langchain-ai/docs
1
0
Fork 0
mirror of https://github.com/langchain-ai/docs.git synced 2026-07-23 12:55:40 -04:00
Code Issues 490 Packages Projects Releases Wiki Activity

[PR #4252] [MERGED] docs(langsmith): document sandbox egress and network access control #4238

New Issue
Closed
opened 2026-06-05 19:13:14 -04:00 by yindo · 0 comments
yindo commented 2026-06-05 19:13:14 -04:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/langchain-ai/docs/pull/4252
Author: @langchain-infra
Created: 6/1/2026
Status: ✅ Merged
Merged: 6/2/2026
Merged by: @langchain-infra

Base: main ← Head: mukil/sandbox-egress-docs

📝 Commits (1)

  • ef7355a docs(langsmith): document sandbox egress and network access control

📊 Changes

1 file changed (+100 additions, -1 deletions)

View changed files

📝 src/langsmith/sandbox-auth-proxy.mdx (+100 -1)

📄 Description

Overview

The sandbox auth proxy guide documented credential injection (rules, callbacks) but said nothing about the egress posture or the access_control allow/deny lists that actually govern which destinations a sandbox can reach. That gap led to the misconception that sandboxes are HTTP-only and cannot reach databases over raw TCP.

This adds an Egress and network access control section to the auth proxy page covering:

  • Default posture — HTTP/HTTPS to any host is open; all other raw TCP is blocked by default. Raw protocols aren't blocked because the proxy "can't speak" them — they're blocked by default and opened per host/port.
  • allow_list vs deny_list — mutual exclusivity, allow=default-deny (must also list HTTP hosts), deny=default-allow for HTTP/S only.
  • Raw TCP passthrough — enabled only via an allow_list entry with an explicit host:PORT; the connection is passed through at the TCP layer with no interception, so the PostgreSQL wire protocol (and TLS, SSH host-key checking, etc.) works unchanged.
  • Pattern syntax reference and a database (psql/dbt) example in curl + Python/TS SDK form.

Verified against the smith-go source (proxy_types.go, rules/types.go, matcher.go, validation.go, dns/server.go): field names, mutual-exclusivity error, pattern forms, and passthrough-eligibility logic all match.

Type of change

Type: Update existing documentation

Checklist

  • I have used root relative paths for internal links
  • No navigation change needed (section added to an existing page)

Additional notes

SDK examples follow the existing page's key convention (snake_case for Python, camelCase like accessControl/allowList for TypeScript). Worth confirming the TS SDK transforms the nested access_control keys the same way it does proxyConfig/matchHosts before merge.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/langchain-ai/docs/pull/4252 **Author:** [@langchain-infra](https://github.com/langchain-infra) **Created:** 6/1/2026 **Status:** ✅ Merged **Merged:** 6/2/2026 **Merged by:** [@langchain-infra](https://github.com/langchain-infra) **Base:** `main` ← **Head:** `mukil/sandbox-egress-docs` --- ### 📝 Commits (1) - [`ef7355a`](https://github.com/langchain-ai/docs/commit/ef7355ae1be53b67bcb133508d2ffff43fef006a) docs(langsmith): document sandbox egress and network access control ### 📊 Changes **1 file changed** (+100 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `src/langsmith/sandbox-auth-proxy.mdx` (+100 -1) </details> ### 📄 Description ## Overview The sandbox auth proxy guide documented credential injection (`rules`, `callbacks`) but said nothing about the egress posture or the `access_control` allow/deny lists that actually govern which destinations a sandbox can reach. That gap led to the misconception that sandboxes are HTTP-only and cannot reach databases over raw TCP. This adds an **Egress and network access control** section to the auth proxy page covering: - **Default posture** — HTTP/HTTPS to any host is open; all other raw TCP is blocked by default. Raw protocols aren't blocked because the proxy "can't speak" them — they're blocked by default and opened per host/port. - **`allow_list` vs `deny_list`** — mutual exclusivity, allow=default-deny (must also list HTTP hosts), deny=default-allow for HTTP/S only. - **Raw TCP passthrough** — enabled *only* via an `allow_list` entry with an explicit `host:PORT`; the connection is passed through at the TCP layer with no interception, so the PostgreSQL wire protocol (and TLS, SSH host-key checking, etc.) works unchanged. - **Pattern syntax** reference and a database (`psql`/`dbt`) example in curl + Python/TS SDK form. Verified against the smith-go source (`proxy_types.go`, `rules/types.go`, `matcher.go`, `validation.go`, `dns/server.go`): field names, mutual-exclusivity error, pattern forms, and passthrough-eligibility logic all match. ## Type of change **Type:** Update existing documentation ## Checklist - [x] I have used **root relative** paths for internal links - [ ] No navigation change needed (section added to an existing page) ## Additional notes SDK examples follow the existing page's key convention (snake_case for Python, camelCase like `accessControl`/`allowList` for TypeScript). Worth confirming the TS SDK transforms the nested `access_control` keys the same way it does `proxyConfig`/`matchHosts` before merge. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-06-05 19:13:14 -04:00
yindo closed this issue 2026-06-05 19:13:14 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
deepagents
docs-infra
external
external
help wanted
integration
internal
internal
javascript
js/ts
langchain
langgraph
langsmith
needs-title
pull-request
Mirrored from GitHub Pull Request
 python
reference
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langchain-ai/docs#4238
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?