Skip to content

Document SDK direct routing and KERNEL_BROWSER_ROUTING_SUBRESOURCES #761

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
meliaj wants to merge 1 commit into
base: main
Choose a base branch
from
+25 −0
Open

Document SDK direct routing and KERNEL_BROWSER_ROUTING_SUBRESOURCES #761

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions info/network-access.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,30 @@ Allow only the destinations used by your integration. Apply the Live View and re

Browser URLs are moving to port `443`, which omits `:8443`. Allow both ports during the rollout and use URLs returned by the API without rewriting them.

## SDK direct routing

The Node, Python, and Go SDKs send some browser calls straight to the browser instead of through `api.onkernel.com`: `curl`, `computer`, `playwright`, `process`, `fs`, `logs/stream`, `telemetry/stream`, `repl`, and `webmcp`. These calls use the same domains and ports as `cdp_ws_url`, so a firewall that only allows the API host blocks them.

### Change which calls route directly

Set `KERNEL_BROWSER_ROUTING_SUBRESOURCES` before your program starts.

| Value | Behavior |
| --- | --- |
| Not set | Route the default subresources directly. |
| Empty, or only whitespace | Route nothing directly. Every call goes through the API. |
| Comma-separated list | Route only the subresources you list. |

```bash
# Send every call through the API
export KERNEL_BROWSER_ROUTING_SUBRESOURCES=""

# Route only Playwright and REPL calls directly
export KERNEL_BROWSER_ROUTING_SUBRESOURCES="playwright,repl"
```

Entries match whole path segments, so `fs` covers every `fs/...` endpoint.

## Content security policy

A network allowlist permits traffic leaving your environment. A Content Security Policy (CSP) permits content loaded by your web application. If you embed Live View or replays, configure both.
Expand Down Expand Up @@ -67,3 +91,4 @@ frame-src https://*.onkernel.com
- If browser creation succeeds but CDP, WebDriver BiDi, or Live View won't connect, verify access to both wildcard domains on ports `443` and `8443`.
- If Live View loads but remains disconnected or doesn't show video, verify access to the STUN and TURN destinations.
- If the replay player loads but a recording doesn't play, verify access to the replay file destination.
- If `process`, `fs`, `playwright`, or `repl` calls time out but browser creation works, allow both wildcard domains on ports `443` and `8443`, or set `KERNEL_BROWSER_ROUTING_SUBRESOURCES=""`.
Loading