CCR Container Networking (upstreamproxy)
How Claude Code Remote (CCR) containers handle outbound network traffic securely.
Overview
When Claude Code runs inside a CCR (Claude Code Remote) container, all outbound network traffic must be proxied through the CCR server for security and monitoring. The upstreamproxy system handles this.
Architecture
Plain text
┌─────────────────────────────────────────────────────┐
│ CCR Container │
│ │
│ ┌──────────┐ ┌──────────────┐ ┌───────────┐ │
│ │ curl/ │───▶│ MITM Proxy │───▶│ Relay │ │
│ │ gh/ │ │ (localhost) │ │ (WS) │ │
│ │ kubectl │ │ │ │ │ │
│ └──────────┘ └──────────────┘ └─────┬─────┘ │
│ │ │
│ HTTPS_PROXY=localhost:port │ │
│ SSL_CERT_FILE=/run/ccr/ca.crt │ │
└────────────────────────────────────────────┼────────┘
│
WebSocket tunnel
│
┌────────▼────────┐
│ CCR Server │
│ (outbound) │
└─────────────────┘