What is enforced, and what you turn on

What a workstation enforces with nothing configured, and what you declare to have the rest enforced outside it.

Some of this holds without you configuring anything, as long as the workstation runs on vz, hcs, qemu or a cloud:

  • The VM itself comes from Apple’s Virtualization framework, Windows’ Host Compute Service, qemu with KVM or your cloud. Ringleader does not build the isolation.
  • Your own files stay out. A vz workstation shares a folder only when its spec lists it under mounts, and an hcs, qemu or cloud workstation shares none at all. A vz workstation reaches only what Ringleader itself needs at your Mac’s 127.0.0.1, and an hcs workstation’s connections to your PC’s own addresses are refused.
  • By default the workstation’s own identity can read its own record and nothing more. self:power and sa:assume stay off until an administrator’s layer grants them.
  • On AWS and Azure it has no cloud identity of its own unless an administrator gives it one. On Google Cloud every VM runs as some service account.

The rest you turn on. Once you do, each of these is enforced outside the workstation as well:

  • To restrict where it may connect, declare an egress block with enforcement: strict and list the cidr and host destinations. enforcement has no default, and strict is refused when you apply it anywhere it cannot be held, so you find out at apply time. Afterward, the EgressEnforced condition on the workstation tells you what is actually in force.
  • To keep a key off the workstation entirely, write a credential injection rule. An Integration, the resource that connects workstations to a shared service, names a host, a header and a Secret under type: httpProxy, and the key itself is never a value in the YAML. Ringleader adds it where the connection leaves the workstation, decrypts only the hosts you name, and the workstation’s owner does not need to be able to read the Secret.
  • To set a limit a member cannot widen, write a Policy or an OrgPolicy: which git repositories a workstation may clone, where it may connect, and which model an llm Integration may name. An apply the policy denies is refused with the field and the value named, and the decision goes to the control plane’s audit log.
  • To learn what a workstation reaches before you restrict it, give it an audit policy. Its Edge then counts each connection it lets through, and rl workstation egress <name> --suggest turns those counts into a strict policy you can apply.
  • To make a workstation go away on its own, set lifecycle.ttl, which deletes the workstation, its machine and its disk at the deadline, or idle and maxRunTime, which stop it. Enforcement is periodic, so a deadline means at or shortly after.

Where to go next

These pages continue from here: