Skip to main content
Evolving. This area is visible in the product, but it is still evolving and should not be treated like a fully mature surface yet.

​
Goal

Deploy applications with an explicit record of what may run and which external destinations they may reach.

​
Prerequisites

  • A StackShift hosted project
  • A successful immutable image build or direct OCI image reference

​
Workflow

1
Build or select an immutable OCI image.
2
Review the project Security tab for the admission decision and effective network policy.
3
Declare any non-web external service before deployment.
4
Request an exact, expiring grant and wait for operator approval when required.
5
Deploy only after the admission receipt and network policy are valid.

​
Default hosted network policy

  • DNS is resolved through StackShift-controlled DNS.
  • Public outbound TCP ports 80 and 443 are available for ordinary HTTP, HTTPS, and secure WebSocket clients.
  • Attached StackShift services are allowed through exact service destinations.
  • Arbitrary UDP, alternate DNS, metadata endpoints, protected private ranges, SMTP, database ports, and custom public ports are blocked unless an approved policy allows them.
  • Inbound application WebSockets are not treated as abuse merely because they use WebSocket transport.

​
Admission receipts

Every customer execution path is tied to an admission decision for the immutable image digest. The sealed receipt binds the project, deployment, execution kind, source and OCI evidence, policy version, and effective network policy. Agents fail closed when a receipt is missing, expired, revoked, replayed for a different workload, or does not match the image digest being started.

​
Inspect from the CLI

​
What StackShift records

  • Sanitized allow, review, or block evidence tied to an immutable image digest.
  • The effective destinations, protocols, ports, purposes, grants, and expiries.
  • Connection destination, port, protocol, transferred bytes, duration, destination cardinality, and denied attempts without payload capture.

​
Expected result

The agent starts only the admitted image digest and enforces the same restricted policy across normal containers and eligible Kata workloads.

​
Common failures

  • The image digest changed after admission. Build again so StackShift can issue a receipt for the final digest.
  • The receipt expired or was revoked. Start a fresh deployment instead of replaying the old receipt.
  • An undeclared database or custom TCP endpoint requires approval. Declare the dependency and request an exact grant.
  • The image or runtime behavior was sent for security review. The sanitized decision is visible without exposing internal detection signatures.

External databases and private routes

Declare exact external services, request scoped egress, and connect private-only databases without opening general network access.

Quarantine and remediation

Understand what StackShift isolates, what evidence it retains, who is notified, and how an operator can release a remediated workload.

Builds, deployments, and logs

Understand the project execution lifecycle: build output, deploy state, rollback behavior, and where to inspect logs.