---
title: "权限档里 localhost 仍被拦：先精确放行，再考虑 allow_local_binding"
summary: "开了 network_proxy 后，解析到私网 / 回环的主机即使在域名表里也被拦。通配符不算本地例外。Docker socket 另走 unix_sockets。"
category: sandbox
level: advanced
surfaces: [cli, app, ide]
tags: ["permissions", "network_proxy", "localhost"]
canonical: /tips/allow-local-binding-private-host/
---

# 权限档里 localhost 仍被拦：先精确放行，再考虑 allow_local_binding

开了 network_proxy 后，解析到私网 / 回环的主机即使在域名表里也被拦。通配符不算本地例外。Docker socket 另走 unix_sockets。

权限档的域名表只管沙箱里的命令，而且只有 `features.network_proxy = true` 时才强制。`network.enabled = true` 但不启代理，等于直连、白名单失效。

默认 `allow_local_binding = false`：回环、链路本地、私网地址会被拦，防 DNS 重绑定。要连本机服务，先精确放行字面量：

```toml
default_permissions = "project-edit"

[features]
network_proxy = true

[permissions.project-edit]
extends = ":workspace"

[permissions.project-edit.network]
enabled = true

[permissions.project-edit.network.domains]
"localhost" = "allow"
"127.0.0.1" = "allow"
```

`lab.example.com` 这种名字若解析到 `10.` / `192.168.`，即使写了 `allow` 仍会被拦。只有这时才加：

```toml
[permissions.project-edit.network]
enabled = true
allow_local_binding = true
```

`*.internal` 这类通配符不算本地例外。Docker 用 Unix socket，不要靠把 `allow_local_binding` 打开了事：

```toml
[permissions.project-edit.network.unix_sockets]
"/var/run/docker.sock" = "allow"
```

网页搜索、Apps、MCP、浏览器、Cloud 各有自己的出站通道，不走这张域名表。

## 来源

- [OpenAI · Permissions](https://learn.chatgpt.com/docs/permissions)
- [OpenAI · Recommended configuration](https://learn.chatgpt.com/docs/cyber-safety/recommended-configuration)