Networking and egress

Marshal runs entirely inside your own network. Nothing on the internet needs to reach in: the cluster only makes outbound connections. This page lists every outbound address Marshal itself uses, explains what your spaces reach, and shows how to plan access for the install. For how the parts fit together, see Architecture.

People on your network reach Marshal through its private entry point, such as an internal load balancer. The Marshal services call Marshal’s hosted services over HTTPS on port 443. Spaces reach only the addresses network policy allows, such as model APIs, git hosts and package registries.

The network model

The Marshal services and every space run inside your VPC or VNet. By default the installers keep Marshal private: EKS and GKE get an internal load balancer, and the k3s VM has no public address. Marshal is reachable only from inside your network, or through an access path you choose, such as a VPN or your own ingress.

Marshal never needs inbound access from the internet. Webhooks reach your install through an outbound connection to the webhook relay.

Reaching the cluster during install

The cluster is private, so whoever runs the install (terraform apply, helm install or your GitOps sync) needs a way into your network first.

You have VPN or bastion access

Run the install from a machine that already reaches the target VPC or VNet, the same way you reach any other private resource.

What the Marshal services reach

The Marshal services need outbound HTTPS (port 443) to these addresses. Every install uses the first four. The toolchain mirror serves spaces. The last two are used only by features you turn on.

Destination	Purpose	Needed
`registry.marshal.codes`	The chart and every image. In production your own pull-through cache is the only thing that talks to it, and your nodes pull from the cache. See Registry options.	Always, from the cache or the nodes
`keys.marshal.codes`	Public keys that verify your installation JWT.	Always
`tokens.marshal.codes`	Two exchanges for your installation JWT: a short-lived operational license, and a short-lived marketplace token. Also receives the hourly usage report, a small report of counts.	Always
`marketplace.marshal.codes`	The package catalog. The in-cluster marketplace reads it for every browse and install.	Always
`assets.marshalstatic.com`	The toolchain download mirror. Spaces use it when a toolchain’s own download host fails. Each file is checked against a known hash. Chart value `toolchainMirror.baseUrl`.	When spaces install toolchains
`hooks.marshal.codes`	The webhook relay. Your install keeps an outbound connection to it and pulls events. Chart value `webhookRelay.url`.	When an organization turns on Webhooks in Settings > Platform
`auth.marshal.codes`, or the host in `authBroker.url`	Brokered sign-in for the Slack connection.	When an organization turns on Slack and OAuth sign-in in Settings > Platform

If your firewall blocks egress by default, allow exactly the destinations above that you need, plus your usual internal DNS and NTP. Then allow what your spaces need, described next.

What your spaces reach

Agents in spaces do real work on the internet: they call a model API, clone and push code, and install packages. That traffic leaves from the nodes that run your spaces, so your firewall must allow it too. Typical destinations:

Model APIs, for example api.anthropic.com for Claude.
Git hosts, for example github.com.
Package registries, for example registry.npmjs.org and pypi.org.
Toolchain download hosts, the official host of each toolchain your packages install.

Marshal also controls this traffic itself. Every space starts with outbound access denied, and network policy rules decide which addresses an agent may reach. So your firewall sets the outer limit for the whole cluster, and network policy sets the limit for each space.

Plan access before you install

Settle three things before you start:

Who runs the install, and from where: their own machine or a bastion, with network access into the target VPC or VNet.
Egress rules for the Marshal services and for your spaces, as listed above.
The hostname your people will use, for example marshal.yourcompany.com. You need only the name before the first install step. Add the DNS record once the load balancer has an address.

The full checklist, with credentials, database and tools, is on Prerequisites.