Stage 05 · Deployment
A production boundary for legacy code
Compatibility code should be easy to observe and hard to escape.
Coexisting with Lasso 9
The 8.6 worker has its own service name, port, document root, and nginx virtual host. The existing Lasso 9 service remains untouched. Only requests for legacy.lairu.org are sent to the Rust compatibility worker.
Static at the edge, Lasso where intended
nginx serves CSS and other public assets directly. It passes only .lasso pages to FastCGI, denies includes and libraries, limits request size, strips server tokens, and supplies the application and namespace roots through protected FastCGI parameters.
Operating-system isolation
Lasso 8 applications can work with files, processes, sockets, mail, and remote services. The public worker therefore runs unprivileged with systemd filesystem protection, a private temporary directory, a bounded address-family set, no capabilities, and a read-only application tree.