Firewall
Partly builtSome of this works today; the page says which parts.
Firewall rules are API objects kept outside the VM. A tenant with root inside the sandbox can't change them, and they survive every lifecycle step.
harebox new --name fw
harebox firewall set current --body '{"default_outbound":"deny","inbound":[],"outbound":[{"action":"allow","hosts":["registry.npmjs.org"]}]}'
harebox firewall current
In this build, inbound rules are enforced at the HareBox edge. Enforcing on each host with eBPF needs root on a real host, and isn't built yet. Outbound rules are stored, and aren't enforced yet.