J3 Running natively, without containers

Requirements

1. J3-R1draftMUST

   The tool MUST be able to run the services as native host services under the init system with no container engine in the path, on Linux.

   locked by

   0.24.0 ○ open

2. J3-R2draftMUST

   VPN isolation MUST be rebuilt as a dedicated network namespace holding the VPN interface, with the download client bound into that namespace.

   locked by

   0.24.0 ○ open

3. J3-R3draftMUST

   A kill rule inside the namespace MUST ensure that if the tunnel drops there is no route out.

   locked by

   0.24.0 ○ open

4. J3-R4draftMUST

   The egress-IP proof MUST run inside the dedicated namespace, comparing the address seen there against the host's, and MUST assert they differ.

   locked by

   0.24.0 ○ open

5. J3-R5draftMUST

   The killswitch MUST be proven by bringing the tunnel interface down and asserting there is then no egress at all.

   locked by

   0.24.0 ○ open

6. J3-R6draftMUST

   Hardlinking MUST be proven by creating a file, linking it, and comparing inodes on the real data root.

   locked by

   0.24.0 ○ open

7. J3-R7draftMUST

   An egress address inside the namespace equal to the host's MUST be treated as a leak and MUST halt the stack.

   locked by

   0.24.0 ○ open

8. J3-R8draftMUST

   A namespace or client binding that cannot be confirmed MUST be reported as unproven, never as isolated.

   locked by

   0.24.0 ○ open

9. J3-R9draftMUST

   The tool MUST state that the native path forfeits the VPN-provider abstraction the container gave, making provider configuration and reconnection the operator's responsibility.

   locked by

   0.24.0 ○ open

10. J3-R10draftMUST

    The tool MUST state that the native path is the highest-effort option.

    locked by

    0.24.0 ○ open

11. J3-R11draftMUST

    The native path MUST be refused on hosts without network namespaces, with the reason given, and MUST NOT be offered on macOS.

    locked by

    0.24.0 ○ open

12. J3-R12draftMUST

    Standing up the namespace, binding the client, installing the kill rule, and running the egress and hardlink proofs MUST each be reachable non-interactively.

    locked by

    0.24.0 ○ open

13. J3-R13draftMUST

    Isolation, client binding, and the kill rule MUST reassert after reboot, with egress re-proven rather than assumed.

    locked by

    0.24.0 ○ open

14. J3-R14draftMUST

    Egress MUST be re-proven after any change to the VPN provider configuration.

    locked by

    0.24.0 ○ open