72 lines
2.5 KiB
Markdown
72 lines
2.5 KiB
Markdown
# Container isolation
|
|
|
|
How HexaHost GameCloud isolates Minecraft server workloads on game nodes.
|
|
|
|
## Model
|
|
|
|
Each customer server runs as a **non-privileged Docker container** on a dedicated game node. The node-agent creates and manages containers; customers never receive Docker socket access.
|
|
|
|
```
|
|
Control plane (trusted) ──mTLS──► Node agent (trusted) ──► Game container (untrusted)
|
|
```
|
|
|
|
## Container hardening (target profile)
|
|
|
|
| Control | Setting |
|
|
|---------|---------|
|
|
| User | Non-root UID inside container |
|
|
| Privileges | `--privileged=false` |
|
|
| Capabilities | Drop ALL, add only required (none for vanilla Java) |
|
|
| seccomp | Docker default or custom profile (Phase 2) |
|
|
| AppArmor | Docker default profile |
|
|
| Network | Bridge network per server; no `host` network mode |
|
|
| Read-only root | Where compatible with selected software family |
|
|
| Memory / CPU | cgroup limits from plan slug |
|
|
| PIDs limit | Prevents fork bombs |
|
|
|
|
## Network isolation
|
|
|
|
- Game containers reach the internet for Minecraft auth and mod downloads only through controlled egress
|
|
- No route to control plane PostgreSQL, Redis, or internal APIs
|
|
- Node-agent management port (`9100`) bound to localhost or management VLAN only
|
|
|
|
See threat T05 and T12 in [threat model](threat-model.md).
|
|
|
|
## Storage isolation
|
|
|
|
- Per-server data directory on node disk: `/var/lib/hgc-node/servers/{serverId}/`
|
|
- Path traversal prevented server-side; symlinks rejected on archive extract
|
|
- Backups uploaded to object storage — not readable by other tenants
|
|
|
|
## Image policy
|
|
|
|
- Only catalog-approved runtime images (digest-pinned)
|
|
- Customers cannot push custom images
|
|
- Periodic image vulnerability scan in CI (Phase 9)
|
|
|
|
## Multi-tenant on one node
|
|
|
|
The scheduler enforces RAM and server count limits per node. There is no shared filesystem between server containers except the read-only image layers.
|
|
|
|
## Operator responsibilities
|
|
|
|
| Task | Frequency |
|
|
|------|-----------|
|
|
| Docker security updates on nodes | Monthly |
|
|
| Review AppArmor/seccomp profiles after Minecraft/Java major bumps | Per release |
|
|
| Audit `docker ps` for unexpected privileged containers | Weekly |
|
|
|
|
Bootstrap hardening via `deploy/ansible/game-node.yml`.
|
|
|
|
## Verification
|
|
|
|
- Attempt cross-container network scan from test server (should fail to reach agent port)
|
|
- Confirm `docker inspect` shows `Privileged: false`
|
|
- Penetration test before production go-live
|
|
|
|
## Related
|
|
|
|
- [Threat model](threat-model.md)
|
|
- [Game node operations](../operations/game-node.md)
|
|
- [Secrets](secrets.md)
|