On Runtime, the egress proxy runs on the host, outside each microVM. A
sandbox has no network card, so it cannot bypass the proxy. Programs that
use HTTP_PROXY and programs that open raw sockets face the same rules,
including root (security). The same proxy
lets a sandbox use an API key that it never holds.
Why it matters for AI agents
Rules that run inside the machine can be undone by whatever runs there. An
agent with sudo can rewrite iptables, unset a proxy variable or start a
program that ignores the proxy. A proxy placed outside the machine is out of
reach. The only way out is through it. Its allow list, its limits and its log
show what actually left the machine.
A proxy that terminates HTTPS for chosen hosts can also add a credential to a request on its way out. The code inside the sandbox sends a placeholder. The proxy attaches the real value outside the sandbox, where the sandbox cannot reach it.
Where the proxy sits on Runtime
| Question | On Runtime |
|---|---|
| Where it runs | On the host, outside the Firecracker microVM |
| How traffic reaches it | The sandbox has no network card. TCP leaves it. UDP to any public address and port also leaves it on paid sandboxes. DNS is answered inside the sandbox |
| Programs that ignore proxy settings | Their TCP connections still go to the same proxy |
| Docker containers in the sandbox | Get HTTP_PROXY and HTTPS_PROXY set to http://172.17.0.1:10800 |
| What it enforces | Per-sandbox allow, deny and connect rules. Private addresses are always refused. |
| Limits | Concurrent connections, bandwidth and bytes per day, per sandbox |
| Runtime's relays in the sandbox | Ports 10800, 10802 and 10853. These ports are never reachable from outside the sandbox. |
Rule changes take effect immediately. This includes connections that are already open (the network).
Attach a key on the way out
Store the key once, with the hosts it may be sent to. With header, the proxy
sets that header on every HTTPS request to those hosts. The code needs no
placeholder at all:
TypeScriptimport { Runtime } from "withruntime";const runtime = new Runtime();await runtime.secrets.set("GITHUB_TOKEN", { value: process.env.GITHUB_TOKEN ?? "", hosts: ["api.github.com"], header: "Authorization", format: "token {value}",});Terminalprintf %s "$OPENAI_API_KEY" | runtime secrets set OPENAI_API_KEY --host api.openai.comTo do this, the proxy opens the HTTPS connection to those hosts itself. It
checks the real server's certificate. Sandboxes already trust Runtime's
certificate for those hosts through SSL_CERT_FILE, REQUESTS_CA_BUNDLE and
NODE_EXTRA_CA_CERTS. Plain HTTP never carries a secret. Request bodies are
never rewritten (secrets).
Related
- What is egress control?
- What is prompt injection?
- How to turn off a sandbox's internet
- Run Docker in a sandbox
Facts on this page were checked on 25 October 2026.