Tenancy

NOITE_TENANCY decides whether other people may push code — multi runs tenant code sandboxed, single is just you.

NOITE_TENANCY decides whether other people may push code to the install. Unset, it is multi off localhost and single on localhost.

• multi: tenant builds and release commands run as the unprivileged build user with a cleared environment (no platform secret reaches them), tenant fleets as the fleet user, and an nftables policy on those users closes new connections to loopback, private ranges and cloud metadata. The one private address allowed is the object store the fleet’s own celld needs; Worker code can reach it but holds no keys. /data is private to the runner. Release commands are skipped until scoped per-app bucket keys exist. All of this needs NET_ADMIN, SETUID, SETGID and CHOWN, which docker/compose.yaml grants; without them the runner keeps /ready at 503 with the reason and refuses builds.
• single: only you push code. No egress policy, and release commands run with the root bucket keys.

The repository’s isolation lane (make e2e-isolation, also runnable from the CI workflow) proves the multi claims: a hostile tenant app tries to read platform secrets and files and to reach every internal API from its build, its release command and its Worker, and the lane asserts every attempt fails while internet egress still works.

NOITE_TENANCY and related knobs are documented in Environment variables.