The Trial sandbox's network: an allowlisting proxy #1013

Parent

#977

What to build

• Each sandbox gets a network of its own, holding only its own loopback.
• An allowlisting CONNECT proxy runs outside it, listening on a Unix socket that's bound into the sandbox. A relay inside turns a local port into that socket, and the Harness reaches its provider through HTTPS_PROXY.
• What the proxy allows: only that Harness's provider hosts, from Live checks for the Trial sandbox #1009's lists. It refuses names that resolve to loopback or to the host's own addresses.
• A Harness that ignores the proxy finds no route, and its Trial is void.
• Web search is off, by each Harness's own flag.

Acceptance criteria

• A sandboxed process reaches an allowed test host through the proxy.
• It can't reach loopback services, the host's public addresses, or a disallowed host such as GitHub.
• A name that resolves to loopback is refused.
• Web search is turned off for every Harness.