Skip to content

docs: annotate ADR 0046 with allowed_ips validation results #5234

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
maruiz93 merged 1 commit into from
Jul 21, 2026
Merged

docs: annotate ADR 0046 with allowed_ips validation results #5234

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 19 additions & 4 deletions docs/ADRs/0046-host-side-api-server-design.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,10 +18,12 @@ Date: 2026-06-02

Accepted

<!-- Once this ADR is Accepted, its content is frozen. Do not edit the Context,
Decision, or Consequences sections. If circumstances change, write a new
ADR that supersedes this one. Only status changes and links to superseding
ADRs should be added after acceptance. -->
<!-- ADRs are point-in-time records, but not fully frozen after acceptance.
Minor annotations are welcome: cross-references to related ADRs, short
notes linking to newer decisions, or clarifying remarks. However, do not
substantially rewrite the Context, Decision, or Consequences sections. If
the decision itself needs to change, write a new ADR that supersedes this
one. For evolving design narrative, use docs/architecture.md. -->

## Context

Expand Down Expand Up @@ -148,6 +150,15 @@ will be evaluated as an alternative when available.
[NVIDIA/OpenShell#1633](https://github.com/NVIDIA/OpenShell/issues/1633)
(supervisor-proxied host-local endpoints) would eliminate this requirement.
Comment thread
maruiz93 marked this conversation as resolved.

> **Note (2026-07):** OpenShell PR
> [#1560](https://github.com/NVIDIA/OpenShell/pull/1560) removed the
> `allowed_ips` requirement for explicitly declared endpoints. The `0.0.0.0`
> bind is still needed (rootless Podman cannot bind to the bridge gateway IP),
> but `allowed_ips` templating is no longer part of the setup. Validated in
> [fullsend-ai/experiments#42](https://github.com/fullsend-ai/experiments/pull/42).
> [#1633](https://github.com/NVIDIA/OpenShell/issues/1633) remains relevant
> for eliminating the `0.0.0.0` exposure itself.

**Security hardening:** timing-safe token comparison, 1 MB request body limits,
rate limiting on unauthenticated endpoints, credential scrubbing in error
messages, bounded in-memory state.
Expand All @@ -166,6 +177,10 @@ messages, bounded in-memory state.
- Servers must bind to `0.0.0.0` on shared hosts, widening the attack surface
until [NVIDIA/OpenShell#1633](https://github.com/NVIDIA/OpenShell/issues/1633)
ships.
> **Note (2026-07):** `allowed_ips` templating is no longer required
> (OpenShell PR [#1560](https://github.com/NVIDIA/OpenShell/pull/1560)).
> The `0.0.0.0` bind and its attack surface remain until
> [#1633](https://github.com/NVIDIA/OpenShell/issues/1633) ships.
- API servers (credential delivery tier 3) are now clearly scoped to cases providers cannot
handle: long-running operations, sandbox capability gaps, credentials in
request bodies, response transformation, and multi-step atomic operations.
Expand Down
Loading