fnox proxy run

• Usage: fnox proxy run [--no-sandbox] [--sandbox] [COMMAND]…

Run a command with placeholder credentials behind the proxy

Resolves the secrets that [[proxy.rules]] names, plus any secrets their providers need, starts the proxy on a local port, and runs COMMAND with:

• each rule's variable set to a placeholder instead of the real value
• HTTP_PROXY, HTTPS_PROXY, and ALL_PROXY pointing at the proxy, with a per-session password that other users' processes don't have
• CA variables such as SSL_CERT_FILE pointing at the proxy's certificate
• every configured secret and common cloud credential variables removed

With --sandbox (or sandbox = true), the command also runs in an OS sandbox: its only network route is the proxy, the filesystem is read-only except for the working directory and temporary files, and fnox's configuration, keys and common credential directories are hidden.

The command's HTTP client must honor those proxy and CA settings. fnox exits with the command's exit status.

Arguments

• [COMMAND]… — Command to run, with its arguments

Flags

• --no-sandbox — Run the command without the sandbox, even if [proxy] enables it

• --sandbox — Run the command in an OS sandbox whose only way out is the proxy

  Also enabled by sandbox = true in [proxy]. Needs bwrap on Linux or sandbox-exec on macOS, and fails instead of running unsandboxed.

• -h --help — Print help

Examples

Run an agent behind the proxy

fnox proxy run -- node agent.js

See also

• Credential proxy