It works.
This page is being served by nginx on a vhost that Warden created, from a document root owned by an isolated Linux account.
What produced this page
- Web server
- nginx (vhost written by the agent)
- Document root
- /var/www/<owner>/sites/<domain>
- Runs as
- a dedicated, unprivileged Linux user
- Uploaded via
- Warden file manager (openat-confined)
Every step was mediated
- The panel never ran a shell. It called a fixed, enumerated agent operation.
- The write was confined. Uploads walk the path with
openat/O_NOFOLLOW, so a planted symlink cannot escape the document root. - It was audited. Every privileged action is in a hash-chained append-only log.
- It is isolated. This site cannot read another tenant's files.