Repository navigation
Restrict sandbox egress with an allow-list - #72
Merged
Merged
Conversation
createSandbox now requires the hosts a sandbox may reach and creates it with an allow-list network policy. It refuses a sandbox whose reported policy admits more. The build sandbox reaches the npm registry and the two apt mirrors its Postgres installs from, set in factoryConfig.sandbox.buildEgress. The publish sandbox reaches only github.com. The allow-list admits HTTPS only and the image's apt sources are HTTP, so the Postgres install reads two HTTPS sources of its own. Moves to @renderinc/sdk 1.5, where the sandbox client is render.sandboxes. Closes #65 Co-authored-by: Cursor <cursoragent@cursor.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #65. Allow-list egress is available in the Sandboxes API (
@renderinc/sdk1.5). The API schema still marks it pre-GA, but this repo already relies on Sandboxes early access.What changes
createSandboxnow requires anegresshost list and creates the sandbox withnetworkPolicy: { type: "allow-list" }. No sandbox can fall back to Render's defaultallow-all.allow-listor names hosts that weren't requested. If Render rejects the create, the error names the hosts and says the workspace may not support allow-list egress.factoryConfig.sandbox.buildEgress=registry.npmjs.org,deb.debian.org,apt.postgresql.org.github.comonly. Tokens are fetched on the workflow host, so the sandbox doesn't needapi.github.com.apt-get install postgresqlwould fail.START_POSTGRESnow uses a temporary sources list with two HTTPS sources.render.experimental.sandboxestorender.sandboxes, andTaskContextgainedmetadata.docs/2_ARCHITECTURE.md, including the DNS channel the issue mentions, plus the setting indocs/1_EXTENSION.md.Tested against real sandboxes
Build sandbox, created through the new
createSandbox:ensureSandboxPostgresinstalled PostgreSQL 18.6 from the HTTPS mirrors.npm install vite react react-dom esbuild pg typescript tsxsucceeded, including esbuild's platform binary.127.0.0.1works, so verification's local health checks still work.example.comandgithub.comare blocked.Publish sandbox:
git ls-remote https://github.com/...works.registry.npmjs.organdapi.github.comare blocked.npm run checkpasses: 108 tests, including a newwiderEgresstest and an assertion on which hosts each sandbox gets.Risk
A generated stack that downloads during install from a host other than npm will now fail in verification. Examples are packages that fetch binaries from GitHub releases, or a non-Node toolchain. The fix is to add the host to
buildEgress. Please run one full fullstack prompt end to end before merging.Made with Cursor