Our production network environment contains several sensitive services with weak or no request authentication. There are few hard restrictions at the network level that prevent a compromised production host from exploiting those weaknesses. Overall, the level of network separation within the production network is not sufficient to let us run semi-trusted services.
To still provide a reasonable level of security, we need to be careful about which services we allow to operate in this networking environment. This creates hurdles for semi-production or volunteer projects like HTML dumps, revision scoring, maps & others. Basically all of these services do not actually need this privileged level of access, but do need production-level hardware and reliability, so can't currently be supported in labs VMs.
There are also many production services without a need for access to a privileged network environment. For example, services like Parsoid, Mathoid, Citoid, the Reading Content Service, AQS, Kartotherian or Hierator can run in very restricted networking environments without access to other sensitive internal services. The consequences of an exploit in any of these services would be significantly less severe if we ran them in restricted network environments.
To summarize, we are looking for a secure way to run semi-trusted services that
a) have production-level hardware and reliability requirements, and
b) don't need access to the privileged production networking environment, but are accessible from production.
See also:
- {T17017} and {T117095}
- {T106867} and {T106731}
- {T121237}