feat(proxy): support HTTPS sandbox backends by jakubno · Pull Request #3280 · e2b-dev/infra

jakubno · 2026-07-13T10:07:56Z

Allow sandbox network config to select HTTPS per port. Accept self-signed backend certificates on trusted orchestrator-to-sandbox hop.

linear-code · 2026-07-13T10:08:00Z

EN-1710

cursor · 2026-07-13T10:08:03Z

PR Summary

Medium Risk
Changes the ingress data path and disables TLS certificate verification on orchestrator-to-sandbox HTTPS hops; misconfiguration or a compromised slot network could be harder to detect than with verified certs.

Overview
Sandbox network config can list httpsPorts so public ingress to those ports is proxied to the VM with an https backend instead of http, with backend TLS verification turned off for self-signed certs inside the sandbox.

The setting is validated on create (limits, duplicates, reserved envd port), stored on ingress config, returned on get, and carried through orchestrator create, node re-sync, and paused snapshot JSON. The orchestrator sandbox proxy picks the backend scheme per port and the shared reverse-proxy pool can skip TLS verify and uses a bounded TLS handshake timeout for HTTPS backends.

^{Reviewed by Cursor Bugbot for commit f2b7e96. Bugbot is set up for automated code reviews on this repo. Configure here.}

codecov · 2026-07-13T10:10:02Z

❌ 11 Tests Failed:

Tests completed	Failed	Passed	Skipped
3324	11	3313	9

View the top 3 failed test(s) by shortest run time

github.com/e2b-dev/infra/tests/integration/internal/tests/api/templates::TestTemplateBuildRUN

Stack Traces | 0s run time

=== RUN   TestTemplateBuildRUN
=== PAUSE TestTemplateBuildRUN
=== CONT  TestTemplateBuildRUN
--- FAIL: TestTemplateBuildRUN (0.00s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_0_lists_only_root_directory

Stack Traces | 0.02s run time

=== RUN   TestListDir/depth_0_lists_only_root_directory
=== PAUSE TestListDir/depth_0_lists_only_root_directory
=== CONT  TestListDir/depth_0_lists_only_root_directory
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_0_lists_only_root_directory
--- FAIL: TestListDir/depth_0_lists_only_root_directory (0.02s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_1_lists_root_directory

Stack Traces | 0.02s run time

=== RUN   TestListDir/depth_1_lists_root_directory
=== PAUSE TestListDir/depth_1_lists_root_directory
=== CONT  TestListDir/depth_1_lists_root_directory
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_1_lists_root_directory
--- FAIL: TestListDir/depth_1_lists_root_directory (0.02s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)

Stack Traces | 0.02s run time

=== RUN   TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
=== PAUSE TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
=== CONT  TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
--- FAIL: TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory) (0.02s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir

Stack Traces | 3.99s run time

=== RUN   TestListDir
=== PAUSE TestListDir
=== CONT  TestListDir
Executing command findmnt in sandbox i0iz4pdkl30evz9ncuiuc (user: root)
--- FAIL: TestListDir (3.99s)

github.com/e2b-dev/infra/tests/integration/internal/tests/api/templates::TestUpdateTemplateNotOwnedByTeam

Stack Traces | 156s run time

=== RUN   TestUpdateTemplateNotOwnedByTeam
=== PAUSE TestUpdateTemplateNotOwnedByTeam
=== CONT  TestUpdateTemplateNotOwnedByTeam
    template_update_test.go:205: Build failed: {<nil> An internal error occurred. Please try again or contact support with the build ID. <nil>}
--- FAIL: TestUpdateTemplateNotOwnedByTeam (156.25s)

github.com/e2b-dev/infra/tests/integration/internal/tests/api/templates::TestSandboxCreateWithAliasAndTag

Stack Traces | 169s run time

=== RUN   TestSandboxCreateWithAliasAndTag
=== PAUSE TestSandboxCreateWithAliasAndTag
=== CONT  TestSandboxCreateWithAliasAndTag
    template_tags_test.go:207: Build failed: {<nil> An internal error occurred. Please try again or contact support with the build ID. <nil>}
--- FAIL: TestSandboxCreateWithAliasAndTag (169.26s)

github.com/e2b-dev/infra/tests/integration/internal/tests/api/templates::TestTemplateTagAssign

Stack Traces | 169s run time

=== RUN   TestTemplateTagAssign
=== PAUSE TestTemplateTagAssign
=== CONT  TestTemplateTagAssign
    template_tags_test.go:28: Build failed: {<nil> An internal error occurred. Please try again or contact support with the build ID. <nil>}
--- FAIL: TestTemplateTagAssign (169.38s)

github.com/e2b-dev/infra/tests/integration/internal/tests/api/templates::TestTemplateBuildRUN/Single_RUN_command

