Revert "[WSLC] Add cooperative HTTP/HTTPS proxy support" (#697)

Revert "[WSLC] Add cooperative HTTP/HTTPS proxy support (#652)"

This reverts commit 3b910d9.

Author: SohamDas2021

docs/schema.md

@@ -55,9 +55,6 @@ production configs and the dev schema when working on experimental features:
         "proxy": { "localhost": 8080 }     // Loopback proxy port (processcontainer; bubblewrap; seatbelt)
                                            // (use { "builtinTestServer": true } for the bundled
                                            //  testing-only proxy; requires --allow-testing-features)
-                                           // WSLC supports the cooperative proxy too, but only via
-                                           // { "url": "http://proxy.example:8080" } (own-netns:
-                                           //  localhost/builtinTestServer are unreachable, rejected)
     },
 
     "processContainer": {                  // Process-based container-specific

docs/wsl/wsl-container-getting-started.md

@@ -227,66 +227,6 @@ no separate `--setup-wslc` step is required.
 | `"allowOutbound": true` | Bridged networking (full access) |
 | `"allowOutbound": false` | No networking (isolated) |
 
-### Network proxy (cooperative, unprivileged)
-
-WSLC supports a **cooperative HTTP/HTTPS proxy**: setting `network.proxy`
-routes a container's egress through a proxy you provide. WSLC's kernel has
-**no in-kernel `iptables`**, so — exactly like the Bubblewrap backend — there
-is no netfilter drop-floor; enforcement is *cooperative*, applied by handing
-the workload proxy environment variables that well-behaved clients honor.
-
-**How it works**
-
-1. When `network.proxy` is set, the runner translates it into the
-   `HTTP_PROXY`, `HTTPS_PROXY`, `http_proxy`, and `https_proxy` environment
-   variables inside the container (via `WslcSetProcessSettingsEnvVariables`).
-   Any caller-supplied values for these keys — including `NO_PROXY` /
-   `no_proxy` — are **stripped** from the *initial* process environment first.
-   Because WSLC merges the process environment onto the image's baked-in
-   `ENV`, the runner also sets `NO_PROXY` / `no_proxy` to the **empty string**,
-   so an image-baked exemption (e.g. `ENV NO_PROXY=*`) cannot silently disable
-   the proxy. This sanitizes the process's *starting* environment only; see the
-   cooperative-model caveat below.
-2. Cooperative tools (curl, wget, Python `requests`, Node `https`, etc.) honor
-   the env vars and their traffic flows through the proxy.
-
-**Only the `url` form is supported.** A WSLC container runs in its own network
-namespace (a separate WSL system VM), so a host- or distro-loopback proxy is
-**not reachable** from inside the container. The proxy must be a routable
-address the container can reach:
-
-```json
-{
-  "version": "0.6.0-alpha",
-  "containment": "wslc",
-  "process": { "commandLine": "curl -fsSL https://example.com && echo OK" },
-  "network": {
-    "defaultPolicy": "allow",
-    "proxy": { "url": "http://proxy.example:8080" }
-  },
-  "experimental": { "wslc": { "image": "alpine:latest" } }
-}
-```
-
-The `localhost` and `builtinTestServer` proxy forms are **rejected at
-config-parse time** for WSLC (they imply a host-loopback / MXC-run proxy that
-the container cannot reach). The proxy also requires `defaultPolicy: "allow"`
-and no `allowedHosts` / `blockedHosts`: the container must have outbound
-networking to reach the proxy, and host lists are not forwarded to it — configs
-that combine the proxy with a `block` default or host lists are **rejected**.
-
-**Caveats**
-
-- **Cooperative model, not enforcement.** Only clients that honor the proxy
-  env vars are routed through the proxy. Tools that bypass them (raw sockets,
-  custom HTTP clients, statically-linked binaries that ignore the env) are
-  **not** contained. WSLC cannot provide a hard network floor because its
-  kernel lacks `iptables`. For strict network isolation, use
-  `"allowOutbound": false` (no networking) instead.
-- **Consumer-provided proxy.** MXC does not start a proxy for WSLC; you supply
-  a reachable one via `url`. Any host filtering is the proxy's responsibility —
-  the runner does not forward `allowedHosts` / `blockedHosts` to it.
-
 ### Filesystem mounts
 
 Paths in `filesystem.readwritePaths` and `filesystem.readonlyPaths` are mounted
@@ -309,7 +249,6 @@ the container.
 
