ConceptsDevelopment Preview
Safety design
In one paragraph#
Local-admin authentication with server-side sessions and derived CSRF; a non-root API; a separate read-only libvirt agent, a separate mutation supervisor and a separate console broker; a closed mutation protocol that carries names, never paths or XML; root-owned trust anchors that no runtime identity can write; AppArmor required; ownership proven before anything destructive.
What is unreachable#
No arbitrary shell or libvirt call is reachable from the browser.
What it does not do#
Safety design is not a security qualification. Release artifacts are not signed, and the web console is served over HTTPS with a self-signed certificate unless you install your own. Bind it to loopback and use an SSH tunnel or a reverse proxy you control if you are unsure.