Stack Traces | 172s run time

=== RUN   TestTemplateBuildRUN/Single_RUN_command
=== PAUSE TestTemplateBuildRUN/Single_RUN_command
=== CONT  TestTemplateBuildRUN/Single_RUN_command
    build_template_test.go:133: test-ubuntu-run: [info] Building template ldw4syzye8oh34236rr6/8192d2dc-8230-44e0-bacb-98497e1b3d9e
    build_template_test.go:133: test-ubuntu-run: [info] [base] FROM ubuntu:22.04 [f9f564014e009a9561a82bf8c84f9314242971e833fb019936654ecba452f184]
    build_template_test.go:133: test-ubuntu-run: [info] Base Docker image size: 30 MB
    build_template_test.go:133: test-ubuntu-run: [info] Creating file system and pulling Docker image
    build_template_test.go:133: test-ubuntu-run: [info] Uncompressing layer sha256:d6834b4a794c03efa2c998853e64969fa8851b11b2ade63292268872a37759d0 30 MB
    build_template_test.go:133: test-ubuntu-run: [info] Uncompressing layer sha256:a0d2cc572085b4c29e03f02cdc779d1ce181f86b2b96b5355d9864817bf57919 13 MB
    build_template_test.go:133: test-ubuntu-run: [info] Uncompressing layer sha256:8c4b1b28875140ed3abacaf16ad0d696f6bef912f52d2148f261a23e3349465b 168 B
    build_template_test.go:133: test-ubuntu-run: [info] Layers extracted
    build_template_test.go:133: test-ubuntu-run: [info] Root filesystem structure: bin, boot, dev, etc, home, lib, lib32, lib64, libx32, media, mnt, opt, proc, root, run, sbin, srv, sys, tmp, usr, var
    build_template_test.go:133: test-ubuntu-run: [info] Provisioning sandbox template
    build_template_test.go:133: test-ubuntu-run: [info] Provisioning was successful, cleaning up
    build_template_test.go:133: test-ubuntu-run: [info] Sandbox template provisioned
    build_template_test.go:133: test-ubuntu-run: [info] [base] DEFAULT USER user [49e586c2171254c6bc4a09e84eedac32dbcf113a158c24248129af2f49cbed74]
    build_template_test.go:133: test-ubuntu-run: [info] [builder 1/1] RUN echo 'Hello, World!' [c72b4f813c2a16b0fc1a1c5da7b1365a304cbac516b22dc304a71f70aae48ac0]
    build_template_test.go:133: test-ubuntu-run: [info] [builder 1/1] [stdout]: Hello, World!
    build_template_test.go:133: test-ubuntu-run: [info] [finalize] Finalizing template build [92c524e30533398ebb41ce04c2596130f0cdecc9aa328e28fdb16a1b11f61d62]
    build_template_test.go:133: test-ubuntu-run: [error] Build failed: An internal error occurred. Please try again or contact support with the build ID.
    build_template_test.go:166: Build failed: {<nil> An internal error occurred. Please try again or contact support with the build ID. <nil>}
--- FAIL: TestTemplateBuildRUN/Single_RUN_command (171.53s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestCommandKillNextApp

Stack Traces | 273s run time

=== RUN   TestCommandKillNextApp
=== PAUSE TestCommandKillNextApp
=== CONT  TestCommandKillNextApp
    process_test.go:30: Build failed: {<nil> An internal error occurred. Please try again or contact support with the build ID. <nil>}
--- FAIL: TestCommandKillNextApp (273.13s)

View the full list of 1 ❄️ flaky test(s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_3_lists_all_directories_and_files

Flake rate in main: 30.77% (Passed 9 times, Failed 4 times)

Stack Traces | 0.01s run time

=== RUN   TestListDir/depth_3_lists_all_directories_and_files
=== PAUSE TestListDir/depth_3_lists_all_directories_and_files
=== CONT  TestListDir/depth_3_lists_all_directories_and_files
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_3_lists_all_directories_and_files
--- FAIL: TestListDir/depth_3_lists_all_directories_and_files (0.01s)

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

gemini-code-assist

Code Review

This pull request introduces support for HTTPS backend routing within sandboxes, allowing public URLs to connect to configured sandbox ports over HTTPS with backend certificate verification disabled (supporting self-signed certificates). It updates the API spec, database models, orchestrator protobuf, and proxy logic to handle the new httpsPorts configuration, along with adding validation and comprehensive integration tests. The feedback suggests a memory-safety improvement in sandbox_get.go to avoid taking the address of a struct field directly, which could prevent the garbage collection of the parent struct.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

fix

feat(proxy): support HTTPS sandbox backends

c90d6b2

Allow sandbox network config to select HTTPS per port. Accept self-signed backend certificates on trusted orchestrator-to-sandbox hop.

gemini-code-assist Bot reviewed Jul 13, 2026

View reviewed changes

Comment thread packages/api/internal/handlers/sandbox_get.go

lint

129aeff

cla-bot Bot added the cla-signed label Jul 13, 2026

jakubno marked this pull request as ready for review July 13, 2026 11:18

jakubno requested review from ValentaTomas and dobrac as code owners July 13, 2026 11:18

claude Bot reviewed Jul 13, 2026

View reviewed changes

Comment thread packages/api/internal/handlers/sandbox_create.go

jakubno added 4 commits July 13, 2026 12:04

fix(api): bound HTTPS backend ports

cfd74cf

move to a helper function

a15ed0c

set limit for TLS handshake

57bc9ec

move TLSHandshakeTimeout to constant

f2b7e96

fix

jakubno force-pushed the en-1710/https-sandbox-backends branch from b12e821 to f2b7e96 Compare July 13, 2026 12:57

mishushakov mentioned this pull request Jul 13, 2026

feat(sdk): add httpsPorts network config for HTTPS sandbox backends e2b-dev/E2B#1546

Draft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(proxy): support HTTPS sandbox backends#3280

feat(proxy): support HTTPS sandbox backends#3280
jakubno wants to merge 6 commits into
mainfrom
en-1710/https-sandbox-backends

jakubno commented Jul 13, 2026

Uh oh!

linear-code Bot commented Jul 13, 2026

Uh oh!

cursor Bot commented Jul 13, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jul 13, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

jakubno commented Jul 13, 2026

Uh oh!

linear-code Bot commented Jul 13, 2026

Uh oh!

cursor Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

codecov Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ 11 Tests Failed:

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

cursor Bot commented Jul 13, 2026 •

edited

Loading

codecov Bot commented Jul 13, 2026 •

edited

Loading