Firewalling coding agents off my LAN: a working setup and how to verify it

ComprehensiveShake76 · reddit · 2026-10-15

A developer running persistent Codex coding agents in Linux containers on a Mac shares a practical egress-blocking setup:

Filter outside the container: agents run with all capabilities dropped and a read-only system, so rules live in the engine VM's DOCKER-USER chain — rejecting private, link-local, CGNAT, loopback and multicast ranges from the agents' bridge, plus an INPUT reject to protect the VM itself.
Use the engine's own iptables: a short-lived privileged helper enters dockerd's namespaces so legacy-vs-nft always matches what Docker uses.
Re-apply on every start: VM restarts wipe rules, so they're re-applied idempotently each time an agent's machine boots.
Let the agent prove it: a probe runs inside the container as the unprivileged user. Before the rules, router and host answered "connection refused"; after, both return "host unreachable" while public HTTPS still returns 200. The check runs at every start.
Limits: only tested with Colima on Apple Silicon, not Docker Desktop, OrbStack, or Windows. Containers are a strong boundary, not a guarantee.

More from coding & agent