{"id":369,"date":"2026-04-13T00:00:00","date_gmt":"2026-04-13T00:00:00","guid":{"rendered":"https:\/\/wordpress.securinsight.ca\/index.php\/2026\/04\/13\/containers-agents-secure-credential-injection-and-dynamic-egress-policies-for-sandboxes\/"},"modified":"2026-04-13T00:00:00","modified_gmt":"2026-04-13T00:00:00","slug":"containers-agents-secure-credential-injection-and-dynamic-egress-policies-for-sandboxes","status":"publish","type":"post","link":"https:\/\/wordpress.securinsight.ca\/index.php\/2026\/04\/13\/containers-agents-secure-credential-injection-and-dynamic-egress-policies-for-sandboxes\/","title":{"rendered":"Containers, Agents – Secure credential injection and dynamic egress policies for Sandboxes"},"content":{"rendered":"

Outbound Workers for Sandboxes<\/a> and Containers<\/a> now support zero-trust credential injection, TLS interception, allow\/deny lists, and dynamic per-instance egress policies. These features give platforms running agentic workloads full control over what leaves the sandbox, without exposing secrets to untrusted workloads, like user-generated code or coding agents.<\/p>\n

Credential injection<\/h4>\n

Because outbound handlers run in the Workers runtime, outside the sandbox, they can hold secrets the sandbox never sees. A sandboxed workload can make a plain request, and credentials are transparently attached before a request is forwarded upstream.<\/p>\n

For instance, you could run an agent in a sandbox and ensure that any requests it makes to Github are authenticated.
\nBut it will never be able to accesss the credentials:<\/p>\n

