GoRunner docs
Search or askSearch⌘K

Outbound access

Choose which private addresses workflow steps may reach.

4 min · Self-hosted

Every connection a step makes is checked where it is made: after the name is looked up, and again at each redirect. That holds for every app, a step’s own proxy and a company proxy.

AddressesSteps may reach them
The public internetAlways
Private networks and this server: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10, 127.0.0.0/8, fc00::/7Only when you allow them
The cloud metadata service, other link-local, multicast and reserved addresses, the provider’s name server, a socket on this serverNever

Allow a private network

  1. In .env, list the ranges and addresses steps may reach, separated by commas.
  2. Apply it with ./deploy.sh "$(cat VERSION)".
.env
WORKFLOW_PRIVATE_NETWORKS=10.0.4.0/24,192.168.1.20

Empty, the default, allows none. all allows every private range, GoRunner’s own database and Redis included. On Kubernetes it is workflows.privateNetworks.

Warning Where your customers build workflows, through Embed or their own organizations, anyone who builds can call any address this allows. Leave it empty, or list only what their workflows should reach. Never all.

Check it

The preflight check prints the rule in force:

Output
✓ Workflow steps: private networks blocked

With a list, it reads private networks blocked except 10.0.4.0/24, 192.168.1.20/32. Cloud metadata addresses are always blocked.

When a step is refused

The step fails with one sentence that names only the host, because the people who build may be your customers:

Output
This address can’t be reached from workflows: intranet.example.com.

A connection test says “This connection can’t reach this address: …”. The worker’s log has the rest: one WARN line with the host, the address it resolved to, the range, the setting that would allow it, and the run_id and step.

bash
docker compose logs worker | grep "refused by the address rule"
What about notification and OAuth addresses?

They follow another setting, OUTBOUND_ALLOW_PRIVATE. Off, notification endpoints and your own OAuth apps’ token addresses must be https on the public internet. true also allows plain http, this server and your private network. It never applies to workflow steps.

Checked against 12d85b3b