System Architecture

SentinelOS uses Go as its main engine to orchestrate underlying Linux subsystems. The architecture is modular and decouples the REST API layer from the execution layer.

Transactional Engine

The core of SentinelOS lies in the config and runtime packages. When a commit is requested, the system performs rigorous validations before touching the Linux kernel.

  1. Validation Phase: The engine checks for logical errors like overlapping IP subnets or invalid VLAN attachments.
  2. Diff Generation: The engine compares Candidate Config with Running Config to generate minimal execution steps.
  3. Atomic Application: Networking scripts execute. If any command fails, the engine triggers an immediate rollback.

Firewall Evaluation: First Match Win

SentinelOS policies are evaluated top to bottom. The first matching rule determines the packet destination. Rule order is critical.

Use the API to move rules without deleting and recreating them:

{
  "reference_id": 105,
  "position": "before"
}

NAT and Routing

NAT rules are evaluated independently of security policies. Security policies evaluate real IPs after DNAT or before SNAT is applied.