From 1f34ccc00973f6209bff3540cb02829557e1708d Mon Sep 17 00:00:00 2001
From: dawn <dawn@tangled.org>
Date: Fri, 19 Jun 2026 22:03:19 +0300
Subject: [PATCH] spindle/microvm: dont enable sandboxing in slirp4netns

slirp4netns has a bug where it will break host devices on root user
if this is enabled. so to avoid this, let's disable it. the sandboxing
doesn't matter here because slirp4netns runs next to spindle anyway
so if slirp is compromised you have bigger issues, and seccomp is still
enabled, and if you really care your spindle should be a hardened
systemd service anyway.

Signed-off-by: dawn <dawn@tangled.org>
---
 spindle/engines/microvm/networking.go | 33 +++++++++++++++------------
 1 file changed, 19 insertions(+), 14 deletions(-)

diff --git a/spindle/engines/microvm/networking.go b/spindle/engines/microvm/networking.go
index 67df330d..30f12dfe 100644
--- a/spindle/engines/microvm/networking.go
+++ b/spindle/engines/microvm/networking.go
@@ -122,31 +122,36 @@ func (n *slirpNamespace) Start(ctx context.Context, logFile *os.File, logger *sl
 		return nil, nil, fmt.Errorf("slirp4netns command not found in PATH: %w", err)
 	}
 
+	args := slirpArgs(n.dev, pid)
+
+	cmd := exec.CommandContext(ctx, slirpPath, args...)
+	cmd.ExtraFiles = []*os.File{exitR}
+	cmd.Stdout = logFile
+	cmd.Stderr = logFile
+	if err := cmd.Start(); err != nil {
+		return nil, nil, fmt.Errorf("start slirp4netns: %w", err)
+	}
+	logger.Info("started slirp4netns network namespace", "pid", pid, "cidr", outerSlirpCIDR, "tap", netnsTapName)
+
+	ok = true
+	return cmd, exitW, nil
+}
+
+func slirpArgs(dev bool, pid string) []string {
 	args := []string{
 		"--configure",
 		"--mtu=" + netnsMTU,
 	}
-	if !n.dev {
+	if !dev {
 		args = append(args, "--disable-host-loopback")
 	}
 	args = append(args,
-		"--enable-sandbox",
+		"--disable-dns",
 		"--enable-seccomp",
 		"--exit-fd=3",
 		"--cidr="+outerSlirpCIDR,
 		pid,
 		netnsTapName,
 	)
-
-	cmd := exec.CommandContext(ctx, slirpPath, args...)
-	cmd.ExtraFiles = []*os.File{exitR}
-	cmd.Stdout = logFile
-	cmd.Stderr = logFile
-	if err := cmd.Start(); err != nil {
-		return nil, nil, fmt.Errorf("start slirp4netns: %w", err)
-	}
-	logger.Info("started slirp4netns network namespace", "pid", pid, "cidr", outerSlirpCIDR, "tap", netnsTapName)
-
-	ok = true
-	return cmd, exitW, nil
+	return args
 }
-- 
2.51.2