Show HN: Sandbox-proxy – A forward proxy that injects credentials to sandboxes

A developer released Sandbox-proxy, a zero-dependency Go forward proxy that injects credentials into outbound requests on the wire, allowing sandboxed code to use tokens without seeing them. The tool simplifies secret management for containerized workloads by intercepting HTTPS traffic and injecting credentials only for configured hosts.

A zero-dependency, stdlib-only Go forward proxy that injects your real credentials GitHub GH TOKEN , npm token, … into outbound requests on the wire , so code running in a sandbox can use them without ever seeing them. A simplified version of Infisical's agent-vault https://github.com/Infisical/agent-vault , driven by a single script sandbox.sh over a dependency-free proxy binary you own. Code runs in a container with no network access except through the proxy . The proxy holds your tokens and injects them into outbound requests as they leave — so the workload can use them but never sees them. sandbox git / gh / npm — no token; HTTPS PROXY, trusts proxy CA │ │ request without credentials ▼ sandbox-proxy holds the real token; default-deny allow-list │ │ + Authorization injected on the wire ▼ upstream github.com, api.github.com, registry.npmjs.org, … - 🌐 Open by default allow all: true for easy setup — egress to any host, with credentials injected only on your configured hosts. Set allow all: false for strict default-deny only listed hosts reachable . - 🔏 HTTPS interception via a CA it generates on first run and the sandbox trusts; the intercepted TLS speaks HTTP/1.1 only ALPN pins http/1.1 , and hosts you don't inject into can be blind-tunnelled untouched. - 🛡️ A compromised workload can at most use a token against the hosts you allow — it can't read or exfiltrate the secret itself. Source the control script once; it gives you a sandbox function that manages one shared proxy and any number of sandbox containers . source sandbox.sh GH TOKEN is taken from gh auth token automatically if it isn't already set. export NPM TOKEN=npm xxx optional; export any secret your rules need sandbox proxy up build if needed + start the shared proxy sandbox proxy status is it running? on which networks? in any project directory: cd ~/code/my-app sandbox run ensures proxy is up, opens a shell in $PWD ...or run a command directly: sandbox run npm ci sandbox run git clone https://github.com/you/private.git Inside a sandbox there is no token in the environment , yet git/npm are authenticated — the proxy injects credentials on the way out. Run as many sandboxes as you like at once; they all share the single proxy: cd ~/code/app-a && sandbox run npm test & cd ~/code/app-b && sandbox run npm test & sandbox ps list running sandboxes Commands: | Command | Does | |---|---| sandbox proxy up | Build if needed, start the shared proxy. | sandbox proxy status | Show whether it's running and its networks. | sandbox proxy reload | Restart the proxy, picking up current env/tokens and config edits. | sandbox proxy down / logs | Stop+remove / follow logs. | sandbox run cmd... | Ensure the proxy is up, run a sandbox in $PWD shell if no cmd . | sandbox build proxy|box|all | Force-rebuild images. | sandbox ps | List running sandboxes. | 🔑 Where secrets come from: for each var in $SANDBOX SECRET ENVS default GH TOKEN NPM TOKEN , sandbox uses the environment value if set, otherwise runs SANDBOX <VAR CMD on the host. GH TOKEN defaults to gh auth token , so just being logged into gh is enough — no need to export anything. Resolution happens in a subshell at proxy up/reload, so tokens never persist in your shell, and they're passed to the container by name never on the command line . To pull another secret from a command, e.g.: export SANDBOX SECRET ENVS="GH TOKEN NPM TOKEN AWS TOKEN" export SANDBOX AWS TOKEN CMD="aws-vault exec me -- printenv AWS SESSION TOKEN" 💾 Persisting tool configs / caches: set SANDBOX VOLUMES to a whitespace-separated list of docker -v specs and every sandbox run mounts them named volumes are created on first use and survive across sandboxes : export SANDBOX VOLUMES="claude-config:/root/.claude codex-config:/root/.codex pi-config:/root/.pi" Each entry is a raw -v spec, so host paths $HOME/.foo:/root/.foo and read-only mounts somevol:/root/.x:ro work too. Note these are shared across all sandboxes, so treat anything mounted there as readable by any workload. ♻️ Changing tokens or rules: edit proxy/config.json and/or update the token