fix(network): bind hostname policy to supervisor DNS

[alangou]

Summary

Bind hostname-based network policy to supervisor-controlled DNS while preserving sandbox host aliases for independently IP-constrained destinations.

Related Issue

Tracked through the private security review process.

Changes

• Separate hostname-authorized and IP-constrained resolution paths.
• Keep sandbox host aliases behind explicit IP validation or a trusted gateway pin.
• Add regression coverage and clarify the operator guidance.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated
• E2E tests added/updated (existing relevant suite)

Validated with the full openshell-supervisor-network test suite, targeted regression coverage, Clippy, rustfmt, docs validation, and the Docker corporate-proxy E2E suite.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4602.docs.buildwithfern.com/openshell

[github-actions]

Label test:e2e applied, but pull-request/4602 does not exist yet. A maintainer needs to comment /ok to test 48da2fe7407ea4c9ac0eb83e2b23b24f257c63ca to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[alangou]

/ok to test 48da2fe

[github-actions]

Compatibility review (advisory)

Unaddressed breaking changes

Existing Linux policies that rely on sandbox /etc/hosts or Kubernetes hostAliases without allowed_ips can stop reaching their configured endpoints. This stable runtime-policy break is not permitted in the v0.1.5 patch train.

1. policy — NOT ACKED

Hostname-authorized endpoints previously resolved through sandbox /etc/hosts, but now ignore those entries unless the endpoint has allowed_ips or a trusted IP pin.

• Impact: Existing exact-host and other hostname-based policies relying on Kubernetes hostAliases may fail DNS resolution or connect to supervisor-resolved addresses instead of the configured alias.
• Action: Restore sandbox-host resolution for existing policies in v0.1.5, or defer the restriction to a break-permitting train with notice and guidance to add a narrow allowed_ips entry for each alias.
• PR: fix(network): bind hostname policy to supervisor DNS #4602

Review details

• Execution: complete
• Candidate: PR #4602 (175f6aca189e20b14072edc75b3aa0e3f70c4580)
• Baseline: 05050a6d644fdce0f4ac046ead6e2266256c4039 (05050a6d644fdce0f4ac046ead6e2266256c4039)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

[alangou]

gator-agent

PR Review Status

The independent code review found no blocking findings. Hostname-authorized destinations now use the supervisor resolver, while sandbox aliases remain available behind an independently checked IP allowlist or trusted gateway pin. The published docs and policy skill explain the changed requirements.

Branch Checks and E2E are running on the current head; Gator will monitor their results.

Blocking findings: None.

Carried findings: None.

Non-blocking suggestions: None.

Gator metadata

• Validation: Focused network-policy security fix from a verified repository administrator; DCO and vouch checks pass, with no merge conflict.
• Docs: Updated docs/security/best-practices.mdx and the policy-generation skill; no navigation change needed.
• Checks: Current-head Branch Checks pending; Helm Lint and Trivy Changes green. No local tests run during code review.
• E2E: test:e2e applied; current-head Branch E2E Checks running after the author's /ok to test dispatch. No additional test labels needed.
• Head SHA: 48da2fe7407ea4c9ac0eb83e2b23b24f257c63ca
• Base SHA: 05050a6d644fdce0f4ac046ead6e2266256c4039
• Merge base SHA: 6ab87ce6926e42ed739312ee3d9253725d9b7924
• Patch ID: 04522d24ce514d162f1613c3d7d604c53bbbbb4b
• Gator payload: 12
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:watch-pipeline

[alangou]

Acknowledged. This security fix intentionally changes resolution for sandbox-only host aliases without an independent IP constraint. Driver-managed host-gateway aliases remain supported through the trusted runtime pin. Custom aliases should add a narrow allowed_ips. I accept this compatibility tradeoff.

[alangou]

gator-agent

Monitoring Complete

Monitoring is complete because this PR has merged.

Final status: Gator had reached gator:merge-ready; the independent code review found no blocking findings.

I removed the active gator:* label because there is nothing left for gator to monitor on this PR.

Gator metadata

• Head SHA: 48da2fe7407ea4c9ac0eb83e2b23b24f257c63ca
• Gator payload: 12