# Working inside a confinement

If you are reading this from a shell you reached over SSH on a port like 2201,
you are inside a confinement. This page tells you what that means, so you do
not waste time attempting things that are designed to fail.

## What a confinement is

A whole small computer, running its own Ubuntu, its own processes, and its own
network — sharing only the physical machine's kernel. Not a directory you have
been restricted to. Not a chroot. You are root here, and root here means
nothing anywhere else.

One application lives in each confinement. Yours is the only one in this one.

## What you can do

- **Anything at all inside these walls.** Install packages, run services,
  change system configuration, break it, rebuild it. There is nothing here you
  can damage that matters to anyone else.
- **Reach the internet.** Outbound HTTP, HTTPS, DNS, git, package registries —
  all work normally and unfiltered.
- **Run your own database.** PostgreSQL, SQLite, whatever suits. It listens on
  localhost, inside here, and nothing outside can see it. You do not need to
  request a database or coordinate with anyone.
- **Serve a website.** Listen on port 80. The machine's reverse proxy holds a
  real HTTPS certificate for your address and forwards plain HTTP to you. Do
  not set up TLS yourself — it is already handled, and doing it twice breaks it.

## What you cannot do, by design

- **Reach the machine underneath.** Every port on the host is refused, on both
  its private and public address. Not filtered by policy you could ask to have
  changed — dropped in the kernel.
- **Reach another confinement.** Same rule. There is no route.
- **See or affect anything outside.** Host processes, host files, other
  applications' data, the container manager. None of it is visible, and none of
  it is reachable.

If something on this list appears to work, that is a serious bug in Harbor and
not a feature to build on. Report it rather than using it.

## Two confinements that need to talk

Use the public web. Each confinement publishes at its own HTTPS address, and
one can call the other's public API exactly as an outside caller would, with
the same authentication an outside caller would need.

This is deliberate. A private channel between confinements would be invisible
to the outside, unauthenticated by default, and would quietly undo the one
property the whole system exists to provide.

## Your address

Your confinement has a number, and everything about your address derives from
it. If you are confinement 3:

| | |
|---|---|
| public site | `https://003.harbor.imake.tools` |
| SSH from outside | port `2203` on the machine's public IP |
| private address | `10.0.0.3` |

Nothing is stored in a mapping table, so nothing can drift out of sync.

## Getting the docs you are reading now

They are served over the ordinary web, which means you can fetch them from in
here like any other page. Markdown, for reading in a terminal:

```bash
curl -s https://docs.harbor.imake.tools/conventions.md
```

Swap the filename for any page listed on the index.

## If you lose access

You cannot lock yourself out permanently. The confinement can be restarted, or
opened from the machine underneath, by the owner. Nothing you do in here is
unrecoverable at the Harbor level — though it may well be unrecoverable inside,
so keep your work in git and push it.