Network boundaries

Where each Context component runs in your network, and which paths into and out of an agent sandbox are checked, open or denied.

Which deployments this describes. The egress proxy (Envoy) and its model route exist only with Sandbox Workload Identity on, or with Sandbox Egress Proxy (domain allowlist) on; both are off by default. The diagrams show a deployment with Sandbox Workload Identity on. On a default install there is no egress proxy and no identity sidecar: the sandbox calls the model gateway directly with the gateway key it holds (see Credential handling).

Deployment boundaries

flowchart LR
  browser["Web browser<br/>your users"] -->|HTTPS 443| alb
  subgraph acct["Your AWS account: Region, VPC, private subnets"]
    alb["Application Load Balancer<br/>internal"] -->|HTTP| edge
    subgraph eks["Amazon EKS cluster"]
      subgraph rel["Release namespace"]
        edge["Edge router (Traefik)<br/>ingress"] --> app["Application tier<br/>Deployment: API, decisions, identity broker"]
        drive["Drive gateway (Caddy)<br/>Deployment"] -->|authorize| app
        subgraph np["Sandbox network policy"]
          sb["Sandbox Pod<br/>agent sandbox, one per task run"]
        end
        sb --> egress["Egress proxy (Envoy)<br/>Deployment"]
        conn["Connectors service<br/>Deployment"]
      end
      subgraph ctl["Sandbox controller namespace"]
        sc["Sandbox controller"]
      end
      subgraph obs["Observability namespace"]
        os["Observability stack<br/>Loki, Tempo, Alloy, Grafana, Prometheus"]
      end
    end
    app -->|SQL| rds["Amazon RDS for PostgreSQL<br/>application records"]
    drive --> s3["Amazon S3<br/>drive files, transcripts, logs, traces"]
  end
  app -->|application credentials| tp["Third-party APIs (internet)<br/>Parallel, Composio, Box"]
  conn -->|MCP calls| mcp["Your internal systems<br/>MCP servers, any address *"]
  egress -->|credential added| gw["Model gateway (LiteLLM)"]
  sb -.->|"direct (S-01) *"| inet["Public internet<br/>any destination, any port"]

1. All Context components run in private subnets of your VPC. The Application Load Balancer is internal by default (ALB Visibility). Without a WAF and a source address restriction (WAF Web ACL ARN, Allowed Source CIDRs), finding S-15 * applies. With TLS Termination on ALB on (the default), the load balancer forwards to the ingress over HTTP, so TLS ends at the load balancer.
2. Context’s components are in three namespaces: context-vpc (application, orchestration, proxies, sandboxes), agent-sandbox-system (sandbox controller) and context-vpc-observability (Loki, Tempo, Alloy, Grafana, Prometheus, Alertmanager). You operate kube-system, including cluster DNS and network policy enforcement.
3. Amazon RDS for PostgreSQL holds application records and is also used by Temporal and OnlyOffice; Amazon S3 holds drive files, task transcripts, logs, traces and ClickHouse trace data. Encryption, keys, backups and retention for these services are your settings (see Data at rest).
4. Context workloads use IAM roles for service accounts. The application tier and ClickHouse share one role; Loki and Tempo have separate roles. If the default ServiceAccount in context-vpc also carries the application role, see S-12 in Known issues and hardening.
5. With Sandbox Workload Identity on, model requests from sandboxes pass through the egress proxy, which asks the application tier to authorize each request and adds the model credential before forwarding to your LiteLLM gateway. With it off (the default), sandboxes call your LiteLLM gateway directly with the gateway key they hold, and the application tier makes no per-request decision. Sandbox Egress Proxy (domain allowlist) on its own limits destinations but does not add model credentials.
6. The connectors service calls MCP servers in your network. Depending on the connector target settings it may call any public address and any address in the private ranges, and its outbound traffic is not limited by NetworkPolicy unless the connector network policy is on (S-04 *). See Connector settings, and for the admin view of connector destinations, Connectors.
7. When the sandbox egress setting is Open internet, sandboxes can reach the public internet directly on any port (S-01, S-02 *). With the Domain allowlist setting, the direct path is removed and outbound traffic is limited to approved domains through the egress proxy; DNS and telemetry remain direct (S-10).
8. The outbound path from the VPC (NAT or your proxy), the AWS Region and the network location of the model gateway are yours to decide (see What your team decides).

Sandbox network paths

Every network path out of a sandbox, and which check applies to it. The behavior column describes the product; paths marked * are open only because of the egress setting.

flowchart LR
  subgraph np["Sandbox network policy"]
    subgraph pod["Sandbox Pod (untrusted)"]
      h["Harness, uid 1000<br/>port 4096, tool policy ◇"]
      sc["Identity sidecar, uid 1001<br/>projected token, capability token"]
      t["Tools and CLI tools, uid 1000"]
      code["Agent-generated code, uid 1000"]
    end
  end
  sc --> broker["Identity broker<br/>HTTPS 3443, attests the sidecar ◆"]
  t --> app["Application tier<br/>3000, API and connectors gateway ◆"]
  t --> drive["Drive gateway<br/>8080, each request checked ◆"]
  t -.-> conn["Connectors service (not used by sandboxes)<br/>8080 open in the policy but unused"]
  h --> model["Egress proxy, model route<br/>443 / 8443, App decides ◆"]
  code -->|"no check ⊘ *"| fwd["Egress proxy, forwarding route<br/>3128, any destination incl. private upstream ranges on 443"]
  code -->|"direct ⊘ *"| inet["Public internet<br/>any destination and port"]
  code -->|"no authentication ⊘"| tel["Telemetry gateway 4317 / 4318<br/>cluster DNS 53"]
  code --x|"denied by NetworkPolicy ✕ (S-14)"| priv["Your private networks, instance metadata"]

Destination	Port	Check	Decision	Behavior
Identity broker	HTTPS 3443	◆ attests the sidecar	Application tier	Enforced
Application tier: API and connectors gateway	3000	◆ every request; every connector tool call	Application tier	Enforced; unauthorized requests are refused
Drive gateway	8080	◆ every request	Application tier	Enforced; bytes go from the gateway to Amazon S3
Egress proxy, model route (Sandbox Workload Identity on)	443 / 8443	◆ every request	Application tier	Enforced; refused if the check cannot be made. With identity off (the default) this route does not exist and model requests go to the model gateway directly with the sandbox’s key
Connectors service, direct	8080	Token check	Token issued by the application tier	Not used: connector calls go through the application tier’s connectors gateway. The sandbox network policy still allows port 8080; requests without a token issued by the application tier are refused
Egress proxy, forwarding route	3128	⊘ none	none	Open * under the Open egress setting: any destination, including the private upstream ranges configured for the egress proxy and in-namespace Pods on port 443 (S-02, S-03)
Public internet, direct	any	⊘ none	none	Open * under the Open egress setting: any destination and port (S-01)
Telemetry gateway, cluster DNS	4317 / 4318 and 53	⊘ none	none	Reachable without authentication (S-10)
Your private networks, instance metadata service		✕	NetworkPolicy	Denied by the policy; the denial depends on network policy enforcement in your cluster (S-14). The forwarding route above is the exception

For the admin-facing statement that cloud metadata endpoints are blocked for connector destinations, see Connectors.

Inbound connections to a sandbox

Inbound connections to a sandbox are allowed only from the application tier, the Temporal worker and the streaming service, on ports 4096, 4098, 4999 and 6085 (release defaults).