":13,"tag":97,"props":122,"children":123},{},[124,134,139],{"type":13,"tag":125,"props":126,"children":127},"td",{"align":103},[128],{"type":13,"tag":129,"props":130,"children":131},"strong",{},[132],{"type":19,"value":133},"1. Network Boundary",{"type":13,"tag":125,"props":135,"children":136},{"align":103},[137],{"type":19,"value":138},"Local LAN\u002FWAN Scanning",{"type":13,"tag":125,"props":140,"children":141},{"align":103},[142,144,150,152,158],{"type":19,"value":143},"Explicit ",{"type":13,"tag":25,"props":145,"children":147},{"className":146},[],[148],{"type":19,"value":149},"127.0.0.1",{"type":19,"value":151}," binding and null-routing ",{"type":13,"tag":25,"props":153,"children":155},{"className":154},[],[156],{"type":19,"value":157},"host.docker.internal:127.0.0.1",{"type":19,"value":159}," inside containers.",{"type":13,"tag":97,"props":161,"children":162},{},[163,171,176],{"type":13,"tag":125,"props":164,"children":165},{"align":103},[166],{"type":13,"tag":129,"props":167,"children":168},{},[169],{"type":19,"value":170},"2. Host Middleware",{"type":13,"tag":125,"props":172,"children":173},{"align":103},[174],{"type":19,"value":175},"REST API Tampering from Containers",{"type":13,"tag":125,"props":177,"children":178},{"align":103},[179,185,187,193],{"type":13,"tag":25,"props":180,"children":182},{"className":181},[],[183],{"type":19,"value":184},"ContainerHostIsolationMiddleware",{"type":19,"value":186}," rejects requests originating from Docker bridge subnets (",{"type":13,"tag":25,"props":188,"children":190},{"className":189},[],[191],{"type":19,"value":192},"172.16.0.0\u002F12",{"type":19,"value":194},").",{"type":13,"tag":97,"props":196,"children":197},{},[198,206,211],{"type":13,"tag":125,"props":199,"children":200},{"align":103},[201],{"type":13,"tag":129,"props":202,"children":203},{},[204],{"type":19,"value":205},"3. Kernel Hardening",{"type":13,"tag":125,"props":207,"children":208},{"align":103},[209],{"type":19,"value":210},"Privilege Escalation & Fork Bombs",{"type":13,"tag":125,"props":212,"children":213},{"align":103},[214,216,222,224,230],{"type":19,"value":215},"Strips capabilities (",{"type":13,"tag":25,"props":217,"children":219},{"className":218},[],[220],{"type":19,"value":221},"CapDrop: ALL",{"type":19,"value":223},"), enforces ",{"type":13,"tag":25,"props":225,"children":227},{"className":226},[],[228],{"type":19,"value":229},"no-new-privileges: true",{"type":19,"value":231},", and applies Seccomp syscall filters.",{"type":13,"tag":34,"props":233,"children":234},{},[],{"type":13,"tag":38,"props":236,"children":238},{"id":237},"pluggable-oci-runtime-strategies",[239],{"type":19,"value":240},"📦 Pluggable OCI Runtime Strategies",{"type":13,"tag":21,"props":242,"children":243},{},[244],{"type":19,"value":245},"Run workstations under standard Linux cgroups, user-space virtualized kernels, or hardware-isolated microVMs.",{"type":13,"tag":89,"props":247,"children":248},{},[249,275],{"type":13,"tag":93,"props":250,"children":251},{},[252],{"type":13,"tag":97,"props":253,"children":254},{},[255,260,265,270],{"type":13,"tag":101,"props":256,"children":257},{"align":103},[258],{"type":19,"value":259},"Runtime",{"type":13,"tag":101,"props":261,"children":262},{"align":103},[263],{"type":19,"value":264},"Isolation