Security Whitepaper

Security & Network Architecture

A comprehensive technical companion to the Trusted Partner Network (TPN) App & Cloud Security Framework (SE-3.0) and Motion Picture Association (MPA) Content Security Best Practices.

1. Instant Security Verification Commands

Technical Directors and Security Auditors can verify that the running agent has opened zero listening sockets on the storage appliance:

bash

docker exec -it pillar-agent ss -tulpn

Expected output: Completely empty. No TCP or UDP listening sockets are bound.

Verify outbound TLS 1.3 encryption to the Pillar control plane:

bash

curl -vI --tls-max 1.3 https://telemetry.pillarinteractive.com/api/v1/nodes/health-check

2. TPN SE-3.0 & MPA Compliance Matrix

Security Domain	Studio Requirement	Pillar Architectural Implementation	Posture
Media Asset Isolation	Zero read or write access to production film & episodic footage bins.	Datasets (/mnt, /Volumes, /tank, /media) are NEVER mounted into the container namespace.	Verified
Network Exposure	Zero listening sockets; zero inbound NAT port forwards or firewall traversal.	Daemon creates 0 listening sockets. All traffic is strictly outbound TLS 1.3 to TCP:443.	Verified
Execution Hardening	Prevent dropping binaries, privilege escalation, or malware persistence.	--read-only root filesystem, --cap-drop=ALL, and memory-backed tmpfs with noexec.	Verified
Hardware Health Access	Pass-through SMART hardware registers without full root host escalation.	--cap-add=SYS_RAWIO grants single ioctl capability for SG_IO pass-through; no CAP_SYS_ADMIN.	Verified
Metadata Minimization	Compliance with studio NDAs restricting customer metadata transmission.	PILLAR_REDACT_METADATA=true masks drive serials and strips private LAN hostname domains.	Verified

3. Outbound Telemetry Payload Transparency

Inspect the complete raw JSON data structure emitted by the agent to verify that no filesystem hierarchies or media filenames are collected:

Payload Transparency Explorer

Exact Outbound Telemetry Emitted to Port 443

This live, bounded JSON document is the complete payload sent by the edge daemon to telemetry.pillarinteractive.com:443. Notice the complete absence of customer filenames, paths, or directory contents.

outbound-telemetry-snapshot.json

{
  "$schema": "https://pillarinteractive.com/schemas/agent-telemetry-v1.json",
  "schema_version": "2026-03-01",
  "agent_semver": "1.4.2",
  "timestamp": "2026-09-08T20:45:00Z",
  "os": "linux",
  "disks": [
    {
      "device_name": "/dev/sdb",
      "model_family": "Western Digital Ultrastar DC HC550",
      "model_name": "WUH721818ALE6L4",
      "serial_number": "2BH12345",
      "passed": true,
      "temp_c": 34,
      "protocol": "ATA",
      "disk_type": "HDD (7200 RPM)",
      "capacity_bytes": 18000207937536,
      "capacity_human": "18 TB",
      "form_factor": "3.5\"",
      "bus_path": "Enclosure 1, Slot 04",
      "standby": false,
      "reallocated_sectors": 0,
      "wear_level": 0,
      "power_on_hours": 14208
    },
    {
      "device_name": "/dev/nvme0n1",
      "model_family": "Micron 7450 Pro Enterprise NVMe",
      "model_name": "MTFDKCB1T9TFS",
      "serial_number": "22453A8B",
      "passed": true,
      "temp_c": 41,
      "protocol": "NVMe",
      "disk_type": "NVMe SSD",
      "capacity_bytes": 1920383410176,
      "capacity_human": "1.92 TB",
      "form_factor": "M.2",
      "bus_path": "M.2 Slot 1",
      "standby": false,
      "reallocated_sectors": 0,
      "wear_level": 4,
      "power_on_hours": 8940
    }
  ],
  "array_topology": {
    "type": "zfs_raidz2",
    "redundancy": "dual_parity",
    "parity_disks": [
      "/dev/sdb",
      "/dev/sdc"
    ],
    "data_disks": [
      "/dev/sdd",
      "/dev/sde",
      "/dev/sdf",
      "/dev/sdg"
    ],
    "max_drive_capacity_bytes": 18000207937536,
    "rebuild_throughput_est_mbs": 210,
    "estimated_rebuild_seconds": 85714
  },
  "io_bottleneck": {
    "device_name": "/dev/sdd",
    "read_latency_ms": 68.4,
    "write_latency_ms": 11.2,
    "queue_depth": 9.2,
    "iops": 412.5,
    "utilization_pct": 98.4,
    "drop_frame_risk": "critical",
    "target_stream_budget_ms": 41.7
  },
  "scrub_status": {
    "pool_name": "tank_media",
    "is_scrubbing": false,
    "is_resilvering": false,
    "percentage_complete": 100,
    "eta_seconds": 0,
    "playback_degradation_pct": 0,
    "is_within_window": true
  },
  "capacity_velocity": {
    "pool_name": "tank_media",
    "total_bytes": 108000000000000,
    "used_bytes": 81000000000000,
    "free_bytes": 27000000000000,
    "used_percent": 75,
    "is_past_cow_threshold": false,
    "ingest_velocity_gb_per_hour": 340.5,
    "full_exhaustion_days": 15.4
  }
}

4. Container Isolation Flags Specification

--read-only

Locks the entire container root filesystem into read-only mode via Linux VFS. Even if an attacker gained execution inside the container, zero scripts or malicious binaries could be written to disk.

--cap-drop=ALL

Drops all 41 default Linux POSIX capabilities. Strips CAP_SYS_ADMIN, CAP_NET_ADMIN, and CAP_DAC_OVERRIDE, removing any host privilege escalation vector.

--cap-add=SYS_RAWIO

Grants strictly the single capability required to execute raw SG_IO ioctls on block device nodes to read SMART wear registers without granting generic root access.

--tmpfs size=64m,noexec

Allocates a small volatile memory buffer in host RAM for parsing smartctl JSON output. The noexec flag ensures the kernel blocks execution of any binary attempted from this path.