saphan egress-door
Serve this run's SOCKS5 egress door on a unix socket and run the command under it (far-side egress)
saphan egress-door
Serve this run's SOCKS5 egress door on a unix socket and run the command under it (far-side egress)
Re-entry point used on a REMOTE machine: bind this run's egress door on a unix socket, serve the policy document carried to this host, run the given command as a child, and close and unlink the door when that child ends.
The door is internal/egress — the same judging core, the same seventeen refusal classes and the same SOCKS5 front-end a local run is judged by. This verb adds a socket and a lifetime and no policy of its own.
LIFETIME. The door is opened BEFORE the command starts and closed AFTER it ends, and the command runs as this process's own child so the two lifetimes cannot come apart. There is no detach and no daemon mode: a proxy left running on someone else's host is a security defect, so this verb has no way to produce one. If this process is killed outright, the socket inode is left behind and NOTHING serves it — a leg whose egress then fails closed — and the next door on that path reclaims the stale inode after proving it is not live.
THE POLICY TRAVELS AS DATA. --policy-document carries the document itself, not a path: a far host may be assumed to carry source code and nothing else, so a policy read from a far path would be a policy nobody shipped there. --policy-source is the dispatcher's sha256 of those exact bytes; the load REFUSES when what arrived digests to anything else, so a mangled document is a named refusal and never a run judged by bytes nobody addressed.
The command's exit status is this verb's exit status. Its stdin, stdout and stderr are this process's own, so an agent behind this door is observed exactly as one in front of it.
Options
| Option | Type | Default | Description |
|---|---|---|---|
--policy-digest | string | unset | sha256 of the CANONICAL COMPILED policy, as the dispatcher recorded it; the load refuses a mismatch |
--policy-document | string | unset | the egress policy DOCUMENT itself, as one JSON value carried to this host |
--policy-source | string | unset | sha256 of the exact --policy-document bytes, as the dispatcher recorded them; the load refuses a mismatch |
--socket | string | unset | absolute path of the unix socket to bind — this run's own door, minted by the dispatcher |