Security & networking

​

Non-root execution

• pod_non_root (boolean, default false): Run the Pod as non-root (UID/GID/FSGroup 65532). Applies pod-wide filesystem ownership.
• container_non_root (boolean, default false): Run the main container as non-root (UID 65532) and disallow privilege escalation.

• Enable both flags for consistent non-root behavior and fewer permission surprises when writing to volumes.
• Some package managers (e.g., Alpine apk add) require root. To run apk add inside the container, you have options:
  • Use before_script with a base image that already includes needed tools, or
  • Temporarily run the main container with root by leaving container_non_root disabled for setup, or
  • Build a custom image with dependencies pre-installed (recommended for production reproducibility).

{
  "name": "nr-example",
  "image": "alpine:latest",
  "pod_non_root": true,
  "container_non_root": true
}

{
  "name": "setup-then-lock",
  "image": "alpine:latest",
  "before_script": "apk add --no-cache curl git",
  "egress_whitelist": ["203.0.113.0/24"]
}

​

Linux capabilities

• cap_drop (string[]): Capabilities to drop. If omitted, ALL is dropped by default.
• cap_add (string[]): Capabilities to add back.
• allow_privilege_escalation: always set to false.
• Seccomp profile: RuntimeDefault.

{
  "name": "caps-minimal",
  "image": "alpine:latest",
  "cap_add": ["CHOWN"],
  "cap_drop": null
}

{
  "name": "caps-custom",
  "image": "alpine:latest",
  "cap_drop": ["NET_RAW"],
  "cap_add": []
}

​

Common capability requirements

{
  "name": "install-packages",
  "image": "ubuntu:22.04",
  "cap_add": ["SETUID", "SETGID", "CHOWN", "DAC_OVERRIDE"],
  "before_script": "apt-get update && apt-get install -y git curl"
}

• SETUID/SETGID: Required for package managers to drop privileges during installation
• CHOWN: Needed for changing file ownership during package installation
• DAC_OVERRIDE: Allows bypassing file permission checks (needed for installing packages)

{
  "name": "alpine-packages",
  "image": "alpine:latest",
  "cap_add": ["SETUID", "SETGID", "CHOWN"],
  "before_script": "apk add --no-cache git curl"
}

{
  "name": "file-ops",
  "image": "alpine:latest",
  "cap_add": ["CHOWN", "FOWNER"],
  "before_script": "chown -R user:group /some/path"
}

{
  "name": "network-tools",
  "image": "alpine:latest",
  "cap_add": ["NET_RAW", "NET_ADMIN"]
}

​

Network isolation and egress lockdown

​

Platform isolation (always on, Cilium)

​

Ingress isolation (Default: deny all, opt-in per sandbox)

• Ingress blocking: VM sandboxes cannot communicate with each other unless a port is opened
• Administrative access preserved: kubectl exec and k7 shell still work normally (they use the Kubernetes API, not pod networking)
• System services allowed: Traffic from kube-system namespace is permitted for cluster functionality

{
  "name": "api",
  "image": "python:3.12-slim",
  "ingress_ports": [8000],
  "ingress_from": ["sandbox:frontend", "namespace:team-a"]
}

{
  "name": "web",
  "image": "python:3.12-slim",
  "ingress_ports": [8000],
  "ingress_from": ["cidr:203.0.113.0/24"],
  "expose_ports": [8000]
}

• ingress_ports without ingress_from = reachable from other sandboxes in the same namespace only. Reaching a sandbox from anywhere requires "cidr:0.0.0.0/0", spelled out.
• Every entry in expose_ports must also be in ingress_ports; the NodePort Service uses externalTrafficPolicy: Local so the pod sees the real client IP, and only answers on the node running the sandbox. The allocated NodePorts come back as node_ports on list / get.
• ingress_from without ingress_ports, an unknown source prefix, or an expose_ports entry missing from ingress_ports is a 400.

​

Egress lockdown and whitelisting

• Omit egress_whitelist: egress open (external internet allowed).
• []: full egress block (no DNS resolution; no outbound IPs).
• ["CIDR", ...]: allow only listed CIDR blocks; DNS is blocked.

{ "name": "fully-isolated", "image": "alpine:latest", "egress_whitelist": [] }

{ "name": "partial-isolation", "image": "alpine:latest" }

{
  "name": "egress-restricted",
  "image": "alpine:latest",
  "egress_whitelist": ["10.0.0.5/32"]
}

​

Mitigations when DNS is blocked

• Use IP/CIDR whitelisting only (no domains post-lockdown)
• Pre-resolve/fetch in before_script (runs before lockdown with open egress)
• If you must allow DNS temporarily, consider an operational override at cluster level (not provided by K7 config)

​

API key namespace scope

• Listed namespaces only — another namespace returns 403 Forbidden.
• All-namespaces list / GC (namespace omitted or all_namespaces=true) is denied for scoped keys.
• Cluster-scoped reads (GET /api/v1/nodes/storage) are denied for scoped keys too.
• Keys without a scope keep full cross-namespace access.

​

Transport

​

docker: true

​

Image registry allowlist (SSRF)