Hangar
Sign in
Pricing Verify Security Docs Sign in

The sandbox reset

The sandbox reset removes everything a session used when the session ends. Hangar runs the reset on its own, and you can check each step.

Every sandbox session runs on its own instance. Hangar launches the instance fresh for that session and terminates the instance when the session ends. The end of a session is its security boundary. When a session ends, Hangar runs the five steps below in this order. A session ends in any of these cases:

Each step is a signed record on the session certificate. The record has the response that confirms the step.

The sandbox reset, in order

  1. instance_terminated: Hangar terminates the session's instance through Amazon EC2. Hangar waits until EC2 reports the instance as terminated. The record has the TerminateInstances and DescribeInstances responses. The workspace was on a session volume attached to this instance alone. The volume was encrypted under a key that Hangar generated for the session. Hangar deletes the volume with the instance. The session's containers and memory end with the instance.
  2. egress_group_checked: Hangar reads the rules of the session security group through Amazon EC2 and compares them with the published rules. Every session runs in this one group. The group admits nothing. The group lets traffic out only to the gateway, to the Hangar control plane endpoint and to Amazon S3. The worker on the host uses the last two; the instance's own rules keep the containers off them. TALOS Defence sets the group's rules through a reviewed change, and the Hangar service only reads them. Hangar makes the same check before each session launches, and a group that does not hold the published rules stops the start. The record has the DescribeSecurityGroupRules response. A rule that is not published, or a published rule that is missing, leaves the step not confirmed.
  3. credentials_revoked: the session's Hangar credential ends at once, and Hangar refuses the credential from then on. The record has the description of the instance from EC2. That description shows that the instance had no instance profile, so the session had no AWS credential at any time. Hangar destroys the session volume key in the same transaction. The record says so.
  4. gateway_ca_destroyed: the gateway drops the certificate authority that the gateway made for this session. The gateway also drops every certificate that this authority signed. The gateway made the key of the authority in the gateway's memory, and the key stayed there. The record names the authority by its SHA-384 digest. That digest is the digest that Hangar recorded when the gateway made the authority.
  5. secrets_detached: the gateway drops every credential value that the gateway attached for this session. The record names each value by name.

Before the steps

Hangar does two things in the transaction that stops the session. Hangar revokes every session token. Hangar withdraws every pending approval. The reset then cancels every command that is still queued, so a command that never started never starts.

A session that ends while paused or interrupted

At a pause or an interruption, the gateway has already dropped the session's certificate authority and attached values. The gateway has reported both drops to Hangar. When a session ends in the paused or interrupted state, Hangar records steps 4 and 5 from that report. The gateway made that report at the pause or at the interruption. Steps 1, 2 and 3 run as for any session.

What a confirmed step means

A response confirms a step. EC2's answer confirms each of the first three steps. The gateway's signed report confirms each of the last two steps. Hangar checks the report against what Hangar recorded when the session started. If a response does not confirm a step, Hangar records the step as not confirmed, with the error. Hangar keeps that record beside any later attempt that succeeds. Hangar issues the session certificate only when all five steps are confirmed. So a certificate always shows a complete reset.

Run hangar sandbox status <id> to see each step, confirmed or not, with its response.

Revoke All

With Revoke All, Hangar runs the five steps at once. Start Revoke All in any of these ways:

Revoke All works in every state before the end, including a paused session. The record shows who asked. A stop runs the same five steps and records a stop.

Where the boundary sits

AWS Nitro separates your session from every other workload: one instance, one session. The Hangar reset covers the instance, the network of the instance, the credentials and the state that the gateway kept for the session. AWS operates the physical hosts and the hypervisor in its Sydney Region, under AWS's own assurance.

Read this page as Markdown