skip to content

detached a236b1d

docs(readme): warn that guest forge traffic comes from a private address

commit: a236b1d94ac02cb8a37aa443358c39f876332b76
author: brice · 10d ago · 2026-10-13 07:33 UTC
parent: 6699244
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

2 files · +1 -2

M README.md +1 -1


@@ -52,7 +52,7 @@ The host name and port come from `ERMITE_RUNNER_URL` (port defaulted from the sc
52	52		- the `github.server_url`, `github.api_url` and `github.graphql_url` of the job's contexts, and so `GITHUB_SERVER_URL`, `GITHUB_API_URL` and `GITHUB_GRAPHQL_URL`, are rewritten to the origin of `ERMITE_RUNNER_URL` when their origin is the server's public one (`github.server_url`); paths are kept (`/-/github/api`). Other values, and the URLs inside `github.event`, stay as the server recorded them;
53	53		- `guest forge access: sandboxes may reach <origin> on the host` is logged at start and at the start of every job, like the privileged-container warning.
54	54
55		-	The runner does not proxy. The traffic reaches the host's own listener on that port, so a service must listen on it on an address the gateway reaches (``, as Gordon does; a listener bound to `127.0.0.1` receives nothing). A shared reverse proxy on that port routes by `Host` header, so a job can reach every app that proxy serves on that port*, not only the forge, by sending another `Host` header: use this on staging hosts only, with a proxy whose other apps you accept to expose to job code. Jobs also see the forge over plain HTTP in that setup.
	55	+	The runner does not proxy. The traffic reaches the host's own listener on that port, so a service must listen on it on an address the gateway reaches (``, as Gordon does; a listener bound to `127.0.0.1` receives nothing). A shared reverse proxy on that port routes by `Host` header, so a job can reach every app that proxy serves on that port*, not only the forge, by sending another `Host` header: use this on staging hosts only, with a proxy whose other apps you accept to expose to job code. That traffic comes from a private address (`10.200.x.x`), so anything behind the proxy that trusts private sources (admin pages, metrics, rate-limit exemptions) trusts job code too. Jobs also see the forge over plain HTTP in that setup.
56	56
57	57		### Cancellation
58	58


@@ -52,7 +52,7 @@ The host name and port come from `ERMITE_RUNNER_URL` (port defaulted from the sc
52		- the `github.server_url`, `github.api_url` and `github.graphql_url` of the job's contexts, and so `GITHUB_SERVER_URL`, `GITHUB_API_URL` and `GITHUB_GRAPHQL_URL`, are rewritten to the origin of `ERMITE_RUNNER_URL` when their origin is the server's public one (`github.server_url`); paths are kept (`/-/github/api`). Other values, and the URLs inside `github.event`, stay as the server recorded them;	52		- the `github.server_url`, `github.api_url` and `github.graphql_url` of the job's contexts, and so `GITHUB_SERVER_URL`, `GITHUB_API_URL` and `GITHUB_GRAPHQL_URL`, are rewritten to the origin of `ERMITE_RUNNER_URL` when their origin is the server's public one (`github.server_url`); paths are kept (`/-/github/api`). Other values, and the URLs inside `github.event`, stay as the server recorded them;
53		- `guest forge access: sandboxes may reach <origin> on the host` is logged at start and at the start of every job, like the privileged-container warning.	53		- `guest forge access: sandboxes may reach <origin> on the host` is logged at start and at the start of every job, like the privileged-container warning.
54			54
55	-	The runner does not proxy. The traffic reaches the host's own listener on that port, so a service must listen on it on an address the gateway reaches (``, as Gordon does; a listener bound to `127.0.0.1` receives nothing). A shared reverse proxy on that port routes by `Host` header, so a job can reach every app that proxy serves on that port*, not only the forge, by sending another `Host` header: use this on staging hosts only, with a proxy whose other apps you accept to expose to job code. Jobs also see the forge over plain HTTP in that setup.	55	+	The runner does not proxy. The traffic reaches the host's own listener on that port, so a service must listen on it on an address the gateway reaches (``, as Gordon does; a listener bound to `127.0.0.1` receives nothing). A shared reverse proxy on that port routes by `Host` header, so a job can reach every app that proxy serves on that port*, not only the forge, by sending another `Host` header: use this on staging hosts only, with a proxy whose other apps you accept to expose to job code. That traffic comes from a private address (`10.200.x.x`), so anything behind the proxy that trusts private sources (admin pages, metrics, rate-limit exemptions) trusts job code too. Jobs also see the forge over plain HTTP in that setup.
56			56
57		### Cancellation	57		### Cancellation
58			58

M internal/host/job.go +0 -1


@@ -575,7 +575,6 @@ func (j jobRun) execute(ctx context.Context, rt Runner, stopHard <-chan struct
575	575		j.failEarly(fmt.Sprintf("The runner has no free sandbox: %v", err))
576	576		return failure()
577	577		}
578		-
579	578		// Stop runs to completion even when the job context is done.
580	579		defer j.stopSandbox(ctx, rt, sb)
581	580


@@ -575,7 +575,6 @@ func (j jobRun) execute(ctx context.Context, rt Runner, stopHard <-chan struct
575		j.failEarly(fmt.Sprintf("The runner has no free sandbox: %v", err))	575		j.failEarly(fmt.Sprintf("The runner has no free sandbox: %v", err))
576		return failure()	576		return failure()
577		}	577		}
578	-
579		// Stop runs to completion even when the job context is done.	578		// Stop runs to completion even when the job context is done.
580		defer j.stopSandbox(ctx, rt, sb)	579		defer j.stopSandbox(ctx, rt, sb)
581			580