Proxy & SSH Gateway
Relevant source files
The following files were used as context for generating this wiki page:
The Proxy & SSH Gateway components form the networking backbone of the Daytona infrastructure, enabling secure access to isolated sandboxes. The Proxy service handles HTTP/HTTPS traffic, providing URL-based access to web applications running within sandboxes, while the SSH Gateway provides a secure entry point for terminal-based access and remote development via the SSH protocol.
These services act as intermediaries between the external network and the internal sandbox environments, ensuring that traffic is correctly routed, authenticated, and monitored. In local development environments, these are often configured to work with *.proxy.localhost domains to facilitate seamless connectivity.
Sources: docker/README.md, apps/proxy/pkg/proxy/proxy.go
Request Proxy Service
The Proxy service is a request-routing intermediary designed to expose ports from Daytona sandboxes to the browser or external APIs. It implements security features such as OIDC authentication and browser-specific warning pages to protect users from untrusted content.
Browser Warning System
To ensure security when accessing sandbox previews, the proxy implements a mandatory warning page for browser-based requests. This system informs users that they are visiting a preview URL served through Daytona and requires explicit acknowledgment before proceeding.
This diagram illustrates the logic used by the proxy to determine whether to show the preview warning page based on user agent and session state.
The system uses specific headers and cookies to manage this state:
X-Daytona-Skip-Preview-Warning: A header used to bypass the warning for trusted internal requests.daytona-preview-page-accepted: A cookie (max age: 1 day) that stores the user's acceptance of the security risks.
Sources: apps/proxy/pkg/proxy/warning_page.go:34-80, apps/proxy/pkg/proxy/warning_page.go:19-22
Proxy Configuration
The Proxy service is configured via environment variables, particularly when integrated with OIDC providers like Auth0.
| Variable | Description |
|---|---|
OIDC_CLIENT_ID | The SPA application client ID for authentication. |
OIDC_DOMAIN | The OIDC issuer domain. |
OIDC_AUDIENCE | The identifier for the custom Daytona API. |
EnableTLS | Boolean flag to determine if the proxy serves traffic over HTTPS. |
Sources: docker/README.md, apps/proxy/pkg/proxy/warning_page.go:207-210
SSH Gateway
The SSH Gateway is a specialized service that handles sandbox SSH access. It allows developers to connect their local IDEs or terminal emulators directly to the sandbox environment using standard SSH tooling.
Authentication & Security
The SSH Gateway integrates with the OIDC provider to manage user identities and access. In a production-ready or containerized setup, it typically interfaces with services like Dex for identity management. Users can regenerate their SSH key-pairs through the Daytona API, which the Gateway then uses to validate incoming connections.
Local Development Connectivity
For local environments, Daytona uses a specific DNS setup to resolve sandbox addresses.
This diagram shows how local requests are routed through a configured DNS setup to reach sandbox services.
Sources: docker/README.md, apps/ssh-gateway/main.go
Technical Implementation Details
Host Parsing and Routing
The proxy identifies the target sandbox and port by parsing the Host header of incoming requests. This allows a single proxy instance to route traffic to multiple different sandboxes based on the subdomain.
| Port Type | Function |
|---|---|
TERMINAL_PORT | Routed directly to the sandbox terminal interface. |
TOOLBOX_PORT | Internal port for Daytona management tools. |
RECORDING_DASHBOARD_PORT | Access to session recording visualizations. |
Sources: apps/proxy/pkg/proxy/warning_page.go:73-77
WebSocket Handling
The proxy explicitly detects WebSocket upgrade requests by checking the Connection: upgrade and Upgrade: websocket headers. These requests bypass standard browser warning middlewares to ensure that terminal sessions and HMR (Hot Module Replacement) connections are not interrupted.
Sources: apps/proxy/pkg/proxy/warning_page.go:226-231
Summary
The Proxy and SSH Gateway are essential components for the Daytona lifecycle, providing the primary interface for users to interact with their sandboxes. While the Proxy focuses on web-based previews with robust security filtering (OIDC and browser warnings), the SSH Gateway ensures low-latency, secure terminal and IDE access. Together, they abstract the underlying infrastructure, allowing developers to access their environments through standard web and shell protocols.