S001: Bridge Management

Overview

The bridge is the foundation of Outcall's network isolation. It is a Linux network bridge interface (outcall0 by default) that acts as a virtual switch — every agent container's network interface is plugged into it, and all traffic must pass through it before reaching the outside world.

nftables rules are attached to this bridge. They enforce the default-BLOCK policy: all forwarded traffic is dropped unless a rule explicitly allows it. Established/related connections are accepted so that responses to allowed outbound requests can return.

The bridge subsystem runs as a Tokio task inside outcalld. It is managed via the outcall bridge CLI commands and the host API. The bridge must be up before any networks (S002) can be created.

User Scenarios

S001-US-001 [P1] As a host operator, I want to bring up the bridge and nftables rules so that all agent containers are isolated by default.

S001-US-002 [P1] As a host operator, I want to check whether the bridge is up and rules are active so that I can verify the system is enforcing policy.

S001-US-003 [P1] As a host operator, I want to tear down the bridge so that I can cleanly shut down the isolation layer.

Requirements Summary

Cross-Spec Dependencies

• Required by: S002, S003, S007, S008, S009