Network names and ranges
Every name starts with the prefix, sandcastle, which --prefix changes.
| Name | What it is |
|---|---|
sandcastle.target | groups the three services and the gate’s repair; enabled, so it starts with the machine |
sandcastle.service | the core |
sandcastle-keep.service, container sandcastle-keep | the keep |
sandcastle-gate.service, container sandcastle-gate | the gate |
sandcastle-gate-repair.timer, sandcastle-gate-repair.service | every minute, restarts the gate if it runs but lost a network |
sandcastle-link | the network of the keep and the gate, with no way out |
sandcastle-egress | the gate’s way out |
sandcastle-box-<random> | a job’s box, removed when the job ends |
sandcastle-{ocr,claude,keep,gate}:<build> | the images, tagged with the binary’s build |
Ranges
| Network | Default | Flag of install |
|---|---|---|
sandcastle-link | 10.89.250.0/24 | --link |
sandcastle-egress | 10.89.251.0/24 | --egress |
Each range is an IPv4 /24. install refuses one that a Podman network or a route of the
machine already uses, and says which. It remembers the ranges you chose. With another
--prefix, there are no defaults: give both ranges. The gate’s address is
the link’s .2, port 4750. No piece publishes a port on the machine.
A box has no network at all.
The routes of the egress network
The egress network has a prohibit route for each of the fourteen IPv4 bogon ranges, so a
connection to one fails at once, with or without the gate:
0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 169.254.0.0/16 172.16.0.0/12
192.0.0.0/24 192.0.2.0/24 192.88.99.0/24 192.168.0.0/16 198.18.0.0/15
198.51.100.0/24 203.0.113.0/24 224.0.0.0/4 240.0.0.0/4
Each internal exception adds a /32 to its address through the
network’s gateway, which wins over the range it is in. The network has no IPv6. The gate makes
it anew each time it starts, and check holds it to these routes. Why there are two barriers is
in How the network is closed.