feat: Adding sandbox property runtime_binding_address to specify whic… #6992
Conversation
…h network interface on the host machine Docker should bind the runtime ports to
| @@ -60,6 +61,7 @@ class SandboxConfig(BaseModel): | |||
| default=False | |||
| ) # once enabled, OpenHands would lint files after editing | |||
| use_host_network: bool = Field(default=False) | |||
| runtime_binding_address: str = Field(default='127.0.0.1') | |||
There was a problem hiding this comment.
I think the default is 0.0.0.0 so this could be a breaking change. But agreed 127 is safer...
There was a problem hiding this comment.
yeah.. you are right. It would be a breaking change but it is safer. As it is a breaking change do I have to change something to the PR or description to make it clear?
There was a problem hiding this comment.
I'm trying to validate that core functionality still works with this change (e.g. asking the agent to start an app), but need to get a docker image built...
There was a problem hiding this comment.
@mamoodi can you have a look at this one?
There was a problem hiding this comment.
Perfect! OK let's get this in
| @@ -60,6 +61,7 @@ class SandboxConfig(BaseModel): | |||
| default=False | |||
| ) # once enabled, OpenHands would lint files after editing | |||
| use_host_network: bool = Field(default=False) | |||
| runtime_binding_address: str = Field(default='127.0.0.1') | |||
There was a problem hiding this comment.
Perfect! OK let's get this in
|
Unfortunately, it seems this PR has started to cause issues on some people's systems. |
specify which network interface on the host machine Docker should bind the runtime ports to
End-user friendly description of the problem this fixes or functionality that this introduces.
Runtimes are exposing some ports by default to all your network interfaces.
From security perspective and reduce attack surface. It is better if those ports are exposed only in the localhost
127.0.0.1. It should be able to configure the binding address for the runtime ports. It will specifies which network interface on the host machine Docker should bind the runtime ports to.Give a summary of what the PR does, explaining any non-trivial design decisions.
New
sandboxconfiguration property was introducedruntime_binding_addressdefault value is127.0.0.1Link of any specific issues this addresses.
https://github.com/All-Hands-AI/OpenHands/security/advisories/GHSA-jh54-cg39-w6pq