M4-egress-defaults

[pt-act]

Proposal

Summary

Ship the examples with least-privilege egress by default: the container-backed examples
should not enable unrestricted network egress ({ mode: "direct" }) without an explicit,
visible opt-in, and the docs should state the risk at the point of configuration.

Background and motivation

examples/mcp/src/index.ts wires its container backend with egress: { mode: "direct" },
which grants code executed in the sandbox unrestricted outbound network access — including
internal services and cloud-metadata endpoints (169.254.169.254). The worker backend in
the same file already defaults to { mode: "none" }, so the container backend is the one
remaining permissive default in the shipped examples. Examples are the first thing users
copy, so a permissive default propagates into downstream projects.

examples/egress already demonstrates the safer pattern: workspaceEgressPolicy with an
http-gateway and an EgressGateway that pins an exact origin and uses
redirect: "manual". The default-vs-example mismatch is the gap.

Who is affected: anyone starting from the MCP example and running untrusted or
model-generated code in the container backend.

Goals

• Change shipped examples so container egress defaults to none (or an allowlisted
  gateway); make direct reachable only via an explicit env flag / clearly-named
  constant, so opting into full network reach is a visible act rather than an inherited
  default.
• Add a warning at the egress configuration site (README/docs) describing the
  full-network-reach / SSRF-to-metadata risk of direct/all, pointing to the gateway
  pattern in examples/egress.
• Optional follow-up (separate proposal): a metadata/RFC1918/link-local blocklist inside
  the gateway engine itself.
• Out of scope: changes to packages/computer egress policy types or enforcement.

Example

examples/mcp today:

readonly containerShell = new CloudflareContainerBackend({
  container: () => this,
  workspace: { binding: "COMPUTER_MCP", id: this.ctx.id.toString() },
  egress: { mode: "direct" },          // unrestricted; sandboxed code can reach any host
});

Proposed:

interface Env {
  // SECURITY: opt-in for unrestricted outbound network access.
  // Default is "none" (no egress). Set to "direct" to allow all outbound.
  EGRESS_MODE?: "none" | "direct";
}
// ...
egress: { mode: this.env.EGRESS_MODE ?? "none" },   // full egress requires a deliberate opt-in

---

We have a working implementation of this change for examples/mcp (env-gated default)
plus the egress-mode warning block for examples/egress/README.md; it applies cleanly on
current main. Per the contribution policy we have not opened a PR — happy to if the
maintainers would like one.