Level",{"type":13,"tag":101,"props":266,"children":267},{"align":103},[268],{"type":19,"value":269},"Memory Overhead",{"type":13,"tag":101,"props":271,"children":272},{"align":103},[273],{"type":19,"value":274},"Best Suited For",{"type":13,"tag":118,"props":276,"children":277},{},[278,310,342,372],{"type":13,"tag":97,"props":279,"children":280},{},[281,295,300,305],{"type":13,"tag":125,"props":282,"children":283},{"align":103},[284],{"type":13,"tag":129,"props":285,"children":286},{},[287,293],{"type":13,"tag":25,"props":288,"children":290},{"className":289},[],[291],{"type":19,"value":292},"runc",{"type":19,"value":294}," (Default)",{"type":13,"tag":125,"props":296,"children":297},{"align":103},[298],{"type":19,"value":299},"Linux Namespaces + cgroups v2",{"type":13,"tag":125,"props":301,"children":302},{"align":103},[303],{"type":19,"value":304},"~0 MB (Native)",{"type":13,"tag":125,"props":306,"children":307},{"align":103},[308],{"type":19,"value":309},"Daily development, VS Code, daily web coding",{"type":13,"tag":97,"props":311,"children":312},{},[313,327,332,337],{"type":13,"tag":125,"props":314,"children":315},{"align":103},[316],{"type":13,"tag":129,"props":317,"children":318},{},[319,325],{"type":13,"tag":25,"props":320,"children":322},{"className":321},[],[323],{"type":19,"value":324},"runsc",{"type":19,"value":326}," (gVisor)",{"type":13,"tag":125,"props":328,"children":329},{"align":103},[330],{"type":19,"value":331},"Intercepted User-Space Virtual Kernel",{"type":13,"tag":125,"props":333,"children":334},{"align":103},[335],{"type":19,"value":336},"~15-30 MB",{"type":13,"tag":125,"props":338,"children":339},{"align":103},[340],{"type":19,"value":341},"Untrusted script execution, dynamic analysis, zero-trust sandboxes",{"type":13,"tag":97,"props":343,"children":344},{},[345,357,362,367],{"type":13,"tag":125,"props":346,"children":347},{"align":103},[348],{"type":13,"tag":129,"props":349,"children":350},{},[351],{"type":13,"tag":25,"props":352,"children":354},{"className":353},[],[355],{"type":19,"value":356},"kata-runtime",{"type":13,"tag":125,"props":358,"children":359},{"align":103},[360],{"type":19,"value":361},"Hardware QEMU \u002F Cloud-Hypervisor MicroVM",{"type":13,"tag":125,"props":363,"children":364},{"align":103},[365],{"type":19,"value":366},"~100 MB",{"type":13,"tag":125,"props":368,"children":369},{"align":103},[370],{"type":19,"value":371},"Multi-tenant isolation with hardware hypervisor boundaries",{"type":13,"tag":97,"props":373,"children":374},{},[375,387,392,397],{"type":13,"tag":125,"props":376,"children":377},{"align":103},[378],{"type":13,"tag":129,"props":379,"children":380},{},[381],{"type":13,"tag":25,"props":382,"children":384},{"className":383},[],[385],{"type":19,"value":386},"crun",{"type":13,"tag":125,"props":388,"children":389},{"align":103},[390],{"type":19,"value":391},"Fast C-Based Native OCI Runtime",{"type":13,"tag":125,"props":393,"children":394},{"align":103},[395],{"type":19,"value":396},"Minimal",{"type":13,"tag":125,"props":398,"children":399},{"align":103},[400],{"type":19,"value":401},"Low-latency microservices and batch workloads",{"type":13,"tag":403,"props":404,"children":406},"h3",{"id":405},"host-docker-daemon-registration",[407],{"type":19,"value":408},"Host