ADR 0100: the machine's own traffic is known by its interface, not its source address

2026-09-22 16:35:25 +02:00
parent 37252f9c3e
commit 3d4ab23830
2 changed files with 4 additions and 2 deletions
@@ -118,7 +118,8 @@ everything by default and holds nothing but refusals, and the two ports it refus
 foundation's own, checked free at genesis, so it cannot close anything the machine serves; it is
 the mesh's, so the found firewall reloading does not touch it. It refuses the store's port and the
 broker's management port except from the private network and from the machine itself — its
-loopback and the container runtime's own networks — at the prerouting hook, ahead of the runtime's
+loopback and the container runtime's own networks, known by the interface a packet arrives on and
+never by its source address alone — at the prerouting hook, ahead of the runtime's
 destination translation, so it matches the port the packet was sent to, for both address
 families. The bus and the registry stay reachable from anywhere, as a node
 enrols over the bus and pulls from the registry before it has a private-network address