How the Credential Vault Prevents API Keys from Entering CubeSandbox Environments

The Credential Vault in TencentCloud/CubeSandbox stores API keys exclusively on the host side and injects them into outbound HTTPS requests via the CubeEgress security proxy, ensuring secrets never enter the sandbox's memory, filesystem, or environment.

The TencentCloud/CubeSandbox project isolates untrusted workloads in micro-VMs, but true secret protection requires preventing credentials from ever reaching the isolated environment. By implementing a Credential Vault architecture that delegates secret injection to the CubeEgress proxy, the platform ensures API keys remain completely outside the sandbox boundary while still enabling authorized external API calls.

Host-Side Secret Storage and Policy Declaration

Secrets are stored only in the host-side configuration or protected vault, never written into the sandbox image or accessible via environment variables. Developers declare egress policies using the EgressRuleInject struct defined in sdk/go/policy.go, specifying which HTTP headers should carry credentials for specific destination hosts. These policies reside in the control plane and are transmitted to the CubeEgress proxy, not the sandbox itself, as documented in docs/guide/pi-agent-integration.md.

Proxy-Level Injection via CubeEgress

Intercepting Outbound Traffic

When sandboxed code initiates an outbound HTTP or HTTPS request, the CubeEgress proxy—running outside the micro-VM on the host—intercepts the traffic before it leaves the node. This interception occurs in network-agent/internal/cubeegress/client.go, where the proxy evaluates the request against configured L7 egress rules to determine if credential injection is required.

Header Injection and Redaction

If the request matches a rule containing an inject action, the proxy adds the required credential header (e.g., Authorization: Bearer <token>) using the value retrieved from the vault. The sandboxed process receives only the response, never seeing the secret value. All audit logs and debug outputs redact injected credentials, displaying ***REDACTED*** instead of the actual key, as noted in docs/guide/introduction.md.

Fail-Safe Behavior

If injection fails due to a missing policy or mismatched domain, the request either proceeds without the credential or is rejected with HTTP 403, depending on the rule configuration. This fail-safe design, implemented in sdk/go/policy.go, ensures that the sandbox never receives a raw credential or error message that could leak sensitive information.

Implementing Credential Injection in Code

The following examples demonstrate how to configure the Credential Vault using the Go SDK, JSON configuration, and Python SDK.

// sdk/go/policy.go (excerpt)
type EgressRuleInject struct {
    // Header name to inject, e.g. "Authorization"
    Header string `json:"header"`
    // Name of the stored credential (from the vault)
    Credential string `json:"credential"`
}

// Example: inject a Bearer token for calls to api.example.com
policy := []policy.EgressRule{
    {
        Match: policy.Match{
            Host: "api.example.com",
        },
        Action: policy.Action{
            // Allow the request and inject the stored credential
            Allow: true,
            Inject: &policy.EgressRuleInject{
                Header:    "Authorization",
                Credential: "my-api-key",
            },
        },
    },
}

{
  "match": { "host": "api.example.com" },
  "action": {
    "allow": true,
    "inject": {
      "header": "Authorization",
      "credential": "my-api-key"
    }
  }
}

from cubesandbox import Sandbox, EgressRule, Inject

sandbox = Sandbox(...)
sandbox.add_egress_rule(
    EgressRule(
        match={"host": "api.example.com"},
        action={"allow": True, "inject": Inject(header="Authorization",
                                                credential="my-api-key")}
    )
)

Key Source Files and Implementation Details

The Credential Vault mechanism relies on the following components:

• sdk/go/policy.go – Defines EgressRuleInject and the policy schema used for credential injection (source).
• sdk/go/models.go – Contains L7 matching structs that describe host, path, and SNI rules for credential injection (source).
• network-agent/internal/cubeegress/client.go – Implements the proxy-side injection logic that intercepts outbound requests and adds vault-stored credentials (source).
• docs/guide/pi-agent-integration.md – Documents the "credential vault" pattern and how to configure injection without exposing secrets to the sandbox (source).
• docs/blog/posts/2026-06-23-cubesandbox-network-deep-dive.md – Explains the security guarantees of CubeEgress, including the guarantee that sandboxes never receive raw credentials (source).
• docs/guide/introduction.md – Provides a high-level overview of egress control and credential injection redaction policies (source).

Summary

• Secrets remain stored exclusively on the host side, never entering the sandbox filesystem or memory.
• The CubeEgress proxy intercepts all outbound traffic and injects credentials at the host boundary.
• Sandboxed code cannot access, dump, or exfiltrate API keys because they never exist inside the micro-VM.
• Fail-safe defaults ensure requests proceed without credentials or fail securely rather than leak secrets.
• Comprehensive log redaction prevents accidental exposure in audit trails.

Frequently Asked Questions

How does the Credential Vault differ from traditional environment variable injection?

Traditional containerized workloads often pass secrets via environment variables or mounted files, which remain visible inside the sandbox via /proc or process inspection. CubeSandbox's Credential Vault keeps secrets entirely outside the micro-VM boundary, with the CubeEgress proxy injecting them only at the network layer, leaving no trace in the sandbox's memory or filesystem.

What happens if the CubeEgress proxy cannot find a matching credential?

According to the logic in sdk/go/policy.go, if an injection rule specifies a credential that is missing or the domain does not match, the request either proceeds without the credential or is rejected with HTTP 403. This ensures the sandbox never receives an error message or placeholder that could leak information about the vault's contents.

Can sandboxed code bypass the proxy to access the Credential Vault directly?

No. The sandbox's network stack is restricted and all outbound traffic routes through the CubeEgress proxy. The Credential Vault is accessible only to the host-side agent and the proxy process, not the micro-VM. Even if sandboxed code attempts to scan the network, it cannot reach the vault's endpoints.

Are injected credentials visible in network logs or packet captures?

No. The CubeEgress proxy redacts sensitive values in all logs, displaying ***REDACTED*** instead of the actual key. Since injection occurs at the host boundary outside the sandbox, packet captures taken inside the micro-VM show only the original outbound request without the injected headers, ensuring secrets remain invisible to the isolated code.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}