Private IP Routing via allowed_ips
Demonstrates the allowed_ips sandbox policy feature, which lets sandboxes
reach services on private IP space (e.g. cluster-internal pods) that would
normally be blocked by the proxy's SSRF protection.
How it works
The sandbox proxy blocks all connections to RFC 1918 addresses by default.
When an endpoint in the sandbox policy includes an allowed_ips field, the
proxy validates the resolved IP against that CIDR allowlist instead of
blanket-blocking. Loopback and link-local remain always-blocked regardless.
The default sandbox policy (baked into the community base image) includes a cluster_pods
entry that allows any binary to reach port 8080 on the configured pod network:
cluster_pods:
name: cluster_pods
endpoints:
- port: 8080
allowed_ips:
- "10.42.0.0/16"
binaries:
- { path: "/**" }
Launch the demo server
Build the image and push it to a registry that your Kubernetes cluster can pull from:
docker build -t registry.example.com/demo/private-api:latest examples/private-ip-routing/
docker push registry.example.com/demo/private-api:latest
Deploy the pod:
kubectl run private-api \
--image=registry.example.com/demo/private-api:latest \
--port=8080 \
--restart=Never
Wait for it to be running and note the pod IP:
kubectl get pod private-api -o wide
Example output:
NAME READY STATUS IP NODE
private-api 1/1 Running 10.42.0.128 ...
Verify from a sandbox
Create a sandbox and curl the private API through the proxy. Replace the IP
with whatever kubectl get pod showed above:
openshell sandbox create -- bash -c \
'curl -s --proxytunnel -x http://10.200.0.1:3128 http://10.42.0.128:8080/'
Expected output:
{
"message": "Hello from the private network!",
"hostname": "private-api",
"path": "/",
"client": "10.42.0.130",
"timestamp": 1772501542.15
}
The proxy allowed the connection because 10.42.0.128 matches the
10.42.0.0/16 CIDR in allowed_ips. Without that policy field, the same
request returns HTTP/1.1 403 Forbidden.
Cleanup
kubectl delete pod private-api