andrewgu-oai f3741880f6
Harden managed proxy listener handoff ( #40999 ) ...
## Why
Linux managed networking routed proxy connections through filesystem-backed Unix sockets, requiring an extra readable sandbox path and stale socket cleanup.
## What changed
- Transfer loopback TCP listeners from the sandbox namespace to host bridge processes over anonymous Unix socket pairs.
- Validate transferred descriptors, keep bootstrap channels private to each sandbox launch, and close them before running untrusted commands.
- Tie proxy bridge lifetime to the sandbox so cancellation closes active upstream connections.
## Testing
- Cover descriptor validation and interrupted handoffs.
- Verify concurrent sandboxes keep proxy endpoints isolated and do not inherit privileged sockets.
- Exercise managed networking end to end through `app-server`, confirming proxied access succeeds while direct host access remains blocked.
GitOrigin-RevId: 6561e09c83b927c604951bf2aa00ff532d179da5
2026-08-26 23:41:18 +00:00
2026-07-29 13:53:15 +00:00
2026-07-23 19:19:35 +00:00
2026-07-21 22:44:43 +00:00
2026-08-24 22:40:35 +00:00
2026-08-26 21:39:05 +00:00
2026-07-29 13:53:15 +00:00
2026-08-26 23:41:18 +00:00
2026-08-18 23:05:52 +00:00
2026-07-21 08:50:21 +00:00
2026-08-26 22:37:59 +00:00
2026-07-30 19:47:30 +00:00
2026-08-25 03:08:33 +00:00
2026-08-24 21:39:48 +00:00
2026-08-20 08:10:08 +00:00
2026-08-25 07:37:42 +00:00
2026-08-24 21:39:48 +00:00
2026-08-20 19:28:32 +00:00
2026-08-11 03:39:02 +00:00
2026-08-14 05:03:39 +00:00
2026-08-17 22:37:14 +00:00
2026-08-26 19:02:02 +00:00
2026-08-25 16:38:46 +00:00
2026-08-25 21:34:05 +00:00
2026-07-21 08:28:51 +00:00
2026-08-25 20:37:15 +00:00
2026-08-26 02:49:51 +00:00
2026-08-25 20:37:15 +00:00
2026-08-21 16:50:34 +00:00
2026-08-26 18:42:44 +00:00
2026-08-18 23:47:00 +00:00
2026-08-13 23:13:37 +00:00
2026-08-25 21:20:51 +00:00
2026-08-26 22:54:10 +00:00
2026-08-04 22:58:02 +00:00
2026-08-26 19:31:52 +00:00
2026-08-07 00:23:38 +00:00
2026-08-23 18:53:15 +00:00
2026-08-26 23:05:08 +00:00
2026-08-25 21:20:51 +00:00
2026-08-26 22:58:54 +00:00
2026-08-07 11:30:17 +00:00
2026-08-13 00:00:16 +00:00
2026-08-26 18:42:44 +00:00
2026-08-26 22:54:10 +00:00
2026-08-25 23:38:49 +00:00
2026-08-17 04:37:50 +00:00
2026-08-26 22:10:47 +00:00
2026-08-26 15:02:21 +00:00
2026-08-26 23:05:08 +00:00
2026-08-18 21:46:18 +00:00
2026-07-31 21:37:56 +00:00
2026-08-25 18:04:01 +00:00
2026-08-25 21:34:05 +00:00
2026-08-25 01:03:20 +00:00
2026-08-25 10:29:26 +00:00
2026-08-17 00:09:44 +00:00
2026-08-10 22:12:14 +00:00
2026-08-26 23:41:18 +00:00
2026-07-22 04:17:34 +00:00
2026-08-25 21:08:22 +00:00
2026-08-26 21:39:05 +00:00
2026-08-26 15:02:21 +00:00
2026-07-17 20:52:42 +00:00
2026-08-24 21:39:48 +00:00
2026-08-26 14:36:48 +00:00
2026-08-24 21:39:48 +00:00
2026-08-25 18:41:03 +00:00
2026-07-30 04:26:36 +00:00
2026-08-25 22:46:49 +00:00
2026-08-21 21:01:59 +00:00
2026-08-25 15:50:19 +00:00
2026-08-26 22:37:59 +00:00
2026-08-26 17:45:42 +00:00
2026-08-21 16:45:05 +00:00
2026-08-25 23:51:57 +00:00
2026-08-26 22:37:59 +00:00
2026-08-24 17:07:21 +00:00
2026-08-26 19:38:42 +00:00
2026-08-10 15:43:10 +00:00
2026-08-20 17:39:06 +00:00
2026-08-08 16:58:26 +00:00
2026-08-20 06:10:03 +00:00
2026-08-26 22:37:59 +00:00
2026-08-04 03:49:53 +00:00
2026-08-20 18:29:35 +00:00
2026-08-26 22:37:59 +00:00
2026-08-26 19:59:08 +00:00
2026-08-26 21:52:56 +00:00
2026-08-25 23:42:50 +00:00
2026-07-22 16:18:08 +00:00
2026-08-20 14:55:08 +00:00
2026-08-26 21:52:56 +00:00
2026-08-15 14:31:04 +00:00
2026-08-25 21:44:43 +00:00
2026-07-09 17:31:44 -07:00
2026-08-26 23:41:18 +00:00
2026-08-25 21:34:05 +00:00
2026-07-28 20:49:22 +00:00
2026-07-11 03:27:51 +00:00
2026-07-29 13:53:15 +00:00
2026-08-18 22:00:25 +00:00
andrewgu-oai
f3741880f6