[WSLC] Add cooperative HTTP/HTTPS proxy support (#652)

* Add cooperative HTTP/HTTPS proxy support for the WSLc backend

* Addressed PR comments

* Harden cooperative proxy support

* Addressed PR comments

* Addressed PR comments

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Author: SohamDas2021

docs/schema.md

@@ -55,6 +55,9 @@ production configs and the dev schema when working on experimental features:
         "proxy": { "localhost": 8080 }     // Loopback proxy port (processcontainer; bubblewrap; seatbelt)
                                            // (use { "builtinTestServer": true } for the bundled
                                            //  testing-only proxy; requires --allow-testing-features)
+                                           // WSLC supports the cooperative proxy too, but only via
+                                           // { "url": "http://proxy.example:8080" } (own-netns:
+                                           //  localhost/builtinTestServer are unreachable, rejected)
     },
 
     "processContainer": {                  // Process-based container-specific

docs/wsl/wsl-container-getting-started.md

@@ -227,6 +227,66 @@ no separate `--setup-wslc` step is required.
 | `"allowOutbound": true` | Bridged networking (full access) |
 | `"allowOutbound": false` | No networking (isolated) |
 
+### Network proxy (cooperative, unprivileged)
+
+WSLC supports a **cooperative HTTP/HTTPS proxy**: setting `network.proxy`
+routes a container's egress through a proxy you provide. WSLC's kernel has
+**no in-kernel `iptables`**, so — exactly like the Bubblewrap backend — there
+is no netfilter drop-floor; enforcement is *cooperative*, applied by handing
+the workload proxy environment variables that well-behaved clients honor.
+
+**How it works**
+
+1. When `network.proxy` is set, the runner translates it into the
+   `HTTP_PROXY`, `HTTPS_PROXY`, `http_proxy`, and `https_proxy` environment
+   variables inside the container (via `WslcSetProcessSettingsEnvVariables`).
+   Any caller-supplied values for these keys — including `NO_PROXY` /
+   `no_proxy` — are **stripped** from the *initial* process environment first.
+   Because WSLC merges the process environment onto the image's baked-in
+   `ENV`, the runner also sets `NO_PROXY` / `no_proxy` to the **empty string**,
+   so an image-baked exemption (e.g. `ENV NO_PROXY=*`) cannot silently disable
+   the proxy. This sanitizes the process's *starting* environment only; see the
+   cooperative-model caveat below.
+2. Cooperative tools (curl, wget, Python `requests`, Node `https`, etc.) honor
+   the env vars and their traffic flows through the proxy.
+
+**Only the `url` form is supported.** A WSLC container runs in its own network
+namespace (a separate WSL system VM), so a host- or distro-loopback proxy is
+**not reachable** from inside the container. The proxy must be a routable
+address the container can reach:
+
+```json
+{
+  "version": "0.6.0-alpha",
+  "containment": "wslc",
+  "process": { "commandLine": "curl -fsSL https://example.com && echo OK" },
+  "network": {
+    "defaultPolicy": "allow",
+    "proxy": { "url": "http://proxy.example:8080" }
+  },
+  "experimental": { "wslc": { "image": "alpine:latest" } }
+}
+```
+
+The `localhost` and `builtinTestServer` proxy forms are **rejected at
+config-parse time** for WSLC (they imply a host-loopback / MXC-run proxy that
+the container cannot reach). The proxy also requires `defaultPolicy: "allow"`
+and no `allowedHosts` / `blockedHosts`: the container must have outbound
+networking to reach the proxy, and host lists are not forwarded to it — configs
+that combine the proxy with a `block` default or host lists are **rejected**.
+
+**Caveats**
+
+- **Cooperative model, not enforcement.** Only clients that honor the proxy
+  env vars are routed through the proxy. Tools that bypass them (raw sockets,
+  custom HTTP clients, statically-linked binaries that ignore the env) are
+  **not** contained. WSLC cannot provide a hard network floor because its
+  kernel lacks `iptables`. For strict network isolation, use
+  `"allowOutbound": false` (no networking) instead.
+- **Consumer-provided proxy.** MXC does not start a proxy for WSLC; you supply
+  a reachable one via `url`. Any host filtering is the proxy's responsibility —
+  the runner does not forward `allowedHosts` / `blockedHosts` to it.
+
 ### Filesystem mounts
 
 Paths in `filesystem.readwritePaths` and `filesystem.readonlyPaths` are mounted
@@ -249,6 +309,7 @@ the container.
 