Docker Daemon Registration",{"type":13,"tag":21,"props":410,"children":411},{},[412,414,420],{"type":19,"value":413},"Register alternate OCI runtimes in ",{"type":13,"tag":25,"props":415,"children":417},{"className":416},[],[418],{"type":19,"value":419},"\u002Fetc\u002Fdocker\u002Fdaemon.json",{"type":19,"value":421}," and restart the Docker engine:",{"type":13,"tag":50,"props":423,"children":427},{"className":424,"code":425,"language":426,"meta":5,"style":5},"language-json shiki shiki-themes github-dark github-dark github-light","{\n  \"runtimes\": {\n    \"runsc\": {\n      \"path\": \"\u002Fusr\u002Fbin\u002Frunsc\"\n    },\n    \"kata-runtime\": {\n      \"path\": \"\u002Fusr\u002Fbin\u002Fkata-runtime\"\n    },\n    \"crun\": {\n      \"path\": \"\u002Fusr\u002Fbin\u002Fcrun\"\n    }\n  }\n}\n","json",[428],{"type":13,"tag":25,"props":429,"children":430},{"__ignoreMap":5},[431,440,454,466,486,495,508,525,533,546,563,572,581],{"type":13,"tag":60,"props":432,"children":433},{"class":62,"line":63},[434],{"type":13,"tag":60,"props":435,"children":437},{"style":436},"--shiki-default:#E1E4E8;--shiki-dark:#E1E4E8;--shiki-light:#24292E",[438],{"type":19,"value":439},"{\n",{"type":13,"tag":60,"props":441,"children":442},{"class":62,"line":72},[443,449],{"type":13,"tag":60,"props":444,"children":446},{"style":445},"--shiki-default:#79B8FF;--shiki-dark:#79B8FF;--shiki-light:#005CC5",[447],{"type":19,"value":448},"  \"runtimes\"",{"type":13,"tag":60,"props":450,"children":451},{"style":436},[452],{"type":19,"value":453},": {\n",{"type":13,"tag":60,"props":455,"children":456},{"class":62,"line":81},[457,462],{"type":13,"tag":60,"props":458,"children":459},{"style":445},[460],{"type":19,"value":461},"    \"runsc\"",{"type":13,"tag":60,"props":463,"children":464},{"style":436},[465],{"type":19,"value":453},{"type":13,"tag":60,"props":467,"children":469},{"class":62,"line":468},4,[470,475,480],{"type":13,"tag":60,"props":471,"children":472},{"style":445},[473],{"type":19,"value":474},"      \"path\"",{"type":13,"tag":60,"props":476,"children":477},{"style":436},[478],{"type":19,"value":479},": ",{"type":13,"tag":60,"props":481,"children":483},{"style":482},"--shiki-default:#9ECBFF;--shiki-dark:#9ECBFF;--shiki-light:#032F62",[484],{"type":19,"value":485},"\"\u002Fusr\u002Fbin\u002Frunsc\"\n",{"type":13,"tag":60,"props":487,"children":489},{"class":62,"line":488},5,[490],{"type":13,"tag":60,"props":491,"children":492},{"style":436},[493],{"type":19,"value":494},"    },\n",{"type":13,"tag":60,"props":496,"children":498},{"class":62,"line":497},6,[499,504],{"type":13,"tag":60,"props":500,"children":501},{"style":445},[502],{"type":19,"value":503},"    \"kata-runtime\"",{"type":13,"tag":60,"props":505,"children":506},{"style":436},[507],{"type":19,"value":453},{"type":13,"tag":60,"props":509,"children":511},{"class":62,"line":510},7,[512,516,520],{"type":13,"tag":60,"props":513,"children":514},{"style":445},[515],{"type":19,"value":474},{"type":13,"tag":60,"props":517,"children":518},{"style":436},[519],{"type":19,"value":479},{"type":13,"tag":60,"props":521,"children":522},{"style":482},[523],{"type":19,"value":524},"\"\u002Fusr\u002Fbin\u002Fkata-runtime\"\n",{"type":13,"tag":60,"props":526,"children":528},{"class":62,"line":527},8,[529],{"type":13,"tag":60,"props":530,"children":531},{"style":436},[532],{"type":19,"value":494},{"type":13,"tag":60,"props":534,"children":536},{"class":62,"line":535},9,[537,542],{"type":13,"tag":60,"props":538,"children":539},{"style":445},[540],{"type":19,"value":541},"    \"crun\"",{"type":13,"tag":60,"props":543,"children":544},{"style":436},[545],{"type":19,"value":453},{"type":13,"tag":60,"props":547,"children":549},{"class":62,"line":548},10,[550,554,558],{"type":13,"tag":60,"props":551,"children":552},{"style":445},[553],{"type":19,"value":474},{"type":13,"tag":60,"props":555,"children":556},{"style":436},[557],{"type":19,"value":479},{"type":13,"tag":60,"props":559,"children":560},{"style":482},[561],{"type":19,"value":562},"\"\u002Fusr\u002Fbin\u002Fcrun\"\n",{"type":13,"tag":60,"props":564,"children":566},{"class":62,"line":565},11,[567],{"type":13,"tag":60,"props":568,"children":569},{"style":436},[570],{"type":19,"value":571},"    }\n",{"type":13,"tag":60,"props":573,"children":575},{"class":62,"line":574},12,[576],{"type":13,"tag":60,"props":577,"children":578},{"style":436},[579],{"type":19,"value":580},"  }\n",{"type":13,"tag":60,"props":582,"children":584},{"class":62,"line":583},13,[585],{"type":13,"tag":60,"props":586,"children":587},{"style":436},[588],{"type":19,"value":589},"}\n",{"type":13,"tag":34,"props":591,"children":592},{},[],{"type":13,"tag":38,"props":594,"children":596},{"id":595},"kernel-capabilities-safe-profile",[597],{"type":19,"value":598},"🔒 Kernel Capabilities & Safe Profile",{"type":13,"tag":21,"props":600,"children":601},{},[602],{"type":19,"value":603},"Containers drop all capabilities by default, retaining only strictly unprivileged permissions necessary for desktop initialization:",{"type":13,"tag":50,"props":605,"children":609},{"className":606,"code":607,"language":608,"meta":5,"style":5},"language-yaml shiki shiki-themes github-dark github-dark github-light","# Default Hardened Capability Profile\ncap_drop:\n  - ALL\ncap_add:\n  - CHOWN\n  - DAC_OVERRIDE\n  - FOWNER\n  - SETGID\n  - SETUID\n  - NET_BIND_SERVICE\n  - KILL\nsecurity_opt:\n  - no-new-privileges:true\n","yaml",[610],{"type":13,"tag":25,"props":611,"children":612},{"__ignoreMap":5},[613,622,636,649,661,673,685,697,709,721,733,745,757],{"type":13,"tag":60,"props":614,"children":615},{"class":62,"line":63},[616],{"type":13,"tag":60,"props":617,"children":619},{"style":618},"--shiki-default:#6A737D;--shiki-dark:#6A737D;--shiki-light:#6A737D",[620],{"type":19,"value":621},"# Default Hardened Capability Profile\n",{"type":13,"tag":60,"props":623,"children":624},{"class":62,"line":72},[625,631],{"type":13,"tag":60,"props":626,"children":628},{"style":627},"--shiki-default:#85E89D;--shiki-dark:#85E89D;--shiki-light:#22863A",[629],{"type":19,"value":630},"cap_drop",{"type":13,"tag":60,"props":632,"children":633},{"style":436},[634],{"type":19,"value":635},":\n",{"type":13,"tag":60,"props":637,"children":638},{"class":62,"line":81},[639,644],{"type":13,"tag":60,"props":640,"children":641},{"style":436},[642],{"type":19,"value":643},"  - ",{"type":13,"tag":60,"props":645,"children":646},{"style":482},[647],{"type":19,"value":648},"ALL\n",{"type":13,"tag":60,"props":650,"children":651},{"class":62,"line":468},[652,657],{"type":13,"tag":60,"props":653,"children":654},{"style":627},[655],{"type":19,"value":656},"cap_add",{"type":13,"tag":60,"props":658,"children":659},{"style":436},[660],{"type":19,"value":635},{"type":13,"tag":60,"props":662,"children":663},{"class":62,"line":488},[664,668],{"type":13,"tag":60,"props":665,"children":666},{"style":436},[667],{"type":19,"value":643},{"type":13,"tag":60,"props":669,"children":670},{"style":482},[671],{"type":19,"value":672},"CHOWN\n",{"type":13,"tag":60,"props":674,"children":675},{"class":62,"line":497},[676,680],{"type":13,"tag":60,"props":677,"children":678},{"style":436},[679],{"type":19,"value":643},{"type":13,"tag":60,"props":681,"children":682},{"style":482},[683],{"type":19,"value":684},"DAC_OVERRIDE\n",{"type":13,"tag":60,"props":686,"children":687},{"class":62,"line":510},[688,692],{"type":13,"tag":60,"props":689,"children":690},{"style":436},[691],{"type":19,"value":643},{"type":13,"tag":60,"props":693,"children":694},{"style":482},[695],{"type":19,"value":696},"FOWNER\n",{"type":13,"tag":60,"props":698,"children":699},{"class":62,"line":527},[700,704],{"type":13,"tag":60,"props":701,"children":702},{"style":436},[703],{"type":19,"value":643},{"type":13,"tag":60,"props":705,"children":706},{"style":482},[707],{"type":19,"value":708},"SETGID\n",{"type":13,"tag":60,"props":710,"children":711},{"class":62,"line":535},[712,716],{"type":13,"tag":60,"props":713,"children":714},{"style":436},[715],{"type":19,"value":643},{"type":13,"tag":60,"props":717,"children":718},{"style":482},[719],{"type":19,"value":720},"SETUID\n",{"type":13,"tag":60,"props":722,"children":723},{"class":62,"line":548},[724,728],{"type":13,"tag":60,"props":725,"children":726},{"style":436},[727],{"type":19,"value":643},{"type":13,"tag":60,"props":729,"children":730},{"style":482},[731],{"type":19,"value":732},"NET_BIND_SERVICE\n",{"type":13,"tag":60,"props":734,"children":735},{"class":62,"line":565},[736,740],{"type":13,"tag":60,"props":737,"children":738},{"style":436},[739],{"type":19,"value":643},{"type":13,"tag":60,"props":741,"children":742},{"style":482},[743],{"type":19,"value":744},"KILL\n",{"type":13,"tag":60,"props":746,"children":747},{"class":62,"line":574},[748,753],{"type":13,"tag":60,"props":749,"children":750},{"style":627},[751],{"type":19,"value":752},"security_opt",{"type":13,"tag":60,"props":754,"children":755},{"style":436},[756],{"type":19,"value":635},{"type":13,"tag":60,"props":758,"children":759},{"class":62,"line":583},[760,764],{"type":13,"tag":60,"props":761,"children":762},{"style":436},[763],{"type":19,"value":643},{"type":13,"tag":60,"props":765,"children":766},{"style":482},[767],{"type":19,"value":768},"no-new-privileges:true\n",{"type":13,"tag":770,"props":771,"children":772},"style",{},[773],{"type":19,"value":774},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}",{"title":5,"searchDepth":81,"depth":81,"links":776},[777,778,781],{"id":40,"depth":72,"text":43},{"id":237,"depth":72,"text":240,"children":779},[780],{"id":405,"depth":81,"text":408},{"id":595,"depth":72,"text":598},"markdown","content:3.security.md","content","3.security.md","3.security","md",1787524877913]