nucleus-container 0.3.3

Extremely lightweight Docker alternative for agents and production services — isolated execution using cgroups, namespaces, seccomp, Landlock, and gVisor
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93

use super::{netns, BridgeNetwork, EgressPolicy};
use crate::error::{NucleusError, Result};
use tracing::{debug, info};

pub(crate) fn apply_egress_policy(
    pid: u32,
    dns: &[String],
    policy: &EgressPolicy,
    join_userns: bool,
) -> Result<()> {
    for cidr in &policy.allowed_cidrs {
        crate::network::config::validate_egress_cidr(cidr)
            .map_err(|e| NucleusError::NetworkError(format!("Invalid egress CIDR: {}", e)))?;
    }

    let ipt = BridgeNetwork::resolve_bin("iptables")?;
    let exec = |args: &[&str]| {
        if join_userns {
            netns::exec_in_user_netns(pid, &ipt, args)
        } else {
            netns::exec_in_netns(pid, &ipt, args)
        }
    };

    exec(&["-P", "OUTPUT", "DROP"])?;
    exec(&["-F", "OUTPUT"])?;
    exec(&["-A", "OUTPUT", "-o", "lo", "-j", "ACCEPT"])?;
    exec(&[
        "-A",
        "OUTPUT",
        "-m",
        "conntrack",
        "--ctstate",
        "ESTABLISHED,RELATED",
        "-j",
        "ACCEPT",
    ])?;

    if policy.allow_dns {
        for dns in dns {
            exec(&[
                "-A", "OUTPUT", "-p", "udp", "-d", dns, "--dport", "53", "-j", "ACCEPT",
            ])?;
            exec(&[
                "-A", "OUTPUT", "-p", "tcp", "-d", dns, "--dport", "53", "-j", "ACCEPT",
            ])?;
        }
    }

    for cidr in &policy.allowed_cidrs {
        if policy.allowed_tcp_ports.is_empty() && policy.allowed_udp_ports.is_empty() {
            exec(&["-A", "OUTPUT", "-d", cidr, "-j", "ACCEPT"])?;
        } else {
            for port in &policy.allowed_tcp_ports {
                let port_s = port.to_string();
                exec(&[
                    "-A", "OUTPUT", "-p", "tcp", "-d", cidr, "--dport", &port_s, "-j", "ACCEPT",
                ])?;
            }
            for port in &policy.allowed_udp_ports {
                let port_s = port.to_string();
                exec(&[
                    "-A", "OUTPUT", "-p", "udp", "-d", cidr, "--dport", &port_s, "-j", "ACCEPT",
                ])?;
            }
        }
    }

    if policy.log_denied {
        exec(&[
            "-A",
            "OUTPUT",
            "-m",
            "limit",
            "--limit",
            "5/min",
            "-j",
            "LOG",
            "--log-prefix",
            "nucleus-egress-denied: ",
        ])?;
    }

    exec(&["-P", "OUTPUT", "DROP"])?;

    info!(
        "Egress policy applied: {} allowed CIDRs",
        policy.allowed_cidrs.len()
    );
    debug!("Egress policy details: {:?}", policy);

    Ok(())
}