 - [`tests/examples/wslc_hello_world.json`](../../tests/examples/wslc_hello_world.json) — Hello world with Alpine
 - [`tests/configs/wslc_network_isolated.json`](../../tests/configs/wslc_network_isolated.json) — Network isolation
+- [`tests/configs/wslc_network_proxy.json`](../../tests/configs/wslc_network_proxy.json) — Cooperative HTTP proxy (`network.proxy.url`)
 - [`tests/configs/wslc_custom_registry_ghcr.json`](../../tests/configs/wslc_custom_registry_ghcr.json) — Pull from GitHub Container Registry
 - [`tests/configs/wslc_custom_registry_quay.json`](../../tests/configs/wslc_custom_registry_quay.json) — Pull from Quay.io
 - [`tests/configs/wslc_tar_import_rootfs.json`](../../tests/configs/wslc_tar_import_rootfs.json) — Import rootfs tar

sdk/node/src/types.ts

@@ -201,11 +201,24 @@ export interface NetworkConfig {
   /** Hostnames or IP addresses to block (firewall mode only) */
   blockedHosts?: string[];
   /** Proxy configuration (supported on Windows ProcessContainer, Linux Bubblewrap,
-   *  and macOS Seatbelt). On Bubblewrap/Seatbelt it is a cooperative env-var proxy
-   *  (HTTP_PROXY/HTTPS_PROXY): well-behaved HTTP clients honor it, raw-socket clients
-   *  can bypass it. `builtinTestServer` activates a bundled, testing-only proxy; the
-   *  SDK rejects it unless `allowTestingFeatures: true` is set in SandboxSpawnOptions
-   *  (which maps to the native `--allow-testing-features` flag). */
+   *  macOS Seatbelt, and WSLC). On Bubblewrap/Seatbelt/WSLC it is a cooperative
+   *  env-var proxy (HTTP_PROXY/HTTPS_PROXY): well-behaved HTTP clients honor it,
+   *  raw-socket clients can bypass it. `builtinTestServer` activates a bundled,
+   *  testing-only proxy; the SDK rejects it unless `allowTestingFeatures: true` is
+   *  set in SandboxSpawnOptions (which maps to the native `--allow-testing-features`
+   *  flag).
+   *
+   *  WSLC imposes additional parse-time constraints (a violating config is
+   *  rejected before it runs):
+   *   - Only the `{ url }` form is accepted — its containers run in their own
+   *     network namespace, so the `localhost` / `builtinTestServer` loopback
+   *     forms are unreachable and rejected.
+   *   - The `url` scheme must be `http` or `https`.
+   *   - `defaultPolicy` must be `"allow"` and both `allowedHosts` and
+   *     `blockedHosts` must be empty/unset — WSLC has no in-kernel iptables, so
+   *     it cannot enforce host lists, and the container needs outbound
+   *     networking to reach the proxy at all.
+   *  Enforcement is cooperative (no in-kernel iptables). */
   proxy?: { builtinTestServer: true } | { localhost: number } | { url: string };
   /** Automatically remove firewall rules after execution (default: true). Deprecated: use lifecycle.preservePolicy. */
   removeRulesOnExit?: boolean;

src/backends/bubblewrap/common/src/bwrap_command.rs

@@ -11,21 +11,7 @@ use std::collections::HashSet;
 
 use wxc_common::filesystem_resolve::FsIntent;
 use wxc_common::models::{ExecutionRequest, NetworkPolicy, ProxyAddress};
-
-/// Env var keys that the proxy block manages. Listed here so we can strip
-/// any conflicting entries the caller supplied via `request.env` (callers
-/// must not be able to defeat the cooperative proxy by injecting their own
-/// proxy env vars).
-const PROXY_ENV_KEYS: &[&str] = &[
-    "HTTP_PROXY",
-    "HTTPS_PROXY",
-    "ALL_PROXY",
-    "http_proxy",
-    "https_proxy",
-    "all_proxy",
-    "NO_PROXY",
-    "no_proxy",
-];
+use wxc_common::proxy_env::{is_managed_proxy_key, PROXY_SET_KEYS};
 
