Restrict network egress and command execution outside the model

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R25 — Docker network & process isolation

   R10 — OWASP SSRF & OS Command Injection Cheat Sheets

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Enforce strict network egress allowlists (only approved local/test domains) and block arbitrary shell/OS command execution outside the model in the computer-use worker container.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Attempt to make the browser agent navigate to an unapproved external domain or internal metadata IP (169.254.169.254) via webpage redirect or prompt text; prove the infrastructure network policy blocks it.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Browser egress-restriction and command-denial verification tests.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R10OWASP Cheat Sheet Series↗ cheatsheetseries.owasp.org

  Authorization, SQL Injection Prevention, File Upload, SSRF, Secrets Management, and Logging Cheat Sheets.

• R25Docker Security Docs↗ docs.docker.com

  Daemon surface, Linux namespaces/capabilities, rootless/non-root containers, read-only FS, and secrets.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsDocker · reference
  Docker Engine security | Docker Docs

  Explains namespaces, cgroups, capabilities and rootless mode, the primitives you use to stop a compromised computer-use worker from reaching the host or executing privileged operations.

  R25checked 2026-11-11
• videoDatadog · 7 min
  Container Security Fundamentals - Seccomp

  Shows how a seccomp profile filters syscalls, which is how you block execve/fork so the worker cannot spawn an arbitrary shell outside the model even if the agent emits a command string.

  R25checked 2026-11-11
• videoDatadog · 8 min
  Container Security Fundamentals - Linux Capabilities (Part 1)

  Explains how capabilities such as CAP_NET_ADMIN and CAP_SYS_ADMIN expand a process's authority, so you can drop them and keep the worker's reach limited to the approved local test domains.

  R25checked 2026-11-11
• articleNorthflank · ~10 min read
  How to design networking for secure AI-agent sandboxes | Blog — Northflank

  Lays out default-deny egress, domain allowlists, DNS controls and credential brokering for agent sandboxes, the concrete policy structure for permitting only approved local/test domains.

  R25R10checked 2026-11-11
• repoGitHub · runnable reference setup
  GitHub - mrinterweb/devcontainer-egress: Hostname-allowlist egress proxy for sandboxed dev environments running coding agents

  Provides a working hostname-allowlist proxy configuration for a sandboxed agent container, which you can adapt to prove that only approved domains resolve while all other egress is dropped.

  R25checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.