Implement VM-scoped restricted registry transport

2026-10-07 04:04:32 -07:00
parent 1f7aa80130
commit 47fcb47d5c
10 changed files with 1051 additions and 5 deletions
@@ -91,3 +91,59 @@ proves that a component-only edit preserves a mixed package's service digest.
 Run `nix run .#camino-component-source-qualification` from the monorepo to
 materialize separate retained Git resources and compile an ordinary Nix candidate.
 This is a source/build qualification harness; it does not deploy a workspace.
+
+## Restricted execution in a workspace VM
+
+Add `service.restricted = true` to a checked portable package to select the pinned
+`workerd` executor. Generated bindings and the ordinary transaction-port protocol
+stay the same. All server exports must belong to one checked portable registry;
+remote exports and custom process services retain their ordinary VM execution
+path. The restricted build rejects Node imports and unresolved dependencies,
+and supplies an explicit SDK for value codecs, identities and declared graph ports.
+
+```nix
+service = {
+  restricted = true;
+  limits = {
+    deadlineMs = 4000;
+    maxBytes = 1048576;
+    maxPortCalls = 1000;
+    maxQueued = 8;
+  };
+};
+```
+
+Each invocation gets a fresh engine process. The adapter admits one active frame
+and a bounded FIFO; queue wait consumes the deadline. Overflow is an explicit
+`RESTRICTED_QUEUE_FULL` result. Cancellation kills the engine process group and
+removes its sockets before acknowledgement. All graph calls inherit the trusted
+invocation identity; authored code cannot choose another frame or workspace.
+Native graph grants and transaction commit remain enforced by Camino outside
+the guest. Initialization and synchronous loops are subject to the same deadline.
+
+Direct network access, native filesystem imports, ambient clock and entropy,
+parent environment credentials, and unlisted modules are denied. Explicit dates,
+`Intl.Segmenter`, deterministic hashes and normal JavaScript computation remain
+available. Host-managed HTTP bridges expose only the current frame's declared
+graph ports. Authored serialization is untrusted protocol input.
+
+This is an inner execution restriction, **not a hardened shared-process sandbox**.
+One workspace owns the surrounding VM. Systemd limits the entire package cgroup,
+including adapter and child engines; memory exhaustion terminates that group.
+No per-isolate memory protection is claimed. A guest user can control its VM,
+so authoritative graph grants and credentials must remain outside it.
+
+Qualification commands:
+
+```sh
+nix build .#checks.x86_64-linux.camino-restricted-execution
+nix build .#checks.x86_64-linux.camino-restricted-package-runners
+nix build .#checks.x86_64-linux.camino-restricted-execution-vm
+```
+
+The first uses the actual pinned engine for frame isolation, graph ports,
+SDK codecs, denied ambient access, cancellation and overload. The second runs
+ordinary package dispatch, rollback, PostgreSQL and browser replica tests with
+the restricted reader fixture. The VM check adds actual cgroup allocation
+exhaustion, neighboring-service survival, native socket egress rejection and
+fresh-frame timing. VM qualification is independent of hosted rollout.