Skip to content
RRCHNM Infra

Sandbox tier

The sandbox namespace hosts pods that process untrusted input or run untrusted code, hold no secrets, and get no LAN reach. Membership is decided by that invariant, not by what a workload is: the founding tenant is a browser-driven MCP server, but crawlers, link-checkers, and code-execution sandboxes belong here too — while an MCP server trusted with credentials does not (it goes in its own namespace, or vibes).

The admission test

One question:

If this workload were fully compromised by the content it processes, what could it reach?

If the honest answer needs a LAN allow or a mounted Secret, it doesn’t belong in the tier. (The Kata RuntimeClass plan sharpens this same test into a runtime decision — “which namespace” and “which kernel boundary” are converging questions.)

Hostnames keep the mcp domain. playwright.mcp.rrchnm.internal is unchanged — the namespace names the trust tier, the FQDN names the protocol. They are deliberately allowed to differ. The namespace was renamed from mcp in 2026-08 once it was clear the tier would outgrow one protocol.

Tenants (as of 2026-09)

ServiceStateNotes
playwright-mcplive (cutover 2026-07)upstream mcr.microsoft.com/playwright/mcp, digest-pinned; crash fix = real /dev/shm + memory limit
a11y-mcpdeferredstays on the docker fleet until its upstream Chromium leak is fixed
firecrawldeferredits self-hosted backend is already down

Served LAN-only via the internal Gateway. Isolation is a namespace-wide CiliumNetworkPolicy: DNS + public internet + the Gateways are allowed out; raw LAN, cluster services, and metadata endpoints are dropped (the SSRF guard), with narrowly-scoped per-pod exceptions. The rule-level table and its review provenance live beside the policy in the repo.

Public edge — retired (2026-08 security review)

The tier briefly had a public, IP-allowlisted edge (*.mcp.chnm.gmu.edu through the F5 → HAProxy → Caddy path). It was parked in the 2026-08 security review, together with a netpol correction (the old toEntities: world rule turned out to include off-cluster LAN IPs — since fixed).

Rationale: playwright is a real browser driven by LLM agents; a hostile page or an injected prompt makes the content untrusted regardless of who the client is. So the public edge — even IP-allowlisted — added exposure with no remaining use case, since every client is on the LAN/VPN. Access is now: LAN client → the internal Gateway (heimdall cert) → playwright.mcp.rrchnm.internal. External DNS and the wildcard-cert grant were left in place (harmless while nothing routes, and they make un-parking cheap); the reversal steps live in the repo README.

Heads-up for browsing *.rrchnm.internal sites from the pod: the pod’s Chromium does not trust the heimdall CA, so those loads fail ERR_CERT_AUTHORITY_INVALID until the rrchnm-root cert is baked into the image/NSS db (or the MCP runs with --ignore-https-errors, which would weaken public browsing too — prefer the CA).