Skip to content

feat: hardened proxy-honoring runtime image for the Isolated tier #22

Open
Open
feat: hardened proxy-honoring runtime image for the Isolated tier#22
Labels
enhancementNew feature or request

Description

@imneov
imneov
opened on Jul 17, 2026

What

ADR-0003 requires the Isolated tier's runtime image to honor HTTP_PROXY/HTTPS_PROXY without bypass paths and to fail closed when the proxy is unreachable (no direct-connect fallback, no proxy-ignoring socket libraries; every bundled tool/SDK audited for proxy-honoring behavior).

The v1 series (#8 / PR #21) enforces egress at the env-injection layer and — per the PR #21 adjudication — restricts isolated instances to the platform default image. But the platform default (openclaw-lite / hermes-lite) is not yet hardened to the ADR-0003 standard. Until this image exists, the tier's egress guarantee rests on env-level enforcement only.

Acceptance criteria

  • An isolated-tier image variant that honors proxy env for all bundled tools/SDKs (audit list documented)
  • Fail-closed behavior verified: with the proxy unreachable, outbound HTTP(S) fails rather than falling back to direct connection
  • Image wired as the isolated-mode platform default; version pinned
  • Verification evidence (in-cluster test with proxy up vs down)

Blocked by

None — parallel to the ClawManager backend track; #8 ships env-level enforcement first.

Refs

ADR-0003, spec #11 (Egress enforcement), PR #21 review adjudication.

Activity

  1. imneov
    added
    enhancementNew feature or request
    on Jul 17, 2026

  2. imneov commented on Jul 17, 2026

    @imneov
    imneov
    on Jul 17, 2026
    Author

    Feasibility recon (read-only, 2026-07-17)

    Where the images are built: NOT in this repo. The root Dockerfile builds the ClawManager app image (server + frontend on nginx). The lite runtime images come from ghcr.io/yuan-lab-llm/agentsruntime/openclaw-lite:latest and .../hermes-lite:latest (defaults in backend/internal/config/config.go:285-286, migration 034, deployments/k8s/clawmanager-apply.sh:14-15). The only runtime-adjacent Dockerfile here is deployments/hermes-runtime/Dockerfile.tui-dist — a TUI asset build on an external Hermes base, not the lite image chain. Conclusion: the hardening work lands in the external agentsruntime image pipeline (or wherever those GHCR tags are produced).

    Known outbound-capable contents (repo evidence): OpenClaw CLI (gateway run), Hermes Python venv runtime, node/npm in the Hermes derivative. Full tool inventory (curl/git/SDKs) unconfirmed — needs docker pull + audit of the actual images.

    Relevant platform fact: the "egress proxy" endpoint today is the ClawManager app itself (service port 3128 → app port 9001, plain HTTP + HTTPS CONNECT in egress_proxy_handler.go) — consistent with spec #11's named v1.x follow-on to harden the trust-all proxy.

    Recommended path:

    1. Confirm ownership/access to the agentsruntime image build repo (blocking question).
    2. First increment there: fail-closed entrypoint wrapper (verify proxy reachability before exec; export proxy env process-wide) + drop/limit proxy-ignoring tools.
    3. Then the ADR-0003 tool-by-tool proxy-honoring audit, with an in-cluster proxy-up/proxy-down verification harness.

    Blocked on: access to the image build pipeline — needs an owner decision.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions