Skip to content

Releases

v0.2.0

v0.2.0 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Nov 21:09
v0.2.0
c69acc7

Full Changelog: v0.1.0...v0.2.0

Assets 7
Loading

v0.1.0

v0.1.0

Choose a tag to compare

View all tags
@humanetresearch humanetresearch released this 11 Nov 19:58
v0.1.0
fe5be39

First public release of Humanet sandbox-check — a zero-dependency Go CLI that verifies sandbox isolation from inside a container, pod, or microVM and exits 2 on any detected isolation gap.

Included Checks

  • Cloud IMDS (Proxy: nil): 169.254.169.254 (AWS v1, AWS IMDSv2 PUT token, Azure /metadata/instance, GCP /computeMetadata/v1/), ECS 169.254.170.2, AWS IPv6 [fd00:ec2::254], Alibaba 100.100.100.200 (response bodies never printed or stored).
  • Proxy Bypass & SSRF: raw UDP:53 DNS tunneling, direct TCP:53/443, and HTTP_PROXY SSRF checking against IMDS IPv4 and 127.0.0.1:2375.
  • Host Gateway Services & Lateral: gateway + host.docker.internal checks (22, 80, 2375, 4222, 5432, 6379, 9000, 10250, 11434), RFC1918 / CGNAT, SMTP port 25, optional --peer.
  • Runtime Surface & Resource Limits: Linux capabilities (CapEff), seccomp mode, /proc/mounts (sockets, host binds, rw shared cgroup v2), /proc/kcore / sysrq-trigger / core_pattern, socket & /dev/{kvm,mem} checks (microVM kernel-aware), cgroup v2 (memory.max, pids.max, cpu.max) vs hypervisor VM limits.
  • Env Secrets: detects raw API keys/secrets without leaking values while recognizing placeholder tokens (phm_*, phantom_*, vault:*, op://*).

Verified Benchmark Snapshot (Cloud Linux KVM Host)

  • Docker default: 12 fails (critical=2, high=9, exit 2) — Cloud IMDS HTTP 200, UDP:53 open, TCP:443 open, host :22/:80 open, 6 caps, memory.max=max, raw secret
  • Docker + Naive HTTP_PROXY: 13 fails, 1 warn (critical=5, high=8, exit 2) — DNS tunnel bypass + proxy SSRF HTTP 200 on IMDS + 502 loopback warn
  • Docker hardened (--user 65532:65532 --cap-drop=ALL --security-opt=no-new-privileges --read-only --memory=256m --cpus=1 --pids-limit=128): 10 fails (critical=2, high=7, exit 2)
  • Docker --network=none (hardened): 0 fails (26/26 active pass + 1 INFO baseline, exit 0, zero network egress)
  • Frame Firecracker microVM (jailed microVM + host L3 firewall + allowlisted egress proxy + placeholder token): 37/37 active checks pass + 1 INFO baseline (0 fails, 0 warns, exit 0) + IMDS/loopback SSRF explicit 403 + allowlisted HTTPS check HTTP 200

Note: Every run includes 1 informational record (baseline_network_posture, status INFO) documenting network posture so offline environments are not confused with filtered ones. Passing active checks covers tested workload-side controls only and does not substitute for an independent penetration test.

Full methodology, Docker baseline commands, raw Docker JSON outputs, and scope limits: benchmark/REPORT.md.

Loading