How to Configure Windows Sandbox Local Traefik Reverse Proxy via XML in Windows 11

When developing modern microservice architectures, evaluating API gateway routing rules, or testing TLS termination with PathPrefix matchers, running reverse proxy configurations directly on developer workstations can create port conflicts with existing local services. Traefik is a cloud-native edge router and reverse proxy that handles dynamic configuration without restarts. By authoring a custom Windows Sandbox (.wsb) configuration file paired with an automated PowerShell logon script, developers can spin up a fully isolated Traefik reverse proxy instance inside an ephemeral Hyper-V sandbox in seconds. This tutorial covers the complete configuration.

The Architecture of an Ephemeral Edge Router

Windows Sandbox operates in a virtual machine communicating with the host over virtual NAT. By mapping a host folder containing the portable Traefik Windows binary (traefik.exe), static YAML configuration files (traefik.yml), and dynamic route files (dynamic_conf.yml) via <MappedFolders>, the sandbox boots, starts Traefik on port 80 (HTTP) and 8080 (Dashboard), and launches Microsoft Edge automatically upon logon.

Structuring Host Folders and Assets

Create a dedicated configuration directory on your Windows 11 host (for example, C:\SandboxTraefik):

C:\SandboxTraefik\
├── traefik.exe
├── traefik.yml
├── dynamic_conf.yml
├── Start-Traefik.ps1
└── Traefik_Sandbox.wsb

Authoring Traefik Configuration Files

Save the static configuration as C:\SandboxTraefik\traefik.yml:

api:
  insecure: true
  dashboard: true

entryPoints:
  web:
    address: ":80"

providers:
  file:
    filename: "C:/SandboxAssets/dynamic_conf.yml"
    watch: true

log:
  level: INFO

Save the dynamic routing definitions as C:\SandboxTraefik\dynamic_conf.yml:

http:
  routers:
    api-router:
      rule: "PathPrefix(`/api`)"
      service: "api-service"
      entryPoints:
        - "web"

  services:
    api-service:
      loadBalancer:
        servers:
          - url: "https://httpbin.org"

Authoring the Automated Traefik Provisioning Script

Save the following PowerShell script as C:\SandboxTraefik\Start-Traefik.ps1:

# Start-Traefik.ps1 - Automated Traefik Launcher inside Sandbox
param (
    [string]$TraefikDir = "C:\SandboxAssets"
)

Write-Host "Initialising Traefik Reverse Proxy inside Windows Sandbox..." -ForegroundColor Cyan

$TraefikExe = Join-Path $TraefikDir "traefik.exe"
$ConfigFile = Join-Path $TraefikDir "traefik.yml"

if (-not (Test-Path $TraefikExe)) {
    Write-Warning "traefik.exe not found at: $TraefikExe"
    Exit 1
}

# 1. Start Traefik process in background
$Process = Start-Process $TraefikExe -ArgumentList "--configFile=`"$ConfigFile`"" -PassThru -NoNewWindow

Start-Sleep -Seconds 3

Write-Host "==========================================" -ForegroundColor Green
Write-Host "Traefik Router is LIVE on port 80!" -ForegroundColor Green
Write-Host "Traefik Dashboard: http://localhost:8080/dashboard/" -ForegroundColor Yellow
Write-Host "Route Test Endpoint: http://localhost/api/get" -ForegroundColor Cyan
Write-Host "==========================================" -ForegroundColor Green

# 2. Open Edge to Dashboard
Start-Process "msedge.exe" "http://localhost:8080/dashboard/"

# Keep session active
Wait-Process -Id $Process.Id

Creating the WSB XML Configuration

Create Traefik_Sandbox.wsb with mapped folder access and automated script execution:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\SandboxTraefik</HostFolder>
      <SandboxFolder>C:\SandboxAssets</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\SandboxAssets\Start-Traefik.ps1 -TraefikDir C:\SandboxAssets</Command>
  </LogonCommand>
</Configuration>

Running and Auditing Reverse Proxy Routes

1. Double-click Traefik_Sandbox.wsb on your Windows 11 host.
2. Windows Sandbox spins up, mounts the host directory, and launches Traefik.
3. Microsoft Edge opens automatically at http://localhost:8080/dashboard/, visualizing active routers, services, and middleware.
4. Test route routing by visiting http://localhost/api/get; Traefik routes the request seamlessly.
5. Close the sandbox window when finished. All processes and network bindings terminate completely without touching host network adapters.