Appendix
Hardening Reference
Sandbox pod settings and served-app headers, as tables
Sandbox pod settings and served-app response settings, presented as tables.
#Sandbox pods
Applied to every sandbox on every island.
| Setting | Value | Effect |
|---|---|---|
runtimeClassName | The Kata runtime class | Each pod is a microVM with its own guest kernel |
| Kata runtime annotations | Guest seccomp on; sandbox cgroup anchored | The seccomp profile applies inside the VM; the VM survives host cgroup reclaim |
securityContext.seccompProfile | RuntimeDefault | Default syscall filter |
securityContext.capabilities | drop: [ALL] | No Linux capabilities |
securityContext.allowPrivilegeEscalation | false | No setuid escalation |
automountServiceAccountToken | false | No Kubernetes credential in the pod |
dnsPolicy and dnsConfig | None, public resolvers | Cluster-internal names do not resolve |
restartPolicy | Never | A dead sandbox is replaced, not restarted in place |
activeDeadlineSeconds | 24 hours for release sandboxes; 1 hour for job runners; 12 hours for dev boxes | Kubernetes hard-kills a wedged pod |
imagePullPolicy | Always | Every start re-checks the image digest |
| Resource requests and limits | Per island | Bounded CPU and memory |
NODE_OPTIONS on the worker | Heap capped beneath the memory limit | A heap runaway fails inside the pod before the pod's limit |
| Labels | app, island, pool, tier, release, app id, role, source, origin, job | What the egress policy and every janitor select on |
| Files | ConfigMap named after the pod, owned by it | Garbage-collected with the pod; nothing written into a running sandbox |
| Egress | NetworkPolicy: internet only; every private range denied | No path to platform-internal addresses |
| Node group | Encrypted root volumes; nested virtualization; IMDS hop limit | Node-level hardening under every sandbox |
Worker-side timings, injected as environment:
| Clock | Value |
|---|---|
| Unclaimed max age | 4 hours |
| Assigned idle | 30 minutes |
| Handler timeout | 30 minutes |
| Background cutoff | 30 minutes |
| Shutdown drain | 25 seconds |
| Job runner wallclock | 55 minutes |
| Dev box ready timeout | 10 minutes |
| Dev box termination grace | 90 seconds |
#Served apps
Set by the serving layer and the auth helpers.
| Header or attribute | Value | Applies to |
|---|---|---|
X-Content-Type-Options | nosniff | Every response |
Referrer-Policy | strict-origin-when-cross-origin | Every response |
Content-Security-Policy | frame-ancestors <declared origins> | Apps that declare embedding origins |
X-Robots-Tag | noindex, nofollow | Gated and preview surfaces |
Cache-Control | private, no-cache | Session HTML |
Cache-Control | public, max-age=86400, immutable | Content-addressed assets |
| HTTPS redirect | At the edge, before any other handling | Every hostname |
X-Powered-By | Not sent | Every response |
| Session cookie | HttpOnly; Secure in production; same-site policy strict unless embedded; per-app signature; 30-day expiry; issue time recorded | App sessions |
| Origins | One per app; a cookieless files domain; separate CDN hosts; a separate dev preview apex | Every app |
#Platform ingress
| Setting | Value |
|---|---|
| ALB listener | 443 with ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04; 80 redirects to 443 |
| ALB targets | Pod IPs |
| Node security group | Ingress from inside the VPC only |
| Node public IPs | None |
| Untrusted API endpoint | Private |
| Peering rules | Worker port, dev-box port, 443 to the API; trusted to untrusted only |
| Bastions | SSM-managed, no public IP, no inbound SSH |