Security on Luther Monson

Your Agent's Shell Allowlist Is Bypassable

Tue, 29 Sep 2026 20:30:00 -0700

Every shipmates crew member runs shell commands. Before any of them runs, it goes through a permission gate. The gate uses the same rule syntax as Claude Code settings: Bash(git status), Bash(rm *), Write(**/.claude/settings.json). The rules are merged from several layers:

a fleet-wide deny list pushed from Fleet Command
per-persona policy files
project settings
the Brig, which compiles shipmates’ fifteen “Ship’s Articles” into deny and ask rules

Deny beats ask, ask beats allow.

Bind Mounts Across Mount Namespaces: Four PRs and a Container Escape

Thu, 24 Sep 2026 21:02:00 -0700

GitHub Actions has a container: key that runs a job’s steps inside an image of your choosing. It’s popular because it gives you a reproducible toolchain without building a custom runner image. On a self-hosted runner it works by having the runner drive Docker. On ephemerd, “Docker” is a shim that speaks the Docker API and creates containers in containerd. Getting bind mounts right through that shim took four PRs in a week. A couple of months later the version that worked turned out to be an escape.

Every Way a Tenant Escaped: A Cross-Tenant Breakout Field Guide

Sun, 13 Sep 2026 16:20:00 -0700

ePHPm can serve a directory full of sites out of one process. Point sites_dir at a folder and every subdirectory is a virtual host. The Host header decides which one you get. That’s how the PR preview environment runs. Every pull request gets a subdomain, and the code behind it is whatever somebody pushed. One process holding many tenants means ePHPm enforces every per-tenant boundary itself, in-process. There’s no container wall between site A and site B unless you add one.

We Disabled PHP's Stack Guard Ourselves: Containing Segfaults in a Single-Process PHP Server

Sun, 06 Sep 2026 15:05:00 -0700

php-fpm has a property nobody thinks about until they leave it. When a worker segfaults, you lose one request. The master forks a new child and life goes on. ePHPm runs every tenant’s PHP as threads inside one process. That’s where the memory and latency wins come from. It also means one tenant’s segfault takes down every other tenant on the box.

This is the story of closing that gap in four steps over about two weeks. The last step turned out to be a bug we’d put there ourselves. It’s also the payoff for the thread pool work in the previous post. Everything below that actually shipped depends on ePHPm owning its own PHP threads.

Clustered ACME in Production: Three Bugs That Took TLS Down

Wed, 02 Sep 2026 19:30:00 -0700

ePHPm gets its own certificates from Let’s Encrypt. In a cluster only one node should be talking to the CA. The nodes elect an ACME leader over the shared KV store. The leader orders the cert, and everybody else installs it from KV. That all had unit tests and had worked on single nodes for months. Then I tried to move wildcard TLS termination for our preview environment off a separate proxy and onto the 3-node cluster itself. In about two days it found three separate bugs that each took TLS down. None of them showed up in a unit test. All of them are the kind of thing you only learn by putting the feature on real machines.

Per-Tenant Network Policy in One Process: ePHPm's eBPF Thread Tags

Fri, 28 Aug 2026 20:40:00 -0700

In multi-tenant mode ePHPm serves every site in sites_dir from one process. Every tenant’s PHP runs as the same OS user on the same pool of ZTS threads. A thread that just served blog.example will serve shop.example a few milliseconds later. That’s the density win. It also means the kernel has no idea which tenant is behind a given connect(). As far as Linux is concerned it’s all ephpm-web.

Most of the isolation work in ePHPm happens above the kernel. That covers open_basedir, the function denylist, per-site databases and KV keyspaces. Network is the one place where that isn’t enough. This week we brought eBPF in to give the kernel a per-tenant identity. It went from a roadmap doc on Wednesday morning to merged that evening (#413, aimed at v0.8.1). v0.8.1 never got a release because its Linux legs failed to link. v0.8.2 shipped with the BPF object silently stubbed out. v0.8.3 was the first release that carried it. This post covers what it enforces and what it costs. It also covers what broke on the way out the door and what it doesn’t do.

Security and Performance Hardening of a Rust Database Proxy

Thu, 27 Aug 2026 20:30:00 -0700

litewire is the piece of ePHPm that lets PHP apps talk MySQL to a SQLite file. I wrote about how it works and about the MySQL quirks WordPress depends on. This one is the less visible half of August:

an audit pass on litewire
a multi-tenant mode that turned a database proxy into a security boundary
a performance regression I shipped and then had to go find

It’s written in Rust. Memory safety is supposed to be the part I don’t have to think about, and it mostly is. The use-after-free in this story was in a dependency. The worst bug wasn’t a memory bug at all.

My iptables Rule Matched 0 Packets in 9.8 GB

Wed, 26 Aug 2026 20:30:00 -0700

After a week of Windows firewall rules that listed fine and enforced nothing, I went back to the Linux side of ephemerd feeling pretty good about it. iptables is the boring, well-understood one. Then I looked at the packet counters on a live node. I found a rule that had never matched a packet in its life. That node had pushed 9.8 GB through the same chain.

The rules I thought I had

Job containers sit on a CNI bridge, 10.88.0.0/16, with the host on 10.88.0.1. ephemerd puts its egress policy in its own chain, EPHEMERD-FORWARD. FORWARD jumps to it for anything to or from the container subnet. From a live node:

Five Ways to Not Firewall a Windows Container (and the One That Works)

Sat, 22 Aug 2026 19:40:00 -0700

ephemerd runs CI jobs from pull requests. One of the rules is that a job can reach the internet but not my LAN. On Linux that’s a few iptables rules in the FORWARD path, and I didn’t think about it much. On Windows I spent about a week finding out how many ways there are to write a firewall rule that Windows accepts, lists and never applies.

The setup is Windows Server 2025 (build 26100) with job containers running under Hyper-V isolation. They sit on the default HNS NAT network that every Windows container tutorial uses. In ephemerd’s case that’s 10.88.0.0/16 with gateway 10.88.0.1. The target is the same as Linux. Block 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 and 169.254.0.0/16, and allow everything else.