Every sandbox exits through the corporate proxy, and can't not

Policy says all outbound traffic from engineering machines goes through the corporate HTTP proxy, where it's logged. On laptops this is a losing war: a developer with root disables it by lunch.

On Hoody the rule is one PATCH to /api/v1/containers/{id}/network with type: http and the proxy URL. The exit is configured at the host level, outside the container's reach. Once set, direct egress is removed: a root shell inside the container can't add a route, can't edit a resolver, can't fall back to a direct connection. Platform services keep their own paths.

IT hands out sandboxes that comply by construction. The compliance team reads the corporate proxy's log and sees every container in it. Nobody audits laptops anymore.

The exit path is set on the host, and the container has no host.