ADR 0169: the firewall seat serves its verbs, and a foreign rule set is removed through one of them #285

2026-10-02T11:28:11Z

mesh-admin commented

2026-10-02 11:28:11 +00:00

Extends ADR 0168. The node-packet-filter seat serves rules, reload and remove; every holder implements them; a holder may add its own tools; a container may declare a capability; 0168's "by hand" is read as "by the operator, through the seat". Designs 33 and 08 revised; index regenerated; checks pass. Built on the matching branches in mesh-host (capabilities), mesh-controller (the seat's verbs) and mesh-catalog (the nftables module's runtime and verbs).

Extends ADR 0168. The `node-packet-filter` seat serves `rules`, `reload` and `remove`; every holder implements them; a holder may add its own tools; a container may declare a capability; 0168's "by hand" is read as "by the operator, through the seat". Designs 33 and 08 revised; index regenerated; checks pass. Built on the matching branches in mesh-host (capabilities), mesh-controller (the seat's verbs) and mesh-catalog (the nftables module's runtime and verbs).

mesh-admin added 1 commit 2026-10-02 11:28:11 +00:00

ADR 0169: the firewall seat serves its verbs, and a foreign rule set is removed through one of them 4567e13071

Designs 33 and 08 revised. The first node-scoped seat with verbs: rules,
reload, remove; the nftables module holds it from a runtime with NET_ADMIN,
the first container to declare a capability.

mesh-admin merged commit bf0ee7cb25 into main

2026-10-02 11:29:15 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#285