 - [`tests/examples/wslc_hello_world.json`](../../tests/examples/wslc_hello_world.json) — Hello world with Alpine
 - [`tests/configs/wslc_network_isolated.json`](../../tests/configs/wslc_network_isolated.json) — Network isolation
-- [`tests/configs/wslc_network_proxy.json`](../../tests/configs/wslc_network_proxy.json) — Cooperative HTTP proxy (`network.proxy.url`)
 - [`tests/configs/wslc_custom_registry_ghcr.json`](../../tests/configs/wslc_custom_registry_ghcr.json) — Pull from GitHub Container Registry
 - [`tests/configs/wslc_custom_registry_quay.json`](../../tests/configs/wslc_custom_registry_quay.json) — Pull from Quay.io
 - [`tests/configs/wslc_tar_import_rootfs.json`](../../tests/configs/wslc_tar_import_rootfs.json) — Import rootfs tar

sdk/node/src/types.ts

@@ -210,24 +210,11 @@ export interface NetworkConfig {
   /** Hostnames or IP addresses to block (firewall mode only) */
   blockedHosts?: string[];
   /** Proxy configuration (supported on Windows ProcessContainer, Linux Bubblewrap,
-   *  macOS Seatbelt, and WSLC). On Bubblewrap/Seatbelt/WSLC it is a cooperative
-   *  env-var proxy (HTTP_PROXY/HTTPS_PROXY): well-behaved HTTP clients honor it,
-   *  raw-socket clients can bypass it. `builtinTestServer` activates a bundled,
-   *  testing-only proxy; the SDK rejects it unless `allowTestingFeatures: true` is
-   *  set in SandboxSpawnOptions (which maps to the native `--allow-testing-features`
-   *  flag).
-   *
-   *  WSLC imposes additional parse-time constraints (a violating config is
-   *  rejected before it runs):
-   *   - Only the `{ url }` form is accepted — its containers run in their own
-   *     network namespace, so the `localhost` / `builtinTestServer` loopback
-   *     forms are unreachable and rejected.
-   *   - The `url` scheme must be `http` or `https`.
-   *   - `defaultPolicy` must be `"allow"` and both `allowedHosts` and
-   *     `blockedHosts` must be empty/unset — WSLC has no in-kernel iptables, so
-   *     it cannot enforce host lists, and the container needs outbound
-   *     networking to reach the proxy at all.
-   *  Enforcement is cooperative (no in-kernel iptables). */
+   *  and macOS Seatbelt). On Bubblewrap/Seatbelt it is a cooperative env-var proxy
+   *  (HTTP_PROXY/HTTPS_PROXY): well-behaved HTTP clients honor it, raw-socket clients
+   *  can bypass it. `builtinTestServer` activates a bundled, testing-only proxy; the
+   *  SDK rejects it unless `allowTestingFeatures: true` is set in SandboxSpawnOptions
+   *  (which maps to the native `--allow-testing-features` flag). */
   proxy?: { builtinTestServer: true } | { localhost: number } | { url: string };
   /** Automatically remove firewall rules after execution (default: true). Deprecated: use lifecycle.preservePolicy. */
   removeRulesOnExit?: boolean;

src/backends/bubblewrap/common/src/bwrap_command.rs

@@ -11,7 +11,21 @@ use std::collections::HashSet;
 
 use wxc_common::filesystem_resolve::FsIntent;
 use wxc_common::models::{ExecutionRequest, NetworkPolicy, ProxyAddress};
-use wxc_common::proxy_env::{is_managed_proxy_key, PROXY_SET_KEYS};
+
+/// Env var keys that the proxy block manages. Listed here so we can strip
+/// any conflicting entries the caller supplied via `request.env` (callers
+/// must not be able to defeat the cooperative proxy by injecting their own
+/// proxy env vars).
+const PROXY_ENV_KEYS: &[&str] = &[
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "ALL_PROXY",
+    "http_proxy",
+    "https_proxy",
+    "all_proxy",
+    "NO_PROXY",
+    "no_proxy",
+];
 
