Advanced Topics

Restricted Mode

RESTRICTED is the default mode and the reason SITU exists. The containers run on an isolated internal network with no external routes — the agent cannot reach anything outside, no matter what the model or the user instructs.

How container network isolation works

In RESTRICTED mode, SITU creates a container network marked --internal. An internal network has no gateway — the kernel routing table inside the container has no default route pointing outside, no DNS upstream, no outbound path. The agent and the local llama.cpp model server share this network and can talk to each other, but neither container can send a packet to any external host.

Attempts to reach the outside world fail at the kernel routing layer. There is no route to send a packet on. The result is not "the firewall blocked it" — the result is "there is no route out."

Not a privacy policy. A kernel constraint.

The model cannot bypass it. A buggy tool cannot bypass it. A clever prompt cannot bypass it. The constraint is enforced one layer below the agent itself.

Starting a restricted session

RESTRICTED is the default — no extra flags are needed. Run a query from the directory that should be the agent's workspace:

$ cd ./my-project
$ situ -p "Refactor the auth module to use JWTs"

The containers run on an internal network with no external routes. The agent and the llama.cpp sidecar share this network and communicate with each other; no traffic can leave it. The host network, the LAN, and the public internet are all unreachable.

What is blocked

Channel	Status in RESTRICTED
Outbound HTTP / HTTPS	Blocked — no external route on the internal network
DNS resolution	No external DNS upstream; host resolvers unreachable
Outbound TCP / UDP to any host	No external route; packets cannot leave the internal network
Inbound connections from the host	The container has no host-routable address
Loopback to the host (`127.0.0.1` on the host)	Not reachable
Local model (sidecar container)	Reachable — internal network only

Verifying the constraint

The point of an architectural guarantee is that it can be tested. The connectivity test runs a series of probes from inside a live pod:

$ situ -t

The command reports on each check — local model reachability, blocked external HTTP, blocked HTTPS, blocked DNS, and blocked outbound TCP. The full source of every probe is in the public repository, so the result is reproducible on any machine.

Workspace isolation in restricted mode

Network isolation is paired with strict workspace isolation. The agent only sees the directory bind-mounted into the container at session start — the directory situ was launched from. The home directory, SSH keys, .env files, credentials, and the rest of the host filesystem do not exist from the agent's point of view.

The host home directory might contain:

$ ls ~/
  projects/  .ssh/  .env  Documents/

Starting situ from inside ~/projects/my-project bind-mounts that one directory into the pod and nothing else. From the agent's point of view, ~/.ssh, ~/.env, and ~/Documents simply do not exist — the bind mount is the entire visible filesystem.

When to use RESTRICTED mode

Default for everything. Treat RESTRICTED as the only mode unless a specific task requires otherwise.
Working with proprietary or regulated source code. Internal IP, customer data in test fixtures, code subject to GDPR / HIPAA / ITAR / export controls — none of it can leave a pod that has no network.
Sessions on untrusted networks. A coffee-shop Wi-Fi or hotel network cannot exfiltrate something the agent process cannot reach.
Reviewing model output. Even a compromised or backdoored model cannot phone home from a namespace that has no interfaces.

Limitations and trade-offs

The agent cannot fetch live API documentation, look up package versions on a registry, or run network-dependent test suites. Cache or vendor those resources locally, or switch into NETWORK mode for the specific task that requires it.
Tasks requiring outbound calls (database access on the LAN, container registries, package mirrors) will not work — that is the point. Open the channel deliberately, complete the task, and return to RESTRICTED.

Network Mode — when and how to opt in to a network-attached pod.
First Steps — installation, the first isolated session, and isolation probe output.