nordisk/heimdall

heimdall-k8s

Heimdall is a defensive sandbox. heimdall-k8s is the node-local signer for a Kubernetes RuntimeClass heimdall (spec §9, "tunnr / rusternetes"): the node's kubelet runs a pod of that class under the class's handler policy (read-only root, only /out writable, no capabilities, no_new_privs, no network, a seccomp profile; the image named by digest), and when a container has exited its shim asks this program for a signed result.

heimdall-k8s serve --socket /run/heimdall/k8s.sock \
                   --pinned-key /run/heimdall/pinned.key \
                   --out-root /data/rusternetes/pods

• At start it generates the per-boot Ed25519 key (in memory only, never on disk), writes the pinned public key (heimdall-boot-key v1 …, mode 0644, atomically) and binds the socket (mode 0600), then confines itself with Landlock (ABI 6 asked, best effort): read-only below --out-root, nothing else on the filesystem, no TCP bind or connect, signal and abstract-unix scopes. The first stdout line says heimdall-k8s: serving <socket> key <key id> (landlock full abi N | partial | off).
• Per connection it reads one JSON ResultRequest (the kubelet's handler record: container, image + digest, writable volumes, what the handler applied; exit code or signal; start and finish times) to end of stream.
• It lists the /out volume (which must lie below --out-root): regular files only, flat, opened with O_NOFOLLOW, Heimdall's output limits (Limits::default()); a symlink, directory or device is heimdall-out-1.
• It signs a JobResult: job id = the first 16 bytes of SHA-256(heimdall-k8s\0<container>\0<startedUnix>), a fresh nonce, the verdict (accepted only for exit 0 with clean outputs), and the runner's Features stated from what the handler applied: container only when the root was read-only, the network none, no_new_privs set and no capability kept; seccomp Default for RuntimeDefault, Generated only for a profile shipped with the image (pinned by its digest); landlock, broker, wasm false; image_verified_each_start when the image was named by digest. kernel is not filled (the probe lives in heimdall-container).
• It answers two lines and closes:

heimdall-features: <Features JSON>
heimdall-signed-result: <standard base64 of the SignedResult wire bytes>

or one heimdall-refused: <reason> line (nothing signed) for a bad request.

The signed line, base64-decoded into a file, is what heimdall verify-result <file> --key <pinned key file> [--files <the /out dir>] verifies.

A static build for the node: cargo build --release --locked --target x86_64-unknown-linux-musl -p nordisk-heimdall-k8s.

License: AGPL-3.0-only. The node's programs only talk to it over the socket.