Sandbox Network Egress

Sandbox Network Egress A sequence diagram generated by Archify. CONNECT host.containers.internal:4000 check binary + endpoint allow forward HTTPS API call completion response tunnel response CONNECT example.com:443 check binary + endpoint deny 403 Forbidden Allowed inference request Blocked egress Goose CLI · agent namespace · Sequence participant Goose CLI agent namespace CONNECT Proxy · veth0 10.200.0.1 · Sequence participant CONNECT Proxy veth0 10.200.0.1 OPA Engine · Rego policy · Sequence participant OPA Engine Rego policy LiteLLM · host :4000 · Sequence participant LiteLLM host :4000 LLM Provider · upstream · Sequence participant LLM Provider upstream Legend request return security async trace default message

Allowed Path

  • • Binary identity verified via /proc/{pid}/exe
  • • Endpoint matches network_policies declaration
  • • Tunnel established through CONNECT proxy

Blocked Path

  • • Undeclared endpoint rejected by OPA
  • • 403 returned to agent — no silent drop
  • • Binary identity still checked (defense in depth)

Host Resolution

  • • host.containers.internal → 169.254.1.2 in container
  • • Proxy resolves from container namespace
  • • SSRF protection exempts exact hostname