amadan
Nested instances can reach the box's own global addresses (public IPv4 on the interface, global IPv6) Issue open
Found while planning #366 (egress allow, plan 5), by reading main at 64a002c8; not box-verified.
carlos-instance@.service:142 (and the seed, sidecar, cmd and gen templates) deny loopback, RFC 1918, CGNAT, link-local, IMDS and ULA, but not the box's own addresses when those are globally routable. internal/instancectl/localaddrs.go reads the box's own addresses from procfs, but only to refuse a resolver allow (hardening.go:268); nothing renders them into the instance's deny.
Effect: on a box whose interface carries a public IPv4 (a customer fleet box on a VPS or at home) or any global IPv6 address (EC2 with IPv6 on eth0), a nested instance can connect to every listener bound to all addresses on its own box, past any host firewall that filters only inbound traffic from outside. On EC2 without IPv6 the interface address is private and already denied.
Suggested fix: the control service renders the box's own addresses (the same localPrefixes set) as IPAddressDeny= on carlos-instances.slice at start and on change, with a probe check that the box's global addresses are unreachable from inside. Interacts with #366's egress allow: systemd's allow beats deny, so the egress renderer must never emit an address that covers a box-own address (plan 5 already checks this twice).
To verify on a box: from inside a nested instance (carlos run), connect to the box's global IPv6 on a port something listens on with ::.