clusterflux-public/docs/security.md

Security model

Disasmer runs untrusted project code as WebAssembly on attached nodes. Wasm is the isolation substrate; access to host operations is the capability boundary. Running a Wasm module alone does not grant commands, containers, source access, artifact access, networking, or coordinator authority.

Authority lanes

• Client requests use an authenticated session scoped to one user, tenant, and project.
• Nodes and non-interactive agents use Ed25519 request signatures, bounded timestamps, unique nonces, and explicitly scoped enrollment grants.
• Identity requests create and poll browser-login transactions. The hosted callback exchanges the authorization code with Authentik and obtains identity from its authenticated user-info endpoint; the CLI cannot supply trusted identity claims.
• Hosted Operator requests use a separate private credential and replay-safe proof. They are not Client protocol variants authorized by convention.

The coordinator uses its own clock for expiry, quota windows, and policy decisions. Quota meters are keyed by tenant, project, resource kind, and window. Client-provided actor or scope strings are not authority. Replay windows, login/enrollment transactions, task and debug histories, downloads, and artifact metadata all have explicit expiry or count bounds scoped to their authority or project/process object.

Transport and secrets

Remote control traffic must use HTTPS and follows normal certificate validation. Plain JSON-lines TCP and HTTP are restricted to loopback and require an explicit local-development mode on the coordinator. The hosted deployment terminates TLS at its reverse proxy and forwards only to a loopback service.

Node keys are generated from operating-system randomness. Local credential directories and files use Unix modes 0700 and 0600, reject symbolic-link paths, and are written atomically without overwriting an existing credential. Environment-provided keys remain the operator's storage responsibility.

Trust boundary

Rootless Podman is a useful additional containment and environment mechanism on Linux nodes, but it does not turn a denied host operation into an allowed one. Native commands require an explicit environment, cwd, bounded environment map, wall-clock timeout, output mount, and network policy. Linux container commands run with resource and process-count limits, no-new-privileges, and dropped capabilities; Wasmtime stores independently enforce memory/table/instance and fuel bounds. A limit failure is a bounded task failure and does not terminate the node daemon. Node operators decide which projects they trust and which host capabilities a node advertises. The community hosted service does not provide arbitrary hosted native execution; users attach their own nodes for real work.

Report vulnerabilities according to SECURITY.md.