Commit 921868375e
921868375ec083ab40bfc4bdc77010cd9e80bec3
parent: 9f309aef9c
Verified · cmc ci/build: success ci/test: success
cmc <hello@cleberg.net> · 2026-09-29 04:28 UTC
wiki: build egress measured on bay1
Closes #260
Layout: unified · split
.gitbay/wiki/Architecture/09-Controls.org
+1 −1
| @@ -88,7 +88,7 @@ chapter names of OWASP ASVS 4.0 where one fits. |
| 88 | 88 | | No secrets for untrusted builds | in place | =internal/control/build.go= | |
| 89 | 89 | | Runner limited to attached repositories | in place | =runnerMayBuild= (=build.go=) | |
| 90 | 90 | | Build images fixed by the operator | in place | =--pull=never= | |
| 91 | | | Build network egress restricted | partial | by build cgroup (=gitbay-runner-builds.nft=): host loopback (but DNS) and private ranges closed; trusted: host public 22/80/443, internet open by decision; untrusted: internet TCP 80/443 and DNS only. Not yet measured from a build (#260) | |
| 91 | | Build network egress restricted | in place | by build cgroup (=gitbay-runner-builds.nft=): host loopback (but DNS) and private ranges closed; trusted: host public 22/80/443, internet open by decision; untrusted: internet TCP 80/443 and DNS only. measured on bay1 2026-09-29 (CI page) | |
| 92 | 92 | | Build results reused only across equal trust | in place | =SuccessBuildForTree=, =SuccessBuildFor= (=internal/store/builds.go=) | |
| 93 | 93 | |
| 94 | 94 | ** Availability and operations |
.gitbay/wiki/Architecture/10-Known-Gaps.org
−2
| @@ -11,7 +11,6 @@ what the 2026-09-27 review found; remove a row when its issue closes. |
| 11 | 11 | | Issue | Area | Gap | Severity | |
| 12 | 12 | |-------+------------------+-----------------------------------------------------------------------+----------| |
| 13 | 13 | | #259 | Recovery | No restore has been exercised; the procedure and tooling (=admin restore-drill=, =backup --verify=) are in place, the clean-host drill is pending | high | |
| 14 | | | #260 | CI network | Separation and egress tables written; not yet measured from a build on bay1 (=deploy/runner-auth-flood-test.sh=) | medium | |
| 15 | 14 | | #261 | Various | Migration foreign-key check after commit; three web writes bypass dispatch; documentation drift | medium | |
| 16 | 15 | |
| 17 | 16 | * Not filed |
| @@ -30,5 +29,4 @@ what the 2026-09-27 review found; remove a row when its issue closes. |
| 30 | 29 | |-----------------------------------------------------------+------------------------------------------| |
| 31 | 30 | | What is the measured recovery time? | unmeasured (#259) | |
| 32 | 31 | | How many concurrent clones does the host sustain? | unmeasured (#262) | |
| 33 | | | What can a build reach on the host's network? | policy on the CI page; reachability untested until the flood test runs (#260) | |
| 34 | 32 | | Have the collaboration features been used by independent users? | no; one human user, tests only | |
.gitbay/wiki/CI.org
+23
| @@ -101,6 +101,29 @@ until the limiter locks its address, and the script checks that the |
| 101 | 101 | runner still reported the build and kept polling, and that the build's |
| 102 | 102 | log shows what the table allowed and refused. |
| 103 | 103 | |
| 104 | ** Measured on bay1 |
| 105 | |
| 106 | 2026-09-29, runner and daemon at 8b73af2, kernel 6.12.107, nftables |
| 107 | 1.1.3, podman 5.4.2, the runner scoped to =cmc/runner-scratch=. pasta |
| 108 | ran in the build's cgroup both times |
| 109 | (=builds/trusted/build-2144=, =builds/untrusted/build-2146=). Both runs |
| 110 | passed. |
| 111 | |
| 112 | | Probe | trusted | untrusted | |
| 113 | |----------------------+------------------+------------------| |
| 114 | | DNS | ok | ok | |
| 115 | | 169.254.1.2:22/80/443 | open | refused | |
| 116 | | 169.254.1.2:2222 | refused | refused | |
| 117 | | 10.0.0.1:80, 192.168.0.1:80 | refused | refused | |
| 118 | | proxy.golang.org:443 | open | open | |
| 119 | | github.com:22 | open | refused | |
| 120 | | 12 logins | 12 denied (sshd) | 12 refused (table) | |
| 121 | |
| 122 | The trusted build's logins arrived from the host's public address, |
| 123 | 46.232.248.67: ten =auth.expired= and one =auth.throttled= for it, none |
| 124 | for =127.0.0.1=. The untrusted build's logins never reached sshd. The |
| 125 | runner kept polling through both builds. |
| 126 | |
| 104 | 127 | * The table |
| 105 | 128 | |
| 106 | 129 | One =ci.yml= with five jobs, each isolating one rule: |