AI generated

Sorry, you’re right. Docker provides the isolation, while Linux firewall rules (iptables) block outbound connections by default. I explicitly allow the destinations needed for development, such as registry.npmjs.org on port 443 for downloading JavaScript packages, plus a few internal services for things like AI model access. Provider API credentials stay outside the agent container. Agents contact a narrowly configured internal gateway, which makes requests using credentials held in a separate, trusted environment. The agents can use the approved AI services without receiving their API keys. The agents run without permission to change the firewall rules. The restrictions apply to the programs and commands they execute, rather than relying on instructions telling the agents not to access the internet. My current setup allows destinations by their resolved IP addresses and ports. A potential upgrade would be to add Squid, a free, open-source proxy, in a separate Docker container. The agents would reach the internet only through that proxy, which would check requested website names against an allowlist. Docker networking or firewall rules would prevent them from connecting around it. Squid would provide more direct control over allowed website names and handle changes to their IP addresses. Both approaches can run entirely locally using Linux and Docker.