Repository navigation
docs: actor DNS is answered by the sandbox's relay - #2615
Draft
Bo-Cheng Chu (bochengchu) wants to merge 1 commit into
Draft
Bo-Cheng Chu (bochengchu) wants to merge 1 commit into
Bo-Cheng Chu (bochengchu) wants to merge 1 commit into
Conversation
Bowei Du (bowei)
added
area/network
kind/docs
Bo-Cheng Chu (bochengchu)
force-pushed
the
docs-egress-dns-relay
branch
from
October 14, 2026 18:00
b88b4e8 to
3a41580
Compare
docs/egress-traffic.md said any TCP that is neither HTTP nor TLS is accepted and then closed with no bytes returned and no status code. That holds only when the actor waits for the server to speak first: the gateway has nothing to classify, gives up on its listener timeout and closes. When the actor sends first, the gateway treats bytes that are not TLS as cleartext HTTP, and its HTTP handler answers with 400 Bad Request before closing. Either way the destination is never contacted. Describe both cases.
Bo-Cheng Chu (bochengchu)
force-pushed
the
docs-egress-dns-relay
branch
from
October 14, 2026 18:46
3a41580 to
3250a96
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
docs/egress-traffic.md said DNS on port 53 is allowed through netfilter rules to the node-configured DNS, and that DNS-over-TCP, UDP and other traffic is filtered by nftables. That was the model before per-sandbox networking. Now each sandbox's only route out is its gateway address: the actor's resolv.conf names a DNS relay listening there, which forwards DNS over UDP and TCP to the node-configured DNS (internal/ateomnet and internal/ateomnet/dns). Every other TCP connection is redirected to atunnel, and UDP or any other traffic to another address has no route.
So DNS sent straight to some other server on port 53 is blocked like any other traffic: over UDP it is dropped, and over TCP it reaches the egress gateway as opaque TCP and is closed with no bytes returned. Describe that, and qualify the DNS rows with the sandbox gateway as the destination.
Breaking change
Fixes #<issue_number_goes_here>