From 958af6ddc7ebbb29c29afd661f2820fe328f9968 Mon Sep 17 00:00:00 2001 From: Evgeny Boger Date: Sat, 13 Jun 2026 15:45:44 +0000 Subject: [PATCH 1/3] proxy: honour host HTTP proxy for guest egress + log it at startup MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Behind a corporate/host HTTP proxy, agent-vm could pull its image (the host-side reqwest clients auto-detect HTTPS_PROXY/HTTP_PROXY) but the agent *inside* the VM could not reach the internet: the microsandbox network stack re-originated guest connections directly, bypassing the proxy. This made agent-vm unusable in proxy-only networks. Bump the vendor/microsandbox gitlink to the network-crate change that tunnels guest egress through the host proxy via HTTP CONNECT (preserving the TLS-intercept MITM and egress policy — see the submodule commit). On the host side, also surface the detected proxy verbosely at launch: ==> Proxy: routing guest egress + image pulls through http://proxy:3128 (HTTP CONNECT) ==> Proxy: bypassing (no_proxy) localhost,127.0.0.1,.internal so the operator can see at a glance that all traffic is routed through their proxy. The banner reads the same HTTPS_PROXY/HTTP_PROXY/ALL_PROXY/ NO_PROXY the network stack consumes, via the re-exported microsandbox_network::http_proxy::ProxyConfig::from_env(). Co-Authored-By: Claude Opus 4.8 (1M context) --- crates/agent-vm/src/run.rs | 24 ++++++++++++++++++++++++ vendor/microsandbox | 2 +- 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/crates/agent-vm/src/run.rs b/crates/agent-vm/src/run.rs index ce74b23..7bf7709 100644 --- a/crates/agent-vm/src/run.rs +++ b/crates/agent-vm/src/run.rs @@ -749,6 +749,30 @@ pub async fn launch(agent: Agent, args: Args) -> Result { ); } + // Surface the host HTTP proxy when one is set. Host-side image pulls + // already honour it (reqwest auto-detects the env), and guest egress now + // tunnels through it via HTTP CONNECT — the microsandbox network stack + // reads the same `HTTPS_PROXY`/`HTTP_PROXY`/`ALL_PROXY`/`NO_PROXY` at boot. + // Be loud about it so the operator knows all traffic is routed there. + if let Some(proxy) = microsandbox::microsandbox_network::http_proxy::ProxyConfig::from_env() { + match (proxy.https_display(), proxy.http_display()) { + (Some(s), Some(h)) if s == h => { + eprintln!("==> Proxy: routing guest egress + image pulls through {s} (HTTP CONNECT)"); + } + (https, http) => { + if let Some(s) = https { + eprintln!("==> Proxy: HTTPS/TLS egress + image pulls via {s} (HTTP CONNECT)"); + } + if let Some(h) = http { + eprintln!("==> Proxy: plain-HTTP egress via {h} (HTTP CONNECT)"); + } + } + } + if let Some(no_proxy) = proxy.no_proxy_display() { + eprintln!("==> Proxy: bypassing (no_proxy) {no_proxy}"); + } + } + // For each provider with a host credential file, register a // SecretValue::File secret keyed on the placeholder string the // guest will send, then register the OAuth refresh endpoint as a diff --git a/vendor/microsandbox b/vendor/microsandbox index a5c830d..a05c6b7 160000 --- a/vendor/microsandbox +++ b/vendor/microsandbox @@ -1 +1 @@ -Subproject commit a5c830d2f46509dffdfdb8cc38571b7fcbc94ed5 +Subproject commit a05c6b702db6b70011fd5e22ad52186e76225eff From 885aa026d15367473e03bd562a28700603bf9b3d Mon Sep 17 00:00:00 2001 From: Evgeny Boger Date: Sat, 27 Jun 2026 18:26:25 +0300 Subject: [PATCH 2/3] vendor: point submodule at merged wb (microsandbox#4) Update the gitlink from the PR branch head to the wb merge commit d6b9b11 now that microsandbox#4 is merged. Co-Authored-By: Claude Opus 4.8 (1M context) --- vendor/microsandbox | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vendor/microsandbox b/vendor/microsandbox index a05c6b7..d6b9b11 160000 --- a/vendor/microsandbox +++ b/vendor/microsandbox @@ -1 +1 @@ -Subproject commit a05c6b702db6b70011fd5e22ad52186e76225eff +Subproject commit d6b9b11732771266169beb4043a4164235a67d64 From 05e8969215785d2c6dd8d2ed9ff05a16954f2ddf Mon Sep 17 00:00:00 2001 From: Evgeny Boger Date: Sat, 27 Jun 2026 18:32:16 +0300 Subject: [PATCH 3/3] v0.1.25: route guest egress through host HTTP proxy (CONNECT) Headline changes since 0.1.24: - network: all guest egress (HTTPS/HTTP/image pulls) is re-originated through the configured host HTTP proxy via CONNECT, honouring HTTPS_PROXY/HTTP_PROXY/ ALL_PROXY and NO_PROXY, while preserving the TLS-intercept egress policy. - fails closed: a configured-but-unreachable proxy errors instead of silently dialing direct. - security: reject control chars/whitespace in the CONNECT target host and in parsed SNI, closing a guest-controlled CRLF/header-injection vector. - run: verbose startup banner reporting the proxy route (and NO_PROXY bypass). - vendor/microsandbox bumped to wb merge of microsandbox#4. Co-Authored-By: Claude Opus 4.8 (1M context) --- Cargo.lock | 2 +- Cargo.toml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index ee88a49..b1328aa 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -21,7 +21,7 @@ dependencies = [ [[package]] name = "agent-vm" -version = "0.1.24" +version = "0.1.25" dependencies = [ "anyhow", "base64", diff --git a/Cargo.toml b/Cargo.toml index 61a4bdf..5608ca3 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -6,7 +6,7 @@ members = ["crates/agent-vm"] exclude = ["vendor/microsandbox"] [workspace.package] -version = "0.1.24" +version = "0.1.25" edition = "2024" license = "MIT" repository = "https://github.com/wirenboard/agent-vm"