ScottW514
2894269115
The way through the extension sandbox's deny rules is an allowlist, and an allowlist names addresses. The machine's own LAN address is not a fact anybody can pin: a new DHCP lease can turn a peer's address on some package's list into the machine's, and with it open the Grbl port or forgectrl's listeners to that package. ffx.nft now refuses it structurally. Everything a host sends to one of its own addresses, the LAN one included, leaves through lo, so chain pool refuses `oifname "lo"` before it looks at the allow map; the two refusals (a reset for TCP, a drop for the rest, both counted) move into chain refuse, which pool jumps to from both places. No kernel option is new: oifname is in the nf_tables core. scripts/sandbox-rules-test.py gets a destination that is not the machine: a second network namespace joined by a veth pair, with listeners of its own. A pool uid is refused on loopback, IPv6 loopback, its own LAN address, and the peer; an allow chain opens one port of the peer to one uid and nothing else; with loopback, IPv6 loopback, and the machine's own address added to that list the uid is still refused at all three while the peer still answers; a reload closes it. It needs ip and nsenter now. exthost.platform reads its counters from chain refuse, holds the rule's place ahead of the map, and adds the case on the machine: an allow chain for the last pool uid that names forgectrl on loopback and on the LAN address opens neither, and the chain is removed. Proven. The rules test passes with nft 1.0.9, and four controls each fail it: the range one uid short, the TCP reject turned to accept, the delete-table line removed, and the lo rule removed (the uid then reaches all three of the machine's addresses). On the bench reference, image 20260920211625, this rule file loaded from /tmp with nft -f and this suite file mounted: exthost.platform PASS, uid 831 refused at 127.0.0.1:443 and 172.16.1.97:443 with both on its allowlist, the counters [0, 0] to [12, 4]. Against the image's own rules the same test fails on the rule's absence, which is the control. The image's rules were reloaded after. The unit suite passes (422). Acceptance. exthost.platform gates the rule on the machine; sandbox-ci gates the file. The rule file is layer content, in the platform identity of every fingerprint.
OpenGlow / ForgeFIRM firmware for Glowforge
BETA
ForgeFIRM is in beta. Every release below 0.1.0 is a beta release. Expect problems, and expect frequent updates. Upgrade whenever a newer release is available, and report what you find on the community forum.
Open firmware for Glowforge brand CNC lasers. ForgeFIRM replaces the cloud-dependent factory software on the stock control board, with no hardware modification, and gives the machine a local controller, a local web control panel, and a standard Grbl interface. The factory cloud experience stays available as an option.
This repository is the base of the build and of the release: the
meta-forgefirm Yocto layer, the kas configuration, the image recipes, the
install and release scripts, the acceptance tool (forgetest/), the bench
tools (scripts/bench/), the bench actuator firmware (fixture/), and the
release artifacts (releases/).
Start here
https://docs.forgefirm.org/ is the documentation, and the source of truth for every fact about the machine and the firmware.
| Read this first | Safety |
| Put it on a machine | Installation |
| Use it | Usage, LightBurn |
| How the machine works | Technical |
| How ForgeFIRM works with it | ForgeFIRM internals |
| Build, test, release | Developers |
| Downloads | Releases |
| Questions | Community forum |
Build
kas build kas/forgefirm-glowforge.yml
Build covers the host setup, the two images, the source variant and the debug kernel. Release flow covers the pins, the push order and the signing pipeline.
Test
cd forgetest && python3 -m unittest discover -s tests -v
The acceptance catalog that gates a release, and the bench tools, are on Acceptance and The bench.
Contributing
AGENTS.md carries the rules for this repository and for the project: safety ordering, proof before done, the push order, and the writing rules. They apply to human contributors too, and Contribute is the same set on the site.
What this costs
Nothing. ForgeFIRM is free in both senses, under MIT and GPL licenses. There is no paid tier, no license key, no subscription and no Pro edition. If someone offers to sell it to you, the licenses allow it, but what you take home is their build rather than this one: get it from the source.
Safety
These machines contain a CO2 laser: it burns, blinds, and starts fires. Never defeat the lid switches or the interlock. Never leave a running job unattended. Keep a fire extinguisher within reach. Read Safety before you cut your first job, and Regulatory and legal before you install.
This is experimental software. Use of it could seriously maim or kill you or others, and it may void your warranty. Use it at your own risk.
Glowforge is a trademark of Glowforge, Inc. This project is not affiliated with, authorized by, or endorsed by Glowforge, Inc.