[Bug] Bridge forwards all Zenoh namespaces to local ROS 2 - how to isolate different users?

[cmeng-gao]

I'm using zenoh-plugin-ros2dds to enable remote ROS 2 debugging across different networks with multiple users. Each user has:

• An industrial PC (running ROS 2 nodes)
• A remote debugging device

All devices connect to a cloud-based Zenoh router. I configured different namespaces for each user to isolate their data.

It appears that:

1. The namespace parameter correctly adds prefixes on the Zenoh network layer (/botA/** vs /botB/**)
2. However, each bridge forwards ALL Zenoh data to local ROS 2, preserving the namespace prefixes
3. This means User B can see User A's topics (with /botA/ prefix in the topic name)

Questions

1. Is this the intended behavior? (I saw in the README that monitoring hosts can see all robots' data, which suggests this might be by design)
2. How can I configure the bridge to only forward data from a specific namespace?

Use Case

We have multiple users with industrial PCs in different locations, and each user needs to remotely debug their own robots without seeing other users' data. We're looking for the best practice to achieve
namespace/user isolation.

Thank you for clarifying the expected behavior and best practices for multi-user isolation!

To reproduce

Cloud Router:
zenohd --listen tcp/0.0.0.0:7447

User A's bridge configuration (configA.json5 - used on both industrial PC and debug device):

{
  mode: "client",

  connect: {
    endpoints: ["tcp/x.x.x.x:7447"]
  },

  plugins: {
    ros2dds: {
      domain: 0,
      namespace: "/botA"
    }
  }
}

User B's bridge configuration (configB.json5 - used on both industrial PC and debug device):

{
  mode: "client",

  connect: {
    endpoints: ["tcp/x.x.x.x:7447"]
  },

  plugins: {
    ros2dds: {
      domain: 0,
      namespace: "/botB"
    }
  }
}

Starting the bridges:

On User A's devices

zenoh-bridge-ros2dds -c configA.json5

On User B's devices

zenoh-bridge-ros2dds -c configB.json5

Expected Behavior

User B should only see ROS 2 topics from User B's devices (prefixed with /botB/ or without prefix on local ROS 2 side).

User B should NOT see any topics from User A.

Actual Behavior

User A publishes a topic:

On User A's industrial PC

ros2 topic pub /robot_status std_msgs/msg/String "data: 'Robot Online'"

Output:

publisher: beginning loop
publishing #1: std_msgs.msg.String(data='Robot Online')
publishing #2: std_msgs.msg.String(data='Robot Online')
publishing #3: std_msgs.msg.String(data='Robot Online')

User B can see User A's topics:

On User B's debug device

ros2 topic list

Output:

/botA/parameter_events
/botA/robot_status # ← User B should NOT see this!
/botA/rosout
/parameter_events
/rosout

User B's bridge is forwarding all Zenoh namespaces to local ROS 2, including /botA/** topics.

System info

• zenoh-plugin-ros2dds: [latest from main branch]
• ROS 2: Humble
• OS: Ubuntu 22.04
• Zenoh router: latest release