From 958af6ddc7ebbb29c29afd661f2820fe328f9968 Mon Sep 17 00:00:00 2001 From: Evgeny Boger Date: Sat, 13 Jun 2026 15:45:44 +0000 Subject: [PATCH] proxy: honour host HTTP proxy for guest egress + log it at startup MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Behind a corporate/host HTTP proxy, agent-vm could pull its image (the host-side reqwest clients auto-detect HTTPS_PROXY/HTTP_PROXY) but the agent *inside* the VM could not reach the internet: the microsandbox network stack re-originated guest connections directly, bypassing the proxy. This made agent-vm unusable in proxy-only networks. Bump the vendor/microsandbox gitlink to the network-crate change that tunnels guest egress through the host proxy via HTTP CONNECT (preserving the TLS-intercept MITM and egress policy — see the submodule commit). On the host side, also surface the detected proxy verbosely at launch: ==> Proxy: routing guest egress + image pulls through http://proxy:3128 (HTTP CONNECT) ==> Proxy: bypassing (no_proxy) localhost,127.0.0.1,.internal so the operator can see at a glance that all traffic is routed through their proxy. The banner reads the same HTTPS_PROXY/HTTP_PROXY/ALL_PROXY/ NO_PROXY the network stack consumes, via the re-exported microsandbox_network::http_proxy::ProxyConfig::from_env(). Co-Authored-By: Claude Opus 4.8 (1M context) --- crates/agent-vm/src/run.rs | 24 ++++++++++++++++++++++++ vendor/microsandbox | 2 +- 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/crates/agent-vm/src/run.rs b/crates/agent-vm/src/run.rs index ce74b23..7bf7709 100644 --- a/crates/agent-vm/src/run.rs +++ b/crates/agent-vm/src/run.rs @@ -749,6 +749,30 @@ pub async fn launch(agent: Agent, args: Args) -> Result { ); } + // Surface the host HTTP proxy when one is set. Host-side image pulls + // already honour it (reqwest auto-detects the env), and guest egress now + // tunnels through it via HTTP CONNECT — the microsandbox network stack + // reads the same `HTTPS_PROXY`/`HTTP_PROXY`/`ALL_PROXY`/`NO_PROXY` at boot. + // Be loud about it so the operator knows all traffic is routed there. + if let Some(proxy) = microsandbox::microsandbox_network::http_proxy::ProxyConfig::from_env() { + match (proxy.https_display(), proxy.http_display()) { + (Some(s), Some(h)) if s == h => { + eprintln!("==> Proxy: routing guest egress + image pulls through {s} (HTTP CONNECT)"); + } + (https, http) => { + if let Some(s) = https { + eprintln!("==> Proxy: HTTPS/TLS egress + image pulls via {s} (HTTP CONNECT)"); + } + if let Some(h) = http { + eprintln!("==> Proxy: plain-HTTP egress via {h} (HTTP CONNECT)"); + } + } + } + if let Some(no_proxy) = proxy.no_proxy_display() { + eprintln!("==> Proxy: bypassing (no_proxy) {no_proxy}"); + } + } + // For each provider with a host credential file, register a // SecretValue::File secret keyed on the placeholder string the // guest will send, then register the OAuth refresh endpoint as a diff --git a/vendor/microsandbox b/vendor/microsandbox index a5c830d..a05c6b7 160000 --- a/vendor/microsandbox +++ b/vendor/microsandbox @@ -1 +1 @@ -Subproject commit a5c830d2f46509dffdfdb8cc38571b7fcbc94ed5 +Subproject commit a05c6b702db6b70011fd5e22ad52186e76225eff