[WSLC] In-built proxy for networking #1462

Activity

1. Soham Das (SohamDas2021)

   self-assigned this

   on Oct 10, 2026
2. Soham Das (SohamDas2021)

   added

   Issue-FeatureA request for new or expanded product functionality.A request for new or expanded product functionality.

   OS-WindowsApplies specifically to Windows hosts or Windows behavior.Applies specifically to Windows hosts or Windows behavior.

   Backend-WSLCWindows WSL Container backend behavior or integration.Windows WSL Container backend behavior or integration.

   Priority1Critical customer, security, or reliability impact requiring immediate attention.Critical customer, security, or reliability impact requiring immediate attention.

   on Oct 10, 2026
3. Soham Das (SohamDas2021)

   added the

   Feature

   issue type on Oct 10, 2026
4. microsoft-github-policy-service

   added

   Needs-TriageHas not yet been reviewed, classified, and routed.Has not yet been reviewed, classified, and routed.

   on Oct 10, 2026
5. Soham Das (SohamDas2021)

   assigned

   Elliot (theelliotm)

   on Oct 10, 2026
6. microsoft-github-policy-service

   removed

   Needs-TriageHas not yet been reviewed, classified, and routed.Has not yet been reviewed, classified, and routed.

   on Oct 10, 2026
7. Anis Mohammed Khaja Mohideen (kanismohammed)

   removed

   Priority1Critical customer, security, or reliability impact requiring immediate attention.Critical customer, security, or reliability impact requiring immediate attention.

   on Oct 12, 2026
8. theelliotm commented on Oct 14, 2026

   

   Elliot (theelliotm)

   on Oct 14, 2026

   Last edited by theelliotm

   Contributor

   More actions

   Implementation Ideas

   Schema

   Use the current networking fields instead of a separate allow/deny list for the built-in proxy.

   Option 1: Default off
   Configs with CIDR filtering (or differing egress/ingress/hostLoopback values) must set (new!) wslc.useBuiltInProxy to true (defaults false) to be valid.

   Option 2: Default on (My preferred)
   Configs with CIDR filtering (or differing egress/ingress/hostLoopback values) automatically use the built-in proxy. Currently valid configs wouldn't use the proxy until updated to include CIDR filtering. No need to add wslc.useBuiltInProxy to the schema.

   Ideas

   The built-in proxy will be scoped to just CIDR filtering. No hostnames.

   Port mappings would be unaffected by the proxy.

   An explicit runtimeConfig.networkProxy will act as a second external proxy. Outbound traffic that passes the CIDR filter gets sent to the external proxy, inbound traffic arrives from the external proxy before being CIDR filtered. This is consistent with most other backends.