Module isolation 

Node-side isolation: run provider sessions as an unprivileged user, and apply the egress kill-switch rendered by hatchery_enroll::KillSwitch. Linux/Unix only; both are opt-in and fail closed (a requested isolation that cannot be set up stops the node).

Enums

IsolationError

Functions

apply_kill_switch

Install the kill-switch with nft (preferred) or iptables-restore; verify afterwards.

drop_privileges

drop-privileges --user USER -- program args... (run as root, once, before the long-lived node starts). The program runs as USER with: no_new_privs (no su/sudo/setuid escalation), a capability bounding set of only CAP_SETUID and CAP_SETGID (so it can start sessions as another user with exec-as, but can never gain CAP_NET_ADMIN, so the tunnel and the kill-switch installed earlier by net-up stay out of its reach), and those two capabilities as ambient.

exec_as

exec-as USER -- program args...: drop to USER (groups, gid, uid), prove the drop cannot be undone, set HOME/USER/LOGNAME, and exec. Never returns on success.

net_up

net-up --enroll-state DIR [--wg-key FILE] [--interface hatch0] [--kill-switch] (root): bring up the kernel WireGuard interface from the enrolled state and optionally install the egress kill-switch. After this the long-lived node can run unprivileged with --no-wg, and the WireGuard private key can live in a root-only place the node never reads.

run_as

set_run_as

Validate and remember the unprivileged user for provider sessions.

wrap_registry

Make every catalog launcher start through <node> exec-as USER -- <program> <args>. The version probe keeps using the original catalog, so only spawned sessions change.