StarHub Kit v1.3.0 compiles one topology into firewall and Tailscale rules to isolate AI coding sandboxes

·15 views

The author describes risks from autonomous AI coding agents given raw shell access in cloud VMs, containers, or Tailscale-connected machines, including access to cloud metadata endpoints and lateral probing of private network peers. Wi-Fi subnet overlaps and throttled UDP/443 proxy tunnels can also cause silent connectivity failures. To address this, the author released StarHub Kit v1.3.0, an open-source, zero-dependency Python policy compiler and MCP server. It compiles a single declarative topology into nftables, macOS pf, Tailscale ACL, and iptables rules, plus Sing-box and Mihomo QUIC rulesets. The project is MIT-licensed and reports OpenSSF Best Practices Silver certification and SLSA Build Level 3 provenance.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Cross-Platform Software Design: Why Robotics Needs Portable Architectures

This chapter from the STATERA Library's Software Architecture Fundamentals series introduces cross-platform software design as a core requirement in modern engineering. It explains that robotic systems span diverse hardware, from real-time microcontrollers to GPU accelerators and cloud servers, which must work together reliably. The text contrasts earlier practice, where applications were tightly bound to specific processors and drivers, with today's emphasis on abstraction layers and modular interfaces. It notes that this shift reduces the cost and rework of hardware migrations and limits accumulating technical debt. The chapter sets the motivation and scope for later material on hardware abstraction, portability, build systems, and CI/CD.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Software Defined Robots: Shifting Robot Capabilities from Hardware to Software

The robotics industry is moving from fixed, hardware-determined machines toward Software Defined Robots, whose functions are governed largely by software. This approach separates standardized hardware, which provides mobility, sensing and computation, from application intelligence such as perception, navigation and decision making. Because new capabilities can be deployed remotely through updates, robots can gain functions years after installation, extending their operational life and lowering ownership costs. The architecture is layered, with a hardware abstraction layer and middleware sitting between physical devices and applications, mirroring cloud-native computing designs. The piece is presented as the tenth chapter of an educational series on software architecture fundamentals.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Krea2 Ecosystem Update Ships Five Separate ComfyUI Workflows

An update to the Krea2 ecosystem introduces five distinct workflows, each targeting a different task the model now handles well. The set includes JSON-driven multi-grid storyboard generation, single-image and dual-reference style transfer, multi-image reference editing, and a PID-based detail enhancement pass. The creator argues for separate workflows rather than one large graph, since bundling them would make every job run every branch. Workflow JSONs, cover materials, and video walkthroughs are provided, though the exports depend on models present in a cloud instance rather than being self-contained. The release is an independent tutorial effort, not affiliated with or endorsed by the model authors or RunningHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Four Krea2 ComfyUI Workflows Add Depth Control, Detail Enhancement and Prompt Generation

An independent creator at AI-KSK has published four ComfyUI workflows for the Krea2 image model aimed at more precise output. The set includes a two-pass RAW and Turbo sampling method, an image editing workflow with detail enhancement, a depth-map control for locking composition, and a random structured prompt generator for batch exploration. The author highlights depth control as the most significant change, since it keeps composition consistent across regenerations. The workflow JSON files and cover assets are hosted on Hugging Face, with video walkthroughs on YouTube and Bilibili. The exports reference models available on a cloud instance and are not self-contained, and the release is positioned as tutorial material unaffiliated with the model's authors or RunningHub.

0 comments Read more at DEV Community