webtop-manage
webtop-manage v1.0.0
/docs/security/sandboxing-and-hardening
Security & Sandboxing webtop-manage v1.0.0

Dedicated Sandboxes & Hardening

Per-instance network isolation, kernel air-gapping, WebSocket CSWSH protection, and container security controls.

Dedicated Sandboxes & Hardening

webtop-manage implements defense-in-depth security controls across container networking, API endpoints, and host filesystem mounts.

🌐 Dedicated Sandbox Networks & Air-Gap Control

By default, containers attached to Docker's default bridge network can freely discover and ping each other. webtop-manage isolates every workstation into a dedicated user-defined bridge network:

code
┌────────────────────────────────────────────────────────────────────────┐
│ Docker Daemon                                                          │
│                                                                        │
│  [ Default State: Complete Isolation ]                                 │
│   ┌────────────────────────┐         ✕ (No Route / Discovered)         │
│   │ Workstation Box A      │ ────────────────────────► [ Production DB ]│
│   │ (workstation-a-net)    │                                           │
│   └────────────────────────┘                                           │
│                                                                        │
│  [ Explicit Network Attachment via webtop-manage ]                     │
│   ┌────────────────────────┐         ✓ (DNS: http://gitea:3000)        │
│   │ Workstation Box B      │ ────────────────────────► [ Gitea Dev ]   │
│   │ (Attached: `dev-net`)  │                                           │
│   └────────────────────────┘                                           │
└────────────────────────────────────────────────────────────────────────┘

Egress Policies

Egress PolicyDriver SettingSecurity Behavior
Full (Default)Standard BridgeFull outbound HTTP/HTTPS access for package managers and development tools.
Restricted / Air-Gap--internal=trueCompletely disables default gateway routes. The workstation cannot reach the WAN/Internet under any circumstance.

🛡️ Web & API Hardening

1. Cross-Site WebSocket Hijacking (CSWSH) Defense

The web terminal WebSocket endpoint (/api/instances/{id}/terminal) validates origin headers:

go
opts := &websocket.AcceptOptions{
    OriginPatterns: []string{
        "localhost:*",
        "127.0.0.1:*",
        "[::1]:*",
        r.Host, // Dynamically allows active reverse proxy domain
    },
}

Malicious websites open in background tabs cannot establish unauthorized terminal exec sessions.

2. Request Body Bounds (DoS Mitigation)

All incoming JSON payloads are capped to 1 MB using http.MaxBytesReader:

go
func decodeJSON(w http.ResponseWriter, r *http.Request, dst interface{}) error {
    r.Body = http.MaxBytesReader(w, r.Body, 1024 * 1024)
    return json.NewDecoder(r.Body).Decode(dst)
}

3. Least Privilege & no-new-privileges

All instantiated containers are launched with SecurityOpt: []string{"no-new-privileges:true"} and run non-root users (abc, UID/GID 1000) to prevent privilege escalation exploits.

🚫 Host Filesystem Traversal Containment

When using the host filesystem browser or attaching bind mounts, webtop-manage enforces strict path restrictions:

go
var forbiddenPrefixes = []string{
    "/etc", "/proc", "/sys", "/dev", "/var/run", "/run", "/boot",
    "/root/.ssh", "c:/windows/system32", "c:/windows/syswow64",
}

Any attempt to bind mount sensitive host structures (id_rsa, known_hosts, shadow, docker.sock) returns a strict 400 Bad Request validation error.