\n
\n
export<\/span> <\/span>class<\/span> <\/span>MySandbox<\/span> <\/span>extends<\/span> <\/span>Sandbox<\/span> <\/span>{}<\/span><\/div><\/div>
\n<\/div><\/div>
MySandbox<\/span>.<\/span>outboundByHost<\/span> <\/span>=<\/span> <\/span>{<\/span><\/div><\/div>
  <\/span>\"github.com\"<\/span>:<\/span> <\/span>(<\/span>request<\/span>:<\/span> <\/span>Request<\/span>,<\/span> <\/span>env<\/span>:<\/span> <\/span>Env<\/span>,<\/span> <\/span>ctx<\/span>:<\/span> <\/span>OutboundHandlerContext<\/span>)<\/span> <\/span>=><\/span> <\/span>{<\/span><\/div><\/div>
    <\/span>const<\/span> <\/span>requestWithAuth<\/span> <\/span>=<\/span> <\/span>new<\/span> <\/span>Request<\/span>(<\/span>request<\/span>)<\/span>;<\/span><\/div><\/div>
    <\/span><\/span>requestWithAuth<\/span>.<\/span>headers<\/span>.<\/span>set<\/span>(<\/span>\"x-auth-token\"<\/span>,<\/span> <\/span>env<\/span>.<\/span>SECRET<\/span>)<\/span>;<\/span><\/div><\/div>
    <\/span>return<\/span> <\/span>fetch<\/span>(<\/span>requestWithAuth<\/span>)<\/span>;<\/span><\/div><\/div>
  <\/span>},<\/span><\/div><\/div>
};<\/span><\/div><\/div><\/code><\/pre>\n
\n
<\/div>\n<\/div>\n<\/figure>\n<\/div>\n
You can easily inject unique credentials for different instances
\nby using ctx.containerId<\/code>:<\/p>\n
\n
\n
MySandbox<\/span>.<\/span>outboundByHost<\/span> <\/span>=<\/span> <\/span>{<\/span><\/div><\/div>
  <\/span>\"my-internal-vcs.dev\"<\/span>:<\/span> <\/span>async<\/span> (<\/span><\/div><\/div>
    <\/span>request<\/span>:<\/span> <\/span>Request<\/span>,<\/span><\/div><\/div>
    <\/span>env<\/span>:<\/span> <\/span>Env<\/span>,<\/span><\/div><\/div>
    <\/span>ctx<\/span>:<\/span> <\/span>OutboundHandlerContext<\/span>,<\/span><\/div><\/div>
  <\/span><\/span>) <\/span>=><\/span> <\/span>{<\/span><\/div><\/div>
    <\/span>const<\/span> <\/span>authKey<\/span> <\/span>=<\/span> <\/span>await<\/span> <\/span>env<\/span>.<\/span>KEYS<\/span>.<\/span>get<\/span>(<\/span>ctx<\/span>.<\/span>containerId<\/span>)<\/span>;<\/span><\/div><\/div>
\n<\/div><\/div>
    <\/span>const<\/span> <\/span>requestWithAuth<\/span> <\/span>=<\/span> <\/span>new<\/span> <\/span>Request<\/span>(<\/span>request<\/span>)<\/span>;<\/span><\/div><\/div>
    <\/span><\/span>requestWithAuth<\/span>.<\/span>headers<\/span>.<\/span>set<\/span>(<\/span>\"x-auth-token\"<\/span>,<\/span> <\/span>authKey<\/span>)<\/span>;<\/span><\/div><\/div>
    <\/span>return<\/span> <\/span>fetch<\/span>(<\/span>requestWithAuth<\/span>)<\/span>;<\/span><\/div><\/div>
  <\/span>},<\/span><\/div><\/div>
};<\/span><\/div><\/div><\/code><\/pre>\n
\n
<\/div>\n<\/div>\n
<\/div>\n<\/figure>\n<\/div>\n
No token is ever passed into the sandbox. You can rotate secrets in the Worker environment
\nand every request will pick them up immediately.<\/p>\n
TLS interception<\/h4>\n
Outbound Workers now intercept HTTPS traffic. A unique ephemeral certificate authority (CA) and private key are created for each sandbox instance. The CA is placed into the sandbox and trusted by default. The ephemeral private key never leaves the container runtime sidecar process and is never shared across instances.<\/p>\n
With TLS interception active, outbound Workers can act as a transparent proxy for both HTTP and HTTPS traffic.<\/p>\n
Allow and deny hosts<\/h4>\n
Easily filter outbound traffic with allowedHosts<\/code> and deniedHosts<\/code>. When allowedHosts<\/code> is set, it becomes a deny-by-default allowlist. Both properties support glob patterns.<\/p>\n
\n
\n
export<\/span> <\/span>class<\/span> <\/span>MySandbox<\/span> <\/span>extends<\/span> <\/span>Sandbox<\/span> <\/span>{<\/span><\/div><\/div>
  <\/span><\/span>allowedHosts <\/span>=<\/span> [<\/span>\"github.com\"<\/span>,<\/span> <\/span>\"npmjs.org\"<\/span>]<\/span>;<\/span><\/div><\/div>
}<\/span><\/div><\/div><\/code><\/pre>\n
\n
<\/div>\n<\/div>\n<\/figure>\n<\/div>\n
Dynamic outbound handlers<\/h4>\n
Define named outbound handlers then apply or remove them at runtime using setOutboundHandler()<\/code> or setOutboundByHost()<\/code>. This lets you change egress policy for a running sandbox without restarting it.<\/p>\n
\n
\n
export<\/span> <\/span>class<\/span> <\/span>MySandbox<\/span> <\/span>extends<\/span> <\/span>Sandbox<\/span> <\/span>{}<\/span><\/div><\/div>
\n<\/div><\/div>
MySandbox<\/span>.<\/span>outboundHandlers<\/span> <\/span>=<\/span> <\/span>{<\/span><\/div><\/div>
