2 ms·
Hey, that looks great. Could you describe more about the docker sandbox that you have? I am especially interested in the network restrictions.
by ustad 1y ago
Hey, that looks great.
Could you describe more about the docker sandbox that you have? I am especially interested in the network restrictions.
- darubramha 1y agoThe sandbox is a lightweight Alpine-based container, it runs as a non-root user for security, it has minimal dependencies installed (curl, bash, coreutils) The container has restricted outbound access—only HTTP/S requests are allowed. It runs inside an isolated network namespace with no access to the host network or other infrastructure components. There's no inbound access, and the container can't receive unsolicited requests from the outside world. The sandbox container can only communicate with other containers in the same network, the main application container and sandbox container are on the same network, allowing them to communicate.
- ustad 1y agoThanks for the details! Do you think there could be ways for someone to abuse the network setup you have? For example, accessing other internet hosts or other containers in the same container network? What happens when curl gets redirect responses?