84e32ef1f2
Guests stay on '-nic none' unless a profile opts in, and opting in does NOT mean internet: the NIC is user,restrict=on (no route out, no route to the host LAN) with one guestfwd to whatever command the overlay configures — a filtering proxy in practice. Keeps 'user code never gets a raw socket outside' true by construction. |
||
|---|---|---|
| .. | ||
| app | ||
| board-indexes | ||
| scripts | ||
| sdk | ||
| tests | ||
| .env.example | ||
| Dockerfile | ||
| debug_qemu.py | ||
| mcp_server.py | ||
| mcp_sse_server.py | ||
| requirements.txt | ||