Gating, not optional: sessions are long-lived and optionally networked, which makes them riskier than the stateless job path.
Scope: auth on by default for all session endpoints, tenant-scoped (ties to #101); enforce gVisor on long-lived sessions and do not silently fall back to runc, block link-local/metadata egress by default (ties to #99/#100); replace the host /tmp chmod(0o777) mailboxes (sessions.py:342) with per-tenant, per-session paths and restrictive permissions. Reframe docs so a gVisor agent workspace is the flagship and the GPU/Ollama path is a security-mode-gated special case.
Done when: no unauthenticated access to any session; long-lived sessions cannot run without gVisor; no shared world-writable session state.
Depends on: #105, #106, #107. Related: #99, #100, #101.
Refs #24, #103.
Gating, not optional: sessions are long-lived and optionally networked, which makes them riskier than the stateless job path.
Scope: auth on by default for all session endpoints, tenant-scoped (ties to #101); enforce gVisor on long-lived sessions and do not silently fall back to runc, block link-local/metadata egress by default (ties to #99/#100); replace the host
/tmpchmod(0o777)mailboxes (sessions.py:342) with per-tenant, per-session paths and restrictive permissions. Reframe docs so a gVisor agent workspace is the flagship and the GPU/Ollama path is a security-mode-gated special case.Done when: no unauthenticated access to any session; long-lived sessions cannot run without gVisor; no shared world-writable session state.
Depends on: #105, #106, #107. Related: #99, #100, #101.
Refs #24, #103.