Network layer

GlobalStacks treats networking as a first-class runtime boundary. Sandboxes do not receive broad host or mesh authority. Host agents own Domain Name System (DNS), proxying, mesh membership, firewall policy, and delivery into the target sandbox.

Layers

GlobalStacks works across several parts of the stack:

• host networking: tap devices, veth, bridges, namespaces, nftables
• Layer 3 (L3): private addressing, routing, mesh topology, network membership
• Layer 4 (L4): port/protocol policy, Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) forwarding, reachability checks
• Layer 7 (L7): Hypertext Transfer Protocol (HTTP) routing, domains, Transport Layer Security (TLS), and preview Uniform Resource Locators (URLs) for higher-level ingress

The lower layers are implementation details for most users. The product surface is networks, aliases, policies, endpoints, and diagnostics.

Private connectivity

Runtime networks let workloads communicate through stable names and approved ports. Agents enforce policy before forwarding traffic.

Typical flow:

1. A sandbox resolves a network alias.
2. The local agent checks policy.
3. The local agent forwards traffic over the mesh.
4. The target agent delivers traffic into the target sandbox.

Sandboxes do not need mesh credentials and do not join the infra mesh directly.

Firewall and port forwarding

Network policy should be explicit:

• source selector
• destination alias or endpoint
• protocol
• port
• direction
• exposure mode

Port forwarding can expose a sandbox service locally, privately, or publicly depending on product policy. Public ingress should remain a controlled endpoint, not an implicit side effect of opening a port inside a sandbox.

Diagnostics

Operators need to know whether failure is Domain Name System (DNS), policy, route, mesh, agent, firewall, or target sandbox health. GlobalStacks diagnostics should report these as separate states instead of returning a generic connection failure.