 /// Read-only host paths bind-mounted into every Bubblewrap sandbox as the
 /// deny-by-default baseline. Mirrors the seatbelt backend's
@@ -217,7 +231,7 @@ pub fn build_args_classified(
         if let Some((key, value)) = env_str.split_once('=') {
             // When the proxy is active, drop any caller-supplied proxy env
             // entries so they cannot override the values we set below.
-            if proxy_address.is_some() && is_managed_proxy_key(key) {
+            if proxy_address.is_some() && PROXY_ENV_KEYS.contains(&key) {
                 continue;
             }
             args.extend(["--setenv".into(), key.into(), value.into()]);
@@ -240,8 +254,15 @@ pub fn build_args_classified(
     // destinations.
     if let Some(addr) = proxy_address {
         let url = addr.to_url();
-        for key in PROXY_SET_KEYS {
-            args.extend(["--setenv".into(), (*key).into(), url.clone()]);
+        for key in [
+            "HTTP_PROXY",
+            "HTTPS_PROXY",
+            "ALL_PROXY",
+            "http_proxy",
+            "https_proxy",
+            "all_proxy",
+        ] {
+            args.extend(["--setenv".into(), key.into(), url.clone()]);
         }
     }
 

src/backends/wslc/common/src/wsl_container_runner.rs

@@ -975,57 +975,17 @@ impl WSLContainerRunner {
             return sdk_error("WslcSetProcessSettingsCmdLine failed", hr, "");
         }
 
-        // Route egress through the cooperative proxy: WSLc has no in-kernel
-        // iptables, so per-host policy is enforced at the proxy layer by
-        // injecting HTTP(S)_PROXY (and scrubbing caller-supplied proxy vars).
-        // See wxc_common::proxy_env.
-        let effective_env: Vec<String> = if request.policy.network_proxy.is_enabled() {
-            // url-only (also enforced at parse time). Fail fast rather than
-            // inject an empty HTTP_PROXY= for the localhost/builtinTestServer
-            // forms, which carry no routable URL.
-            let proxy_url = match request
-                .policy
-                .network_proxy
-                .address
-                .as_ref()
-                .and_then(|addr| addr.original_url.clone())
-            {
-                Some(url) => url,
-                None => {
-                    return ScriptResponse::error(
-                        "WSLC: network.proxy requires the 'url' form (a routable proxy URL); \
-                         the localhost and builtinTestServer forms are not supported because a \
-                         WSLc container runs in its own network namespace.",
-                    );
-                }
-            };
-            let _ = writeln!(
-                logger,
-                "[WSLC] Cooperative network proxy configured: {}",
-                wxc_common::proxy_env::redact_proxy_url(&proxy_url)
-            );
-            wxc_common::proxy_env::apply_cooperative_proxy_env(&request.env, &proxy_url)
-        } else {
-            request.env.clone()
-        };
-
-        // Env buffers must outlive WslcCreateContainer: the SDK stores the
-        // pointers into process_settings (it does not copy), and reads them at
-        // container-create time. Hoisting to function scope keeps them alive —
-        // mirrors the cmdline/_cwd_cstr handling. Scoping them inside the `if`
-        // below frees them early and causes a use-after-free (0xC0000005).
-        let _env_cstrings: Vec<Vec<u8>>;
-        let _env_ptrs: Vec<PCSTR>;
-        if !effective_env.is_empty() {
-            _env_cstrings = effective_env
+        if !request.env.is_empty() {
+            let env_cstrings: Vec<Vec<u8>> = request
+                .env
                 .iter()
                 .map(|e| format!("{}\0", e).into_bytes())
                 .collect();
-            _env_ptrs = _env_cstrings.iter().map(|e| e.as_ptr() as PCSTR).collect();
+            let env_ptrs: Vec<PCSTR> = env_cstrings.iter().map(|e| e.as_ptr() as PCSTR).collect();
             let hr = sdk.WslcSetProcessSettingsEnvVariables(
                 &mut process_settings,
-                _env_ptrs.as_ptr(),
-                _env_ptrs.len(),
+                env_ptrs.as_ptr(),
+                env_ptrs.len(),
             );
             if hr != S_OK {
                 return sdk_error("WslcSetProcessSettingsEnvVariables failed", hr, "");