 /// Read-only host paths bind-mounted into every Bubblewrap sandbox as the
 /// deny-by-default baseline. Mirrors the seatbelt backend's
@@ -231,7 +217,7 @@ pub fn build_args_classified(
         if let Some((key, value)) = env_str.split_once('=') {
             // When the proxy is active, drop any caller-supplied proxy env
             // entries so they cannot override the values we set below.
-            if proxy_address.is_some() && PROXY_ENV_KEYS.contains(&key) {
+            if proxy_address.is_some() && is_managed_proxy_key(key) {
                 continue;
             }
             args.extend(["--setenv".into(), key.into(), value.into()]);
@@ -254,15 +240,8 @@ pub fn build_args_classified(
     // destinations.
     if let Some(addr) = proxy_address {
         let url = addr.to_url();
-        for key in [
-            "HTTP_PROXY",
-            "HTTPS_PROXY",
-            "ALL_PROXY",
-            "http_proxy",
-            "https_proxy",
-            "all_proxy",
-        ] {
-            args.extend(["--setenv".into(), key.into(), url.clone()]);
+        for key in PROXY_SET_KEYS {
+            args.extend(["--setenv".into(), (*key).into(), url.clone()]);
         }
     }
 

src/backends/wslc/common/src/wsl_container_runner.rs

@@ -975,17 +975,57 @@ impl WSLContainerRunner {
             return sdk_error("WslcSetProcessSettingsCmdLine failed", hr, "");
         }
 
-        if !request.env.is_empty() {
-            let env_cstrings: Vec<Vec<u8>> = request
-                .env
+        // Route egress through the cooperative proxy: WSLc has no in-kernel
+        // iptables, so per-host policy is enforced at the proxy layer by
+        // injecting HTTP(S)_PROXY (and scrubbing caller-supplied proxy vars).
+        // See wxc_common::proxy_env.
+        let effective_env: Vec<String> = if request.policy.network_proxy.is_enabled() {
+            // url-only (also enforced at parse time). Fail fast rather than
+            // inject an empty HTTP_PROXY= for the localhost/builtinTestServer
+            // forms, which carry no routable URL.
+            let proxy_url = match request
+                .policy
+                .network_proxy
+                .address
+                .as_ref()
+                .and_then(|addr| addr.original_url.clone())
+            {
+                Some(url) => url,
+                None => {
+                    return ScriptResponse::error(
+                        "WSLC: network.proxy requires the 'url' form (a routable proxy URL); \
+                         the localhost and builtinTestServer forms are not supported because a \
+                         WSLc container runs in its own network namespace.",
+                    );
+                }
+            };
+            let _ = writeln!(
+                logger,
+                "[WSLC] Cooperative network proxy configured: {}",
+                wxc_common::proxy_env::redact_proxy_url(&proxy_url)
+            );
+            wxc_common::proxy_env::apply_cooperative_proxy_env(&request.env, &proxy_url)
+        } else {
+            request.env.clone()
+        };
+
+        // Env buffers must outlive WslcCreateContainer: the SDK stores the
+        // pointers into process_settings (it does not copy), and reads them at
+        // container-create time. Hoisting to function scope keeps them alive —
+        // mirrors the cmdline/_cwd_cstr handling. Scoping them inside the `if`
+        // below frees them early and causes a use-after-free (0xC0000005).
+        let _env_cstrings: Vec<Vec<u8>>;
+        let _env_ptrs: Vec<PCSTR>;
+        if !effective_env.is_empty() {
+            _env_cstrings = effective_env
                 .iter()
                 .map(|e| format!("{}\0", e).into_bytes())
                 .collect();
-            let env_ptrs: Vec<PCSTR> = env_cstrings.iter().map(|e| e.as_ptr() as PCSTR).collect();
+            _env_ptrs = _env_cstrings.iter().map(|e| e.as_ptr() as PCSTR).collect();
             let hr = sdk.WslcSetProcessSettingsEnvVariables(
                 &mut process_settings,
-                env_ptrs.as_ptr(),
-                env_ptrs.len(),
+                _env_ptrs.as_ptr(),
+                _env_ptrs.len(),
             );
             if hr != S_OK {
                 return sdk_error("WslcSetProcessSettingsEnvVariables failed", hr, "");