# What is an egress proxy?

An egress proxy is a server that every outbound connection from a machine must
pass through. The proxy applies rules to each connection and logs the traffic.

**On Runtime, the egress proxy runs on the host, outside each microVM. A
sandbox has no network card, so it cannot bypass the proxy.** Programs that
use `HTTP_PROXY` and programs that open raw sockets face the same rules,
including root ([security](/docs/security#network-access)). The same proxy
lets a sandbox use an API key that it never holds.

## Why it matters for AI agents

Rules that run inside the machine can be undone by whatever runs there. An
agent with `sudo` can rewrite `iptables`, unset a proxy variable or start a
program that ignores the proxy. A proxy placed outside the machine is out of
reach. The only way out is through it. Its allow list, its limits and its log
show what actually left the machine.

A proxy that terminates HTTPS for chosen hosts can also add a credential to a
request on its way out. The code inside the sandbox sends a placeholder. The
proxy attaches the real value outside the sandbox, where the sandbox cannot
reach it.

## Where the proxy sits on Runtime

| Question                            | On Runtime                                                                                                                                              |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Where it runs                       | On the host, outside the Firecracker microVM                                                                                                            |
| How traffic reaches it              | The sandbox has no network card. TCP leaves it. UDP to any public address and port also leaves it on paid sandboxes. DNS is answered inside the sandbox |
| Programs that ignore proxy settings | Their TCP connections still go to the same proxy                                                                                                        |
| Docker containers in the sandbox    | Get `HTTP_PROXY` and `HTTPS_PROXY` set to `http://172.17.0.1:10800`                                                                                     |
| What it enforces                    | Per-sandbox allow, deny and connect rules. Private addresses are always refused.                                                                        |
| Limits                              | Concurrent connections, bandwidth and bytes per day, per sandbox                                                                                        |
| Runtime's relays in the sandbox     | Ports 10800, 10802 and 10853. These ports are never reachable from outside the sandbox.                                                                 |

Rule changes take effect immediately. This includes connections that are
already open ([the network](/docs/sandbox-environment#the-network)).

## Attach a key on the way out

Store the key once, with the hosts it may be sent to. With `header`, the proxy
sets that header on every HTTPS request to those hosts. The code needs no
placeholder at all:

```ts check
import { Runtime } from "withruntime";

const runtime = new Runtime();
await runtime.secrets.set("GITHUB_TOKEN", {
  value: process.env.GITHUB_TOKEN ?? "",
  hosts: ["api.github.com"],
  header: "Authorization",
  format: "token {value}",
});
```

```bash no-run
printf %s "$OPENAI_API_KEY" | runtime secrets set OPENAI_API_KEY --host api.openai.com
```

To do this, the proxy opens the HTTPS connection to those hosts itself. It
checks the real server's certificate. Sandboxes already trust Runtime's
certificate for those hosts through `SSL_CERT_FILE`, `REQUESTS_CA_BUNDLE` and
`NODE_EXTRA_CA_CERTS`. Plain HTTP never carries a secret. Request bodies are
never rewritten ([secrets](/docs/security#secrets-sandboxes-never-see)).

## Related

- [What is egress control?](/glossary/egress-control)
- [What is prompt injection?](/glossary/prompt-injection)
- [How to turn off a sandbox's internet](/how-to/turn-off-sandbox-internet)
- [Run Docker in a sandbox](/how-to/run-docker-in-a-sandbox)

Facts on this page were checked on 25 October 2026.