Skip to content

cayu.egress.proxy_exposure

Public Cayu API. Definitions are grouped by their public source module, and definitions from private implementation modules appear on their package’s page; adding a symbol does not move existing links. The import shown at each entry is a supported public namespace. Read the Python API overview and install the required extra.

ExposedProxy

Section titled “ExposedProxy”
from cayu.extensions.egress import ExposedProxy

A runtime-reachable URL for one in-process Cayu proxy listener.

credentialless_isolated is an explicit transport-boundary assertion: the endpoint is reachable only by the intended sandbox and Cayu’s trusted host, not by the public internet, a shared tenant network, or another sandbox. Credentialless routes fail closed unless an exposure makes this assertion.

Decorators: @dataclass.

Fields and attributes

Section titled “Fields and attributes”

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name Type Default
proxy_url str required
teardown Callable[[], Awaitable[None]] | None None
credentialless_isolated bool False

close (method)

Section titled “close (method)”
async ExposedProxy.close() -> None

Release source · Runtime guarantees · Capability guides

ProxyExposure

Section titled “ProxyExposure”
from cayu.extensions.egress import ProxyExposure

Exposes a local Cayu proxy listener to a sandbox runtime.

Bases: Protocol.

expose (method)

Section titled “expose (method)”
async ProxyExposure.expose(*, local_host: str, local_port: int) -> ExposedProxy

Release source · Runtime guarantees · Capability guides

VpcTaskProxyExposure

Section titled “VpcTaskProxyExposure”
from cayu.egress import VpcTaskProxyExposure

Advertise a proxy listener through the private IPv4 of its VPC task.

This exposure is intended for a Cayu control plane running in ECS/Fargate. Lambda MicroVMs reach the in-process proxy through a VPC egress connector; the address is deliberately restricted to RFC 1918 space so an accidental public listener cannot become the credential-broker boundary.

init (method)

Section titled “init (method)”
VpcTaskProxyExposure.__init__(task_ipv4: str) -> None

expose (method)

Section titled “expose (method)”
async VpcTaskProxyExposure.expose(*, local_host: str, local_port: int) -> ExposedProxy

Release source · Runtime guarantees · Capability guides