mwiegand abc907b14b docs(specs): script sandbox v3 — egress filter design + plan ... Captures the v3 design: IPAddressDeny= alone (no IPAddressAllow=any because the documented "more specific wins" semantics don't hold on systemd 257 / kernel 6.12 — the allow trumps unconditionally), explicit CIDRs (the -p parser rejects the localhost/link-local shorthand keywords), and a static sandbox-only resolv.conf bind to keep DNS reachable when private RFC1918 ranges are blocked. Plan documents what was implemented (in 7e66936) and the lessons surfaced during execution so the next person doesn't have to rediscover them. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-05-08 17:08:47 +02:00
..
plans	docs(specs): script sandbox v3 — egress filter design + plan	2026-05-08 17:08:47 +02:00
specs	docs(specs): script sandbox v3 — egress filter design + plan	2026-05-08 17:08:47 +02:00