Sandbox Firewall

Archil’s persistent sandboxes support defining a network policy to filter network egress from the sandbox. This is useful when running untrusted workloads, including agents. The sandbox firewall operates on both the IP and transport layer, so you can filter both CIDR ranges and domains. To deny all network egress you can set the default to deny. On top of this, you can apply additional deny and allow rules to whitelist certain targets. For example:

import * as archil from "disk";

const sandbox = await archil.createSandbox({
  network: {
    egress: {
      default: "deny",
      allow: ["192.168.14.0/24", "*.github.com"],
    }
  }
});

Domain filtering

Domain filtering applies to all HTTP traffic (ports 80/443). HTTP/3 is blocked when domain filters are in place. It validates SNI using the TLS ClientHello, the Host header, and the URI authority for every request. If any are denied, then the request will be rejected. To support this, our egress proxy must terminate TLS, so we install an “archil egress” proxy CA into every sandbox.

Credential brokering

For HTTP egress, we also support defining rules for transforming requests. This means that secret credentials can live outside the sandbox, so untrusted workloads cannot access them directly. For example, you can add API keys to outgoing HTTP requests so your sandbox never sees them:

import * as archil from "disk";

const sandbox = await archil.createSandbox({
  network: {
    egress: {
      default: "deny",
      allow: [{
        target: "api.github.com",
        transform: {
          headers: {
            Authorization: `Bearer ${process.env.GITHUB_TOKEN}`
          }
        }
      }],
    }
  }
});

Dynamic Updates

Network policy can be updated dynamically, even while a sandbox is running. For example you can:

initially pull data from an S3 bucket
deny all egress while an agent is running
run a verifier and upload evaluation results

import * as archil from "disk";

const sandbox = await archil.createSandbox({
  network: {
    egress: {
      default: "deny",
      allow: ["data-bucket.s3.us-east-1.amazonaws.com"],
    }
  }
});

// download data...

await sandbox.updateNetworkPolicy({
  egress: {
    default: "deny",
  }
});

// run agent...

await sandbox.updateNetworkPolicy({
  egress: {
    default: "deny",
    allow: ["result-bucket.s3.us-east-1.amazonaws.com"]
  }
});

// run verifier...

Getting started

Compute

Concepts

Data Sources

Details

Administration

Protocols

Reference

Legal

Sandbox Firewall

Domain filtering

Credential brokering

Dynamic Updates

​Domain filtering

​Credential brokering

​Dynamic Updates

Domain filtering

Credential brokering

Dynamic Updates