Network and egress
Labtagon AI OS runs code that people and agents wrote: tool servers, their builds, programs in the sandbox. The network is set up so that this code reaches only what it is allowed to reach.
Default deny
Section titled “Default deny”- The platform namespace starts with a policy that denies every connection
(
ai-os-default-deny), then opens only the paths the components need. Every pod may resolve names. - People’s and organisations’ namespaces, the build namespace and the sandbox namespace get their policies from the controller, the only component allowed to write them. Instances have no DNS: they reach the egress gateway, the controller’s resource API, and their own companions, nothing else; their init container reaches the control API’s bundle port.
The paths the chart opens
Section titled “The paths the chart opens”| From | To | Why |
|---|---|---|
The route’s namespace (routes.fromNamespace) |
Console, control API, MCP gateway | People, clients and applications calling in. |
| Control API | MCP gateway | The chat calls the person’s tools there, as their client. |
| MCP gateway | Instances; the control API’s tool port; the egress gateway’s calls port; sandboxes | Tool calls; AI OS’s own tools; the caller’s token for a call (ADR 0048); code__run. |
| Instances, build jobs, sandboxes | Egress gateway (proxy port) | Their only way out. |
| Instances | Egress gateway (launch port) | Credentials a server declared as environment variables, at start; never to builds. |
| Build jobs, instances | Control API (bundle port) | Fetch source and code bundles, hand in a build’s bundle. |
| Control API, MCP gateway, controller, egress gateway | Postgres | Their state. |
| Control API, MCP gateway | Garage or S3; Presidio | Files; personal-data checks. |
| Control API | SearXNG, Docling, Gotenberg | Web search, reading documents, Office previews. |
| Control API, MCP gateway | Port 443 | The OpenID Connect provider, model providers, push services. |
Narrow them with networkPolicies.*:
ingressFrom: who may reach the console, the control API and the gateway (default: the route’s namespace).keycloakEgress: where the control API and the gateway reach the OpenID Connect provider (default: any address on 443).modelEgress: where the gateway reaches its safety and decision models (default: any address on 443).pushEgress: extra ways out for browser notifications.storage.external.egress,storage.offsite.egress: where an external S3 and the off-site copy are.
The egress gateway
Section titled “The egress gateway”The egress gateway is the only way out for instances, build jobs and sandboxes, and the only component that decrypts stored credentials.
- Approved hosts. A tool server reaches only the hosts its approved version names. A new or wider host waits for an approval.
- API rules (ADR 0054). A server can declare per host which requests it sends: methods, paths and
what they act on. Once rules exist for a host, everything else there is refused, before any
credential is filled in. Refusals go back to the server as 403 with the rule, into the tool call’s
record and into the audit log. The setting Tools that need checked web traffic
(
egress.requireApiRules) can require API rules for servers with tools that change something, cost money, delete, or change rights. - Credentials on the way out. Instances hold placeholders. The egress gateway opens their TLS with the platform’s egress CA, which instances trust, and puts the real key or token in its declared place, only toward the hosts that key is bound to.
- Build jobs download only from the setting Websites a build may download from
(
builds.allowHosts, by default the npm registry and PyPI). - Code sandboxes reach the internet as the setting Where code a sandbox runs may reach
(
code.egress) says: by default the package indexes, and other websites once the person approves them for the conversation; ports 80 and 443; never your own network. Every connection is logged.
components.egressGateway.allowPrivate lets instances reach private addresses. It exists for the
local test stack: never switch it on in production.
Air-gapped and mirrored
Section titled “Air-gapped and mirrored”- The chart pulls third-party images through
global.mirrorwhen you set one, and pods pull only by digest fromallowedRegistriesandglobal.imageRegistry. - Docling’s models are in its image; it downloads nothing at run time and reaches nothing.
- The control API reads the vulnerability data for build checks from
osv-vulnerabilities.storage.googleapis.com(settingchecks.advisoriesUrl) and hands each build what it needs; build pods get no host for it. - Model calls go to the providers your administrators set up; there is no model inside the installation yet (planned, ADR 0079).
- This handbook needs nothing from elsewhere either: its search index, fonts and pictures are served with it.