Add a Docker container mode for the proxy, where containers become first-class mesh principals and the host acts as their carrier. Today the proxy is host-centric: it intercepts traffic in the host namespace, resolves names through the trust engine, routes local traffic to localhost, and tunnels remote traffic over mTLS. That works for host services, but it does not give us a clean way to express per-container identity and authorization in container deployments. The direction here is to introduce host-managed identities for attached containers, endorse name -> container IMID, route DNS/proxy/connect paths by the attached target IMID, and make inbound authorization and dispatch target-principal-aware. The host should carry traffic for local containers without collapsing them into a single host principal.
Add a Docker container mode for the proxy, where containers become first-class mesh principals and the host acts as their carrier. Today the proxy is host-centric: it intercepts traffic in the host namespace, resolves names through the trust engine, routes local traffic to localhost, and tunnels remote traffic over mTLS. That works for host services, but it does not give us a clean way to express per-container identity and authorization in container deployments. The direction here is to introduce host-managed identities for attached containers, endorse
name -> container IMID, route DNS/proxy/connect paths by the attached target IMID, and make inbound authorization and dispatch target-principal-aware. The host should carry traffic for local containers without collapsing them into a single host principal.