kstyagi/nest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: correct formatting and improve clarity in documentation and test descriptions

Browse Source
This commit is contained in:
kstyagi
2026-09-23 06:25:35 +05:30
parent ed9c5306af
commit 0f72ac693a
4 changed files with 18 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DEVELOPER.md
+12 -9
View File
@@ -376,8 +376,8 @@ survive stop/start; guest RAM does not.
Start on a healthy running VM validates its retained network, synchronizes
policy, then restores shared bridge/NAT/forwarding rules without spawning another
VMM. A shared-network setup failure retains the running VM for retry. An ambiguous
process or interrupted live boot/stop is not adopted as a
successful start. Failed resume retains the private disk for retry. Restart
process or interrupted live boot/stop is not adopted as a successful start.
Failed resume retains the private disk for retry. Restart
performs stop and start under one operation lock, not two independent public
calls with a race between them.
@@ -705,16 +705,18 @@ including on conntrack-tools 1.4.8, where `--list` is not a supported option.
### Coexistence and Recovery
Shared `iptables` egress MASQUERADE/forwarding is separate from private bridge
policy. The policy adds no DNAT, public listener, or host-port mapping and does not replace
the host firewall manager. Public inbound connectivity, DNS publication, guest reverse proxies/TLS,
and integration with UFW/firewalld/Docker/libvirt remain out of scope. An
policy. The policy adds no DNAT, public listener, or host-port mapping and does
not replace the host firewall manager. Public inbound connectivity, DNS
publication, guest reverse proxies/TLS, and integration with
UFW/firewalld/Docker/libvirt remain out of scope. An
administrator's external routing/NAT can still affect reachability; do not
infer source-CIDR restrictions or complete public-exposure protection from the
use of private addresses. Operators must choose a non-conflicting topology.
If an external actor loses or changes private policy, recovery is explicit
`ports sync`; `start` also restores shared networking for a running VM. An `enforced` snapshot cannot
prevent later root-level changes or prove that other rules allow traffic.
`ports sync`; `start` also restores shared networking for a running VM. An
`enforced` snapshot cannot prevent later root-level changes or prove that other
rules allow traffic.
[FIREWALL.md](FIREWALL.md) retains the original proposal/backend evaluation;
do not import its unimplemented topology checks into current documentation.
@@ -1055,8 +1057,9 @@ The code is intentionally honest about current limits:
- Guest health is inferred from VMM process state, not application readiness.
- No quotas, DHCP, host-port mapping, UDP/IPv6 services, or network tenancy.
- No guest snapshots, extra disks, production image builder, or SSH-key injection.
- Per-VM private TCP ingress policy exists, but public inbound connectivity, DNS publication,
guest reverse proxy/TLS, and external firewall integration remain out of scope.
- Per-VM private TCP ingress policy exists, but public inbound connectivity,
DNS publication, guest reverse proxy/TLS, and external firewall integration
remain out of scope.
- Shared egress `iptables` rules are incremental and idempotent; only the
private bridge policy is atomically rendered per VM.
- No autostart, background reconciliation, or guest-coordinated shutdown.