Harden runtime admission and persistent cache

Author: eldryoth

.github/workflows/ci.yml

@@ -23,15 +23,15 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Rust toolchain
         run: rustup show
 
       - name: Install security tools
         run: |
-          cargo install --locked cargo-deny
-          cargo install --locked cargo-audit
+          cargo install --locked cargo-deny --version 0.20.2
+          cargo install --locked cargo-audit --version 0.22.2
 
       - name: Install SBOM tool
         run: cargo install --locked cargo-sbom --version 0.10.0
@@ -232,7 +232,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Rust toolchain
         run: rustup show

.github/workflows/images.yml

@@ -120,35 +120,35 @@ jobs:
 
       - name: Checkout repository
         if: ${{ steps.profile.outputs.build == 'true' }}
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up QEMU
         if: ${{ steps.profile.outputs.build == 'true' }}
-        uses: docker/setup-qemu-action@v4.2.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: Set up Buildx
         if: ${{ steps.profile.outputs.build == 'true' }}
-        uses: docker/setup-buildx-action@v4.2.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log in to GitHub Container Registry
         if: ${{ steps.profile.outputs.build == 'true' }}
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Log in to Docker Hub
         if: ${{ steps.profile.outputs.build == 'true' && env.DOCKERHUB_USERNAME != '' && env.DOCKERHUB_TOKEN != '' }}
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: docker.io
           username: ${{ env.DOCKERHUB_USERNAME }}
           password: ${{ env.DOCKERHUB_TOKEN }}
 
       - name: Log in to Quay
         if: ${{ steps.profile.outputs.build == 'true' && env.QUAY_USERNAME != '' && env.QUAY_TOKEN != '' }}
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: quay.io
           username: ${{ env.QUAY_USERNAME }}
@@ -301,7 +301,7 @@ jobs:
 
       - name: Build and publish image
         if: ${{ steps.profile.outputs.build == 'true' }}
-        uses: docker/build-push-action@v7.3.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: containers/Containerfile.${{ matrix.variant }}
@@ -337,14 +337,14 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@v4.2.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log in to Quay
         if: ${{ env.QUAY_USERNAME != '' && env.QUAY_TOKEN != '' }}
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: quay.io
           username: ${{ env.QUAY_USERNAME }}
@@ -366,7 +366,7 @@ jobs:
 
       - name: Build and publish dev-wolfi
         if: ${{ env.QUAY_USERNAME != '' && env.QUAY_TOKEN != '' }}
-        uses: docker/build-push-action@v7.3.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: containers/Containerfile.wolfi

CHANGELOG.md

@@ -43,6 +43,22 @@ behavior when the change improves security or project direction.
 - Restrict `proxy-wasm-preview` manifests to `access-decision` and prevent the
   server from binding `fluxheim_policy_v1` phase capabilities into preview
   namespaces.
+- Enforce strict host routing in native HTTP/1 and HTTP/2, returning `400` for
+  missing/invalid identity and `421` for unknown hosts.
+- Acquire bounded Wasm admission before blocking-work submission, honor
+  `queue_limit`, and replace per-invocation watchdog threads with one epoch
+  process-wide epoch ticker.
+- Add bounded pre-submission external-auth admission and preserve valid
+  operator access during global invalid-credential throttling.
+- Bound persistent cache index/metadata parsing and keep decoded local cache
+  encryption keys in `sanitization::SecretBytes<32>`.
+- Pin publishing actions, security-tool installs, and container base images to
+  immutable reviewed versions and digests.
+
+### Fixed
+
+- Replace storage-bin request-path full-index rewrites and map-scanning LRU
+  selection with a coalescing persistence worker and ordered eviction index.
 
 ## 1.7.6 - 2026-07-09
 

Cargo.lock

@@ -1,5 +1,5 @@
-ARG RUST_IMAGE=docker.io/library/rust:1.97.0-bookworm
-ARG RUNTIME_IMAGE=docker.io/library/debian:bookworm-slim
+ARG RUST_IMAGE=docker.io/library/rust:1.97.0-bookworm@sha256:7d0723df719e7f213b69dc7c8c595985c3f4b060cfbee4f7bc0e347a86fe3b6a
+ARG RUNTIME_IMAGE=docker.io/library/debian:bookworm-slim@sha256:60eac759739651111db372c07be67863818726f754804b8707c90979bda511df
 ARG FLUXHEIM_CONFIG=packaging/container/fluxheim.toml
 
