Proxies

Go SDK - Proxy API reference

Configure one SOCKS4 or SOCKS5 proxy for outbound sandbox connections with WithProxy. Proxy protocols are mutually exclusive.

See Proxy for routing behavior, security considerations, and limits.

Outbound proxies are local-only. Cloud sandbox creation rejects this setting.

Typical flow

sb, err := m.CreateSandbox(ctx, "worker",
    m.WithImage("python"),
    m.WithProxy(m.SOCKS5Proxy("127.0.0.1:1080")),
)

Functions

m.WithProxy()

func WithProxy(proxy *OutboundProxy) SandboxOption

Set the single proxy used for outbound sandbox connections.

Parameters

proxy*OutboundProxy

Protocol-specific outbound proxy configuration.

m.SOCKS4Proxy()

func SOCKS4Proxy(address string, options ...SOCKS4ProxyOptions) *OutboundProxy

Construct a SOCKS4 proxy at IP:port for WithProxy. Pass SOCKS4ProxyOptions{UserID: "sandbox"} to include the optional SOCKS4 user ID. It must contain 1–255 bytes and no null byte; it is an identifier, not a password.

m.SOCKS5Proxy()

func SOCKS5Proxy(address string) *OutboundProxy

Construct a SOCKS5 proxy at IP:port for WithProxy.

(*OutboundProxy).Credentials()

func (p *OutboundProxy) Credentials(username string, password SecretSource) *OutboundProxy

Return a copy configured with SOCKS5 username/password authentication. Call this on a value returned by SOCKS5Proxy and pass SecretSourceEnv("SOCKS5_PASSWORD") as password.

The host environment variable is read once each time the sandbox starts. Changing it affects the next start, not a sandbox that is already running. ConfigJSON() and the database contain the source reference but never the resolved password. The username and resolved password must each contain 1–255 bytes.

m.SecretSourceEnv()

func SecretSourceEnv(variable string) SecretSource

Create a host environment-variable reference for a SOCKS5 password.

OutboundProxy

Opaque outbound proxy configuration constructed with a protocol-specific function. Pass it to WithProxy.

SecretSource

Opaque host-side secret source constructed with SecretSourceEnv. Durable configuration contains this source reference, not the resolved password.

SOCKS4ProxyOptions

Field	Type	Default	Description
UserID	string	""	Optional user ID sent during the SOCKS4 handshake