fix(sandbox): default network to plain allow; stop claiming a metadata-endpoint block - #853
Merged
Merged
Conversation
…a-endpoint block
Neither the Docker nor the Kubernetes provider enforces an allow-mode
denylist, so the default { mode: "allow", denylist: ["169.254.169.254"] }
claimed a block that never happened. Default to { mode: "allow" } and
correct the docs, blog copy, and JSDoc to say plainly that allow mode is
open egress (cloud metadata endpoint included), recommending deny mode or
an egress control outside B4.run.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…curacy text Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
blove
enabled auto-merge (squash)
September 25, 2026 19:55
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The default sandbox network policy was
{ mode: "allow", denylist: ["169.254.169.254"] }, but neither reference provider enforces an allow-modedenylist:--network bridgeand never reads the denylist. Deny mode (--network none) also ignoresallowlist.b4-sandbox-infrachart's default-deny egress backstop (on by default, and needing a policy-enforcing CNI) blocks the metadata endpoint.The docs described the default as blocking the cloud metadata endpoint "best-effort", and
configuration.mdxsaid it "denies" it. The endpoint was always reachable from an allow-mode sandbox.This PR makes the default honest instead of adding enforcement:
DEFAULT_NETWORKis now{ mode: "allow" }. Runtime behavior is unchanged, because egress was open before and is open now.SandboxPolicy.networkJSDoc and the Docker/Kubernetes provider comments say which lists each provider ignores.docs/sandbox,docs/configuration, theapi/workspacefield row, and two blog posts now say plainly that allow mode is open egress, metadata endpoint included. They recommend{ mode: "deny" }, or a host firewall/egress proxy (Docker) or the chart backstop/NetworkPolicy (Kubernetes).allowlist: ["api.openai.com"]was wrong too (Kubernetes takes CIDRs, Docker ignores the list). It's now a CIDR with a note.check-docs.mjspins updated: the sandbox page now must carry the "not enforced" and "metadata endpoint reachable" sentences instead of "best-effort".@b4run/cli,@b4run/workspace,@b4run/sandbox. SEO lastmod regenerated.Test plan
resolve-sandbox.test.tscase asserts the provider receives{ mode: "allow" }; confirmed failing against the old default firstpnpm lint,pnpm build,pnpm typecheck,pnpm test:release-integritynode scripts/check-docs.mjs,pnpm --dir apps/web test,seo:lastmod:check@b4run/cli,@b4run/workspace,@b4run/sandboxtest suites🤖 Generated with Claude Code