Lines 1-37javascript
1import { mkdirSync, writeFileSync } from "fs";
2import { join } from "path";
3import { DEFAULT_ALLOWLIST, mergeAllowlist } from "./egress-allowlist.js";
5 * Egress firewall config generation for the docker sandbox backend.
7 * Architecture (replaces the earlier tinyproxy CONNECT-proxy):
9 * sandbox-egress (internal: true, subnet 172.30.0.0/24)
10 * ├─ sandbox containers (docker run --dns <coredns-ip>)
11 * ├─ coredns-strict 172.30.0.10 → returns nginx-strict IP for allowlist hosts, NXDOMAIN otherwise
12 * ├─ coredns-open 172.30.0.11 → returns nginx-open IP for ANY hostname (except hard-deny SSRF magnets)
13 * ├─ nginx-egress-strict 172.30.0.20 → ssl_preread, SNI must match allowlist; tunnel upstream via proxy-egress
14 * └─ nginx-egress-open 172.30.0.21 → tunnel any SNI; client DNS already gated through coredns-open
16 * Why this instead of a forward proxy (tinyproxy/smokescreen): clients
17 * inside the sandbox (especially the OpenAI/Anthropic SDKs that build
18 * their own undici dispatchers) don't honour HTTP_PROXY / HTTPS_PROXY.
19 * Forcing them to cooperate is a losing battle. By spoofing DNS and
HighCloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/sandbox/egress-firewall-config.jsView on unpkg · L17 20 * peeking SNI at the network layer, the sandbox sees no proxy at all —
21 * it dials `api.openai.com:443` directly. The firewall intercepts the
22 * connection by virtue of being the only thing the spoofed DNS pointed
25 * Inspired by Vercel Sandbox's egress firewall (SNI peeking, no env
26 * vars). Their implementation also handles TLS termination for
27 * credentials brokering and Postgres STARTTLS — we don't (yet).
31 * Entries in egress-allowlist.ts with a leading dot (`".github.com"`)
32 * match the apex plus every subdomain. nginx's `map` directive supports
33 * this syntax natively. CoreDNS uses the `template` plugin with an
34 * anchored regex to do the same.
36/** Fixed IPs assigned in docker-compose.yml so `--dns` and nginx upstreams can reference them. */
37export const COREDNS_STRICT_IP = "172.30.0.10";