Docs / Platform Protections

Security overview

Isoward separates control plane (API gateway) from data plane (customer Docker workloads). This page lists what is implemented today for tenant isolation, and what remains operator-managed or planned. The public security specs page is the buyer-facing summary.

Implemented today

  • gVisor (runsc) for customer app containers on Isoward Cloud; self-host via ./scripts/setup-gvisor.sh + ISOWARD_DOCKER_RUNTIME=runsc
  • Per-workspace Docker bridges with controlled Linux iface names iws-* (com.docker.network.bridge.name)
  • Host east-west isolation via ./scripts/setup-workspace-isolation.sh (DOCKER-USER / ISOWARD-EASTWEST DROP between iws-* bridges and edge customer hairpins)
  • SMTP egress lockout via ./scripts/setup-smtp-egress-block.sh (DOCKER-USER DROP on 25/465/587). CapDrop is not the control.
  • userns-remap via ./scripts/setup-userns-remap.sh (gateway stays userns_mode: host)
  • Per-plan cgroup CPU and memory limits on customer containers
  • Cloudflare Tunnel edge TLS for *.isoward.com with no inbound 80/443 on the host (zone SSL Full, not Full Strict)
  • API rate limiting via @fastify/rate-limit on /v1 routes (stricter limits on auth; see API rate limiting)

Warded workloads (gVisor)

Isoward Cloud runs customer app containers under gVisor (runsc) today. Self-hosted operators enable the same path: install with ./scripts/setup-gvisor.sh, set ISOWARD_DOCKER_RUNTIME=runsc, restart the gateway. See Install & self-host. Managed Postgres and Key Value do not use runsc in this release. Apps must listen on 0.0.0.0.

IAM / RBAC

Mutating routes check workspace permissions. Built-in roles (viewer / developer / admin) ship with fixed permission sets; admins can define custom roles. Details: IAM roles & permissions.

Remaining gaps

  • Platform DDoS mitigation not built in: use Cloudflare at edge
  • Absolute SMTP / east-west / userns / gVisor on self-host remain per-host operator scripts (not automatic on clone alone)
  • Self-host gVisor remains opt-in; Postgres/KV stay on the default runtime
  • IAM grants are workspace-wide only (no per-service bindings yet)