Technology · Discipline

Network egress confinement

The most privileged agent seat in my estate is fenced: its only way out is a proxy that allows a handful of exact destinations.

AgentOS team-lead seatDeny-by-default egress proxyA preflight before every launch
The team-lead seat, fenced · illustrative
everything else, unreachablethe allow-listing proxy

A fence round the most privileged seat

AgentOS runs coding agents in containers, and the team-lead seat is the most privileged of them. It directs other agents and uses the estate's governance tools. My view was that a seat like that should reach its model vendor and nothing else, so I built deny-by-default network confinement for it. The seat's container sits on an internal network with no route out. Its one exit is an allow-listing proxy, and the proxy carries one thing: an encrypted connection to the seat's vendor endpoints.

I treat the agent's network as an attack surface and start from deny-all with one named exit.

The seat's vendor endpoints, encrypted
allowedDirect internet
Private address ranges
Cloud metadata endpoints
The host
Other agent containers
The estate's internal services
Raw IP addresses
Domains off the list
DNS from the seat's network
allow-listing proxy

The usual bypasses, closed

An allow-list has well-known ways around it, and each is closed explicitly.

A listed name resolving into private space
refusedTLS naming a different host
refusedA wildcard or address literal in the list
not allowed

The seat cannot reconfigure the proxy, and when the proxy is full it refuses new tunnels. The proxy holds no credentials, so confinement adds no secret to protect.

A rollout that proves the blocks

Rollout proves the blocks, in both directions, before any seat is trusted to them.

Install
Config checked, nothing changedChecksum-pinned proxy image builtPut in placeReconciled at every boot
Probe, both directions
Vendor connection
must succeedEvery blocked category
must fail
Before a team-lead seat starts
Proxy image identity matches the pinned buildWhole isolation shape checks outLaunch
The identity check is on the image, because a matching tag can sit on a different image.

Network confinement sits beside credential isolation: the seat's logins are isolated from other seats, and its traffic reaches only its vendor. The firewall, container networking and TLS are standard parts; the policy, the proxy and the proof-driven rollout and preflight are my design.