  <\/span>allowHosts<\/span>:<\/span> <\/span>async<\/span> <\/span>(<\/span>req<\/span>:<\/span> <\/span>Request<\/span>,<\/span> <\/span>env<\/span>:<\/span> <\/span>Env<\/span>,<\/span> <\/span>ctx<\/span>:<\/span> <\/span>OutboundHandlerContext<\/span> <\/span>)<\/span><\/span> <\/span>=><\/span> <\/span>{<\/span><\/div><\/div>
    <\/span>const<\/span> <\/span>url<\/span> <\/span>=<\/span> <\/span>new<\/span> <\/span>URL<\/span>(<\/span>req<\/span>.<\/span>url<\/span>)<\/span>;<\/span><\/div><\/div>
    <\/span>if<\/span> (<\/span>ctx<\/span>.<\/span>params<\/span>.<\/span>allowedHostnames<\/span>.<\/span>includes<\/span>(<\/span>url<\/span>.<\/span>hostname<\/span>)) <\/span>{<\/span><\/div><\/div>
      <\/span>return<\/span> <\/span>fetch<\/span>(<\/span>req<\/span>)<\/span>;<\/span><\/div><\/div>
    <\/span>}<\/span><\/div><\/div>
    <\/span>return<\/span> <\/span>new<\/span> <\/span>Response<\/span>(<\/span>null<\/span>,<\/span> <\/span>{<\/span> status<\/span>:<\/span> <\/span>403<\/span> <\/span>}<\/span>)<\/span>;<\/span><\/div><\/div>
  <\/span>},<\/span><\/div><\/div>
\n<\/div><\/div>
  <\/span>noHttp<\/span>:<\/span> <\/span>async<\/span> <\/span>()<\/span> <\/span>=><\/span> <\/span>{<\/span><\/div><\/div>
    <\/span>return<\/span> <\/span>new<\/span> <\/span>Response<\/span>(<\/span>null<\/span>,<\/span> <\/span>{<\/span> status<\/span>:<\/span> <\/span>403<\/span> <\/span>}<\/span>)<\/span>;<\/span><\/div><\/div>
  <\/span>},<\/span><\/div><\/div>
};<\/span><\/div><\/div><\/code><\/pre>\n
\n
<\/div>\n<\/div>\n
<\/div>\n<\/figure>\n<\/div>\n
Apply handlers programmatically from your Worker:<\/p>\n
\n
\n
const<\/span> <\/span>sandbox<\/span> <\/span>=<\/span> <\/span>getSandbox<\/span>(<\/span>env<\/span>.<\/span>Sandbox<\/span>,<\/span> <\/span>userId<\/span>)<\/span>;<\/span><\/div><\/div>
\n<\/div><\/div>
\/\/ Open network for setup<\/span><\/div><\/div>
await<\/span> <\/span>sandbox<\/span>.<\/span>setOutboundHandler<\/span>(<\/span>\"allowHosts\"<\/span>,<\/span> <\/span>{<\/span><\/div><\/div>
  <\/span><\/span>allowedHostnames<\/span>:<\/span> [<\/span>\"github.com\"<\/span>,<\/span> <\/span>\"npmjs.org\"<\/span>]<\/span>,<\/span><\/div><\/div>
}<\/span>)<\/span>;<\/span><\/div><\/div>
await<\/span> <\/span>sandbox<\/span>.<\/span>exec<\/span>(<\/span>\"npm install\"<\/span>)<\/span>;<\/span><\/div><\/div>
\n<\/div><\/div>
\/\/ Lock down after setup<\/span><\/div><\/div>
await<\/span> <\/span>sandbox<\/span>.<\/span>setOutboundHandler<\/span>(<\/span>\"noHttp\"<\/span>)<\/span>;<\/span><\/div><\/div><\/code><\/pre>\n
\n
<\/div>\n<\/div>\n
<\/div>\n<\/figure>\n<\/div>\n
Handlers accept params<\/code>, so you can customize behavior per instance without defining separate handler functions.<\/p>\n
Get started<\/h4>\n
Upgrade to @cloudflare\/containers@0.3.0<\/code> or @cloudflare\/sandbox@0.8.9<\/code> to use these features.<\/p>\n
For more details, refer to Sandbox outbound traffic<\/a> and Container outbound traffic<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"
Outbound Workers for Sandboxes and Containers now support zero-trust credential injection, TLS interception, allow\/deny lists, and dynamic per-instance egress policies. These features give platforms running agentic workloads full control over what leaves the sandbox, without exposing secrets to untrusted workloads, like user-generated code or coding agents. Credential injection Because outbound handlers run in the Workers […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-369","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/wordpress.securinsight.ca\/index.php\/wp-json\/wp\/v2\/posts\/369","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.securinsight.ca\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wordpress.securinsight.ca\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.securinsight.ca\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.securinsight.ca\/index.php\/wp-json\/wp\/v2\/comments?post=369"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.securinsight.ca\/index.php\/wp-json\/wp\/v2\/posts\/369\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.securinsight.ca\/index.php\/wp-json\/wp\/v2\/media?parent=369"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wordpress.securinsight.ca\/index.php\/wp-json\/wp\/v2\/categories?post=369"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wordpress.securinsight.ca\/index.php\/wp-json\/wp\/v2\/tags?post=369"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}