How to Configure Windows Sandbox Local Traefik TLS Dynamic Routing Rules via XML in Windows 11

Testing microservice routing rules and TLS termination topologies often requires a sandbox environment that mirrors production complexity without risking host configuration changes. In Windows 11, Windows Sandbox delivers an isolated, hardware-accelerated container that starts cleanly and leaves no persistent footprint upon exit. By orchestrating Windows Sandbox through custom XML configuration files (.wsb) alongside Traefik’s dynamic routing engine, developers can evaluate path-based routing, SNI matching, and header rewrite rules safely.

Sandboxed Routing Architecture

Using the Windows Sandbox MappedFolders directive, a local repository on the host machine containing Traefik configuration files and SSL certificates is mounted into the container. Traefik’s dynamic file provider monitors configuration updates in real time, reloading ingress rules instantly when files are saved on the host workstation.

Creating the Windows Sandbox WSB Configuration

Save the following XML as TraefikRoutingSandbox.wsb on your Windows 11 workstation:

<Configuration>
  <VGpu>Default</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:LocalClusterTraefik</HostFolder>
      <SandboxFolder>C:Traefik</SandboxFolder>
      <ReadOnly>false</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File "C:Traefikinit-router.ps1"</Command>
  </LogonCommand>
</Configuration>

Defining Dynamic Routing Rules in Traefik

Inside C:LocalClusterTraefikdynamic outes.yml, specify dynamic path-based routing rules:

http:
  routers:
    api-v1-router:
      rule: "Host(`app.sandbox.local`) && PathPrefix(`/api/v1`)"
      service: api-service-v1
      entryPoints:
        - websecure
      tls: {}

    api-v2-router:
      rule: "Host(`app.sandbox.local`) && PathPrefix(`/api/v2`)"
      service: api-service-v2
      entryPoints:
        - websecure
      tls: {}

  services:
    api-service-v1:
      loadBalancer:
        servers:
          - url: "http://127.0.0.1:8081"
    api-service-v2:
      loadBalancer:
        servers:
          - url: "http://127.0.0.1:8082"

Authoring the Sandbox Startup Script

Create init-router.ps1 inside C:LocalClusterTraefik to start mock backend listeners and initialise Traefik:

Write-Host "Initialising Traefik Dynamic Routing Sandbox..." -ForegroundColor Cyan
Set-Location "C:Traefik"

# Start mock HTTP backend endpoints for v1 and v2
$v1 = Start-Job -ScriptBlock {
    $listener = New-Object System.Net.HttpListener
    $listener.Prefixes.Add("http://localhost:8081/")
    $listener.Start()
    while ($listener.IsListening) {
        $ctx = $listener.GetContext()
        $buf = [System.Text.Encoding]::UTF8.GetBytes('{"version":"1.0","status":"healthy"}')
        $ctx.Response.OutputStream.Write($buf, 0, $buf.Length)
        $ctx.Response.Close()
    }
}

$v2 = Start-Job -ScriptBlock {
    $listener = New-Object System.Net.HttpListener
    $listener.Prefixes.Add("http://localhost:8082/")
    $listener.Start()
    while ($listener.IsListening) {
        $ctx = $listener.GetContext()
        $buf = [System.Text.Encoding]::UTF8.GetBytes('{"version":"2.0","status":"accelerated"}')
        $ctx.Response.OutputStream.Write($buf, 0, $buf.Length)
        $ctx.Response.Close()
    }
}

# Start Traefik reverse proxy
Start-Process "traefik.exe" -ArgumentList "--configfile=traefik.yml" -NoNewWindow
Write-Host "Traefik router is active on port 443 with dynamic rules." -ForegroundColor Green

Operational Advantages and Cleanup

Launching TraefikRoutingSandbox.wsb provides a sandboxed environment where routing rule modifications take effect immediately. Test edge cases such as regex path manipulations and SNI routing rules without installing network daemons or certificate roots on your primary Windows 11 host. Closing the sandbox window tears down all processes cleanly.