source, then sandbox proxy reload — it re-resolves secrets picking up a rotated gh token and restarts. The CA is stored in a persistent Docker volume, so it survives reloads and sandboxes keep trusting it. The sandbox network is created --internal , so a sandbox physically cannot reach the internet except through the proxy. Confirm: php sandbox run sh -c 'env | grep -i token' - nothing no token inside the sandbox sandbox run curl -sI https://example.com reachable via the proxy allow all default ; with allow all:false an unlisted host - 403 Override defaults network/image/volume names, which env vars are forwarded as secrets by exporting SANDBOX vars before sourcing — see the top of sandbox.sh . 📦 Installing packages at runtime: the image sets both upper- and lower-case proxy vars, so apt , curl , wget , go , npm , bun all route through the proxy — apt update && apt install <pkg works needs allow all , or the Ubuntu archive hosts allow-listed . These installs live in the --rm container and vanish on exit; for anything you want every time, add it to sandbox/Dockerfile and sandbox build box . Your host TERM / COLORTERM are forwarded too, so full-color TUIs work. proxy/config.json maps secrets how to build an auth header, with the value read from the proxy's environment to rules which host gets which secret : { "allow all": true, "secrets": { "github": { "type": "basic", "env": "GH TOKEN", "username": "x-access-token" }, "github-api": { "type": "bearer", "env": "GH TOKEN" }, "npm": { "type": "bearer", "env": "NPM TOKEN" } }, "rules": { "host": "github.com", "inject": "github" }, { "host": "api.github.com", "inject": "github-api" }, { "host": " .githubusercontent.com" }, { "host": "registry.npmjs.org", "inject": "npm" } } secrets — type is bearer or basic ; env names the host env var holding the token never the value itself . username is for basic auth GitHub uses the token as the password with any username . rules — matched by host , covering all methods and paths. A . prefix is a suffix wildcard: .githubusercontent.com matches objects. / raw. / any subdomain and the bare domain — handy for CDN hosts behind gh-release/git-lfs/npm-tarball downloads. inject names a secret to add on every request; omit it to allow a host with no credential added.— allow all for simplicity: egress to any host, with injection still scoped to listed hosts others are blind-tunnelled, untouched . Set it to true by default false for strict default-deny — only listed hosts are reachable.⚠️ With allow all on, the proxy is a credential broker , not a firewall: a compromised workload can send data anywhere. Flip it to false for untrusted code. Run sandbox proxy reload to re-read the config. The proxy is just a binary — no runtime deps. cd proxy/src go build -o sandbox-proxy . or: GOOS=linux GOARCH=amd64 go build ... GH TOKEN=ghp xxx NPM TOKEN=npm xxx ./sandbox-proxy listens on :3128, writes ca/ca.crt point any client at it: export HTTPS PROXY=http://127.0.0.1:3128 curl --cacert ca/ca.crt https://api.github.com/user authenticated, token never left the proxy git -c http.proxy=$HTTPS PROXY clone https://github.com/your/private.git Cross-compile for any target with GOOS / GOARCH — the output is a single static file you can drop anywhere. cd proxy/src && go test ./... Covers the policy engine host matching, decide , credential injection incl. placeholder overwrite , config loading, header/host helpers, WebSocket-upgrade detection, and end-to-end forward-proxy and CONNECT/MITM flows injection, default-deny, allow all via httptest . test.go files are excluded from the built binary. | Var | Default | Meaning | |---|---|---| PROXY LISTEN | :3128 | listen address | PROXY CONFIG | config.json | rules file | PROXY CA DIR | ca | where ca.crt / ca.key are stored/generated | HTTP S PROXY | — | upstream proxy for the proxy's own egress optional | It lives mode ca.key stays in the proxy. 0600 in the proxy-only CA volume; sandboxes bind-mount only the public ca.crt read-only, never the volume — so a workload can't read the key and mint trusted certs. Keep the CA volume private on the host. Lock down the network , not just the env. The --internal sandbox network sandbox-net is what actually forces traffic through the proxy; without it a workload could ignore HTTPS PROXY and dial out directly. sandbox.sh creates it internal by default. Scope tightly. Prefer specific injection hosts over broad allow all so a leaked-but-injected token is useful only for what you intended.