Universalsandboxing
Put every inbound session in its own container, before anything is known about it.
Every session is containerised on connect. Not the suspicious ones. Every one. The safe execution boundary is not something switched on once a connection starts to look bad, because by then the interesting part has already happened.
Each container comes up on two networks. mgmt_net carries the SSH or HTTP session itself. backend_net is how the session reaches the real MySQL, Redis and internal API. Keeping those separate from the first moment is what makes L4 possible at all. You cannot hot-swap a backend network that was never a distinct network.
This is the layer that pays for the rest of the design. It costs a container per session whether or not that session ever does anything wrong.
- Session opened by L0
- Prior
- Per-session container
- mgmt_net attached
- backend_net attached
Rules this layer holds to
Each of these is written down because relaxing it would be locally convenient and globally wrong.
Containerising everything has a real cost in memory and startup latency. That cost is the price of the conversion mechanism, and it is paid on benign sessions too.