Skip to content

docs: actor DNS is answered by the sandbox's relay #2615

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Bo-Cheng Chu (bochengchu) wants to merge 1 commit into
base: main
Choose a base branch
from
+1 −1
Draft

docs: actor DNS is answered by the sandbox's relay #2615

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/egress-traffic.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ cannot reach the collector until the actor has an `http` egress rule for it. See
| any | WebSocket | Blocked | n/a | `403 Forbidden` |
| any | Standard HTTP(S) CONNECT (forward-proxy tunnel) | Blocked | n/a | `403 Forbidden` |
| 53 | DNS to the sandbox's gateway | Allowed for hostnames matching the actor's egress policy | sandbox DNS relay -> worker pod's resolvers | `REFUSED` |
| any | Any other TCP | Blocked | n/a | The connection is accepted and then closed with no bytes returned. There is no status code. atunnel logs the failure. |
| any | Any other TCP | Blocked | n/a | If the actor sends first, the gateway treats bytes that are not TLS as cleartext HTTP and answers `400 Bad Request`, then closes. If the actor waits for the server to speak first, the connection is closed with no bytes returned and no status code. The destination is never contacted either way. |

## UDP

Expand Down
Loading