gate

Overview ¶

Command gate is one session's egress gate. It runs as a sidecar sharing the sandbox's network namespace: on startup it installs owner-match iptables rules (egress permitted only for the gate's own UID and loopback, everything else dropped), verifies they took, and drops to that unprivileged UID; thereafter it serves internal/gate's forward proxy on a loopback port the sandbox reaches via HTTP_PROXY, keeping its policy and resolved credentials current by periodically fetching the session's config from the control plane.

Environment:

• CONTROLPLANE_URL (required) base URL of the internal gate-config endpoint
• GATE_TOKEN (required) the per-session gtk_ bearer token
• GATE_ADDR proxy listen address (default 127.0.0.1:15080; loopback)
• GATE_UID dedicated UID for owner-match + privilege drop (default 65532)
• GATE_GID dedicated GID for privilege drop (default GATE_UID)
• GATE_FETCH_INTERVAL config refresh interval, a Go duration (default 30s)
• OTEL_EXPORTER_OTLP_ENDPOINT / OTEL_EXPORTER_OTLP_INSECURE telemetry export