 FROM ${RUST_IMAGE} AS builder

Containerfile

@@ -73,7 +73,7 @@ Fluxheim is licensed under the European Union Public Licence 1.2.
 | --- | --- | --- |
 | Proxy cache | ✅ | Vhost and route-scoped cache policies. |
 | Memory cache | ✅ | Bounded in-memory cache tier. |
-| Disk cache | ✅ | Filesystem and storage-bin disk backends. |
+| Disk cache | ✅ | Filesystem and storage-bin disk backends with ordered eviction and coalesced durable index writes. |
 | Tiered cache | ✅ | Memory plus disk storage plans. |
 | Encrypted disk cache | ✅ | Optional local-key and OpenBao transit encryption paths. |
 | Static-file cache | ✅ | Optional local static-file caching. |
@@ -107,7 +107,7 @@ Fluxheim is licensed under the European Union Public Licence 1.2.
 | HTTP/2 origins | ✅ | Upstream HTTP version controls and bounded HTTP/2 settings. |
 | gRPC pass-through | ✅ | Route-scoped HTTP/2 gRPC policy; no transcoding. |
 | WebSocket / HTTP upgrade | ✅ | `1.4.1`; explicit `proxy.websocket = true` on HTTP/1.1 upstream routes. |
-| External auth subrequests | ✅ | `1.4.1`; `[proxy.auth_request]` with bounded header/body forwarding. |
+| External auth subrequests | ✅ | `1.4.1`; `[proxy.auth_request]` with bounded header/body forwarding and pre-submission in-flight admission. |
 | Traffic mirroring | ✅ | `1.4.1`; `traffic-mirror` feature with safe bodyless shadow requests. |
 | TCP stream proxying | ✅ | Optional `stream-proxy` feature with Fluxheim-owned L4 TCP listener/data-path and upstream TLS connector boundaries, source IP/CIDR allow/deny policy, hostname-upstream DNS-rebinding guards, weighted upstream selection, drain/backup policy, bounded idle/lifetime/byte/connect controls, route-local PROXY protocol receive/send, and stream upstream TLS/mTLS controls. |
 | UDP/GSLB beta boundary | Limited | `1.5.16`; separate `[udp]` config namespace and `udp-proxy` feature gate with beta DNS-style request/response forwarding, bounded response waits, oversized-response drops, drop-log rate limiting, and syslog one-way forwarding. Public DNS reflector hardening, QUIC pass-through, game proxying, production UDP support, and generic UDP/GSLB platform behavior are not included yet. |

README.md

@@ -1,5 +1,5 @@
-ARG RUST_IMAGE=docker.io/library/rust:1.97.0-alpine3.23
-ARG RUNTIME_IMAGE=docker.io/library/alpine:3.23
+ARG RUST_IMAGE=docker.io/library/rust:1.97.0-alpine3.23@sha256:ca0daf101eef0c8cd1e49dfc137154a220efb8c458c85a3eacacc7dfd5d9e04c
+ARG RUNTIME_IMAGE=docker.io/library/alpine:3.23@sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40
 ARG FLUXHEIM_CONFIG=packaging/container/fluxheim.toml
 
 FROM ${RUST_IMAGE} AS builder

containers/Containerfile.alpine

@@ -1,5 +1,5 @@
-ARG RUST_IMAGE=docker.io/library/rust:1.97.0-bookworm
-ARG RUNTIME_IMAGE=docker.io/library/debian:trixie-slim
+ARG RUST_IMAGE=docker.io/library/rust:1.97.0-bookworm@sha256:7d0723df719e7f213b69dc7c8c595985c3f4b060cfbee4f7bc0e347a86fe3b6a
+ARG RUNTIME_IMAGE=docker.io/library/debian:trixie-slim@sha256:28de0877c2189802884ccd20f15ee41c203573bd87bb6b883f5f46362d24c5c2
 ARG FLUXHEIM_CONFIG=packaging/container/fluxheim.toml
 
 FROM ${RUST_IMAGE} AS builder

containers/Containerfile.debian

@@ -1,5 +1,5 @@
-ARG RUST_IMAGE=docker.io/library/rust:1.97.0-alpine3.23
-ARG RUNTIME_IMAGE=registry.suse.com/suse/sl-micro/6.2/base-os-container:latest
+ARG RUST_IMAGE=docker.io/library/rust:1.97.0-alpine3.23@sha256:ca0daf101eef0c8cd1e49dfc137154a220efb8c458c85a3eacacc7dfd5d9e04c
+ARG RUNTIME_IMAGE=registry.suse.com/suse/sl-micro/6.2/base-os-container:latest@sha256:37a4d254c68e5ad6b923063def06eb2b0a6d8878dce0142b27869c0cee235539
 ARG FLUXHEIM_CONFIG=packaging/container/fluxheim.toml
 
 FROM ${RUST_IMAGE} AS builder

containers/Containerfile.suse-micro

@@ -1,5 +1,5 @@
-ARG RUST_IMAGE=docker.io/library/rust:1.97.0-alpine3.23
-ARG RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base:latest
+ARG RUST_IMAGE=docker.io/library/rust:1.97.0-alpine3.23@sha256:ca0daf101eef0c8cd1e49dfc137154a220efb8c458c85a3eacacc7dfd5d9e04c
+ARG RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base:latest@sha256:02dab76bd852a70556b5b2002195c8a5fdab77d323c433bf6642aab080489795
 ARG FLUXHEIM_CONFIG=packaging/container/fluxheim.toml
 
 FROM ${RUST_IMAGE} AS builder