Hacker News Reader

Comment by kevincox | Hacker News Reader

Something I've wanted to do is run less trusted services on a private network but still have the reverse proxy connect to them. This way I can be sure that they only way to get to them from the outside is via the reverse proxy (which adds authentication). However I haven't found a decent way to manage that no network access paired with a loopback or similar that can be accessed by the reverse proxy.

View on HN

Can run it in a isolated namespace and communicate with unix sockets. If the service does not support listening on sockets you can use socat within the namespace to forward from the unix socket to a port on lo in the namespace. Most reverse proxies can forward to a unix socket.

I've done similar things (and sometimes with a wireguard tunnel out to internet) for privacy reasons.

Here is an example I linked in another comment: http://www.dest-unreach.org/socat/doc/socat-gender.txt

Create a veth pair. Move one end of the pair into a network namespace. Bind the untrusted service on that end. Have your proxy service connect to the other end.

You've just described Sandstorm. Sandstorm runs instances (called grains) of applications in a sandbox. The application gets a limited file system and a Cap'n Proto RPC connection to the outside world over a unix socket. Sandstorm runs the HTTPS server, which turns requests into RPC calls. Sandstorm authenticates the users and provides temporary subdomains and frames to sandbox the HTML side of it.

https://sandstorm.io/

OP's comments are all about Sandstorm FYI

I have less trusted services all listening on my Tailscale network. Network ACLs can then ensure they can't talk to each other and the only thing that can talk to them is the reverse proxy.

Use socket activation and run your service with PrivateNetwork=yes

Just share an open FD to a socks proxy with the isolated service.

This depends on the service itself supporting inheriting sockets for proxies. Is this a common feature? Some services do support listening socket passing which does solve my problem as I can make it listen on a UNIX socket mounted on the host and accessible to the reverse proxy but many of the lower quality services that I want to give this treatment to don't support that either.

As another commenter says, you can use socat. Specifically, you can run it in double client mode (see http://www.dest-unreach.org/socat/doc/socat-gender.txt) to connect the UNIX socket to the service.

Reply on news.ycombinator.com