- Notifications
You must be signed in to change notification settings - Fork0
coder/boundary
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
Network isolation tool for monitoring and restricting HTTP/HTTPS requests from processes.
boundary creates an isolated network environment for target processes, intercepting HTTP/HTTPS traffic through a transparent proxy that enforces user-defined allow rules.
- Process-level network isolation (Linux namespaces, macOS process groups)
- HTTP/HTTPS interception with transparent proxy and TLS certificate injection
- Wildcard pattern matching for URL patterns
- Request logging and monitoring
- Cross-platform support (Linux and macOS)
- Default deny-all security model
curl -fsSL https://raw.githubusercontent.com/coder/boundary/main/install.sh| bashFor installation options, manual installation, and release details, seeRELEASES.md.
# Allow only requests to github.comboundary --allow"github.com" -- curl https://github.com# Allow full access to GitHub issues API, but only GET/HEAD elsewhere on GitHubboundary \ --allow"github.com/api/issues/*" \ --allow"GET,HEAD github.com" \ -- npm install# Default deny-all: everything is blocked unless explicitly allowedboundary -- curl https://example.com
--allow "pattern" # All HTTP methods allowed--allow "METHOD[,METHOD] pattern" # Specific methods onlyboundary --allow"github.com" -- git pullboundary --allow"*.github.com" -- npm install# GitHub subdomainsboundary --allow"api.*" -- ./app# Any API domainboundary --allow"GET,HEAD api.github.com" -- curl https://api.github.com
Wildcards:* matches any characters. All traffic is denied unless explicitly allowed.
boundary --log-level info --allow"*" -- npm install# Show all requestsboundary --log-level debug --allow"github.com" -- git pull# Debug info
Log Levels:error,warn (default),info,debug
When you can't or don't want to run with sudo privileges, use--unprivileged:
# Run without network isolation (uses HTTP_PROXY/HTTPS_PROXY environment variables)boundary --unprivileged --allow"github.com" -- npm install# Useful in containers or restricted environmentsboundary --unprivileged --allow"*.npmjs.org" --allow"registry.npmjs.org" -- npm install
Unprivileged Mode:
- No network namespaces or firewall rules
- Works without sudo privileges
- Uses proxy environment variables instead
- Applications must respect HTTP_PROXY/HTTPS_PROXY settings
- Less secure but more compatible
| Platform | Implementation | Sudo Required |
|---|---|---|
| Linux | Network namespaces + iptables | Yes |
| macOS | Process groups + PF rules | Yes |
| Windows | Not supported | - |
boundary [flags] -- command [args...]--allow <SPEC> Allow rule (repeatable)--log-level <LEVEL> Set log level (error, warn, info, debug)--unprivileged Run without network isolation-h, --help Print helpmake build# Build for current platformmake build-all# Build for all platformsmaketest# Run testsmake test-coverage# Run tests with coveragemake clean# Clean build artifactsmake fmt# Format codemake lint# Lint code
MIT License - see LICENSE file for details.
About
Resources
Code of conduct
Security policy
Uh oh!
There was an error while loading.Please reload this page.
Stars
Watchers
Forks
Packages0
Uh oh!
There was an error while loading.Please reload this page.
Contributors3
Uh oh!
There was an error while loading.Please reload this page.