egress

Overview ¶

Package egress is a per-VM CONNECT proxy: default-deny, per-session allowlist, audit log. It is the only path out for session containers on the internal network (spec §8). The session is identified by its Proxy-Authorization header, either a literal Bearer token (the session id) or — the form a plain HTTP_PROXY/HTTPS_PROXY env var actually produces, since curl/wget have no way to set a literal header from an env var — HTTP Basic auth decoded from the proxy URL's userinfo (http://<session-id>:<ignored>@host:port), added for egress R4's env-var proxy flow (Task 13; see sessionFromProxyAuth). A CONNECT that carries no usable identity is answered with a 407 challenge rather than a refusal, because a client that waits to be asked (git does; curl does not) would otherwise never send the credential it already holds — see challengeRealm.