Interactive container sessions

Exec, attach, and port-forward requests return short-lived local streaming URLs. Stackie’s production endpoint is a host-leased IPv4 loopback HTTP listener; an explicitly configured HTTPS origin is also accepted. The endpoint negotiates Kubernetes’ default SPDY/3.1 remote-command and port-forward protocols and the version-matched WebSocket channel protocols, so standard kubectl, kubelet, and critest clients work without patches or transport flags.

Each URL contains a cryptographically random token bound to one action and one container or pod sandbox. Tokens are single-use, expire automatically, and are never written to logs or error messages. Stream counts, frames, header blocks, queues, and port-forward connections are bounded. Closing standard input does not terminate an attached container; disconnecting or cancelling a session closes only the process pipes or forwarding sockets owned by that session. TTY requests use a real pseudo-terminal. Kubernetes resize messages are validated by this plugin, translated into typed width/height operations, and applied without passing Kubernetes JSON into the host runtime.