Level 0: resolver Agent runtime

Claude Code, Codex CLI and Gemini CLI

Claude Code, Codex CLI and Gemini CLI run where developers and pipelines run. Their sandboxes decide whether a shell command has a network; they do not decide which names it may resolve. This guide applies the policy to the environment, so the scope holds whether the tool sandbox is on, off or unavailable.

Claude Code: OS sandbox for bash; ~/.claude/settings.json sandbox.network.allowedDomains
Codex CLI: OS sandbox; ~/.codex/config.toml [sandbox_workspace_write] network_access
Gemini CLI: Docker or Podman sandbox, or macOS seatbelt; SANDBOX_FLAGS
Covered here: Devcontainers, CI runners, managed workstations, the Gemini docker sandbox

Configuration and reference code for Claude Code, Codex CLI and Gemini CLI

Why

A coding agent has repository write access and a shell. Its sandbox network setting is a boolean or a prompt-grown allowlist, and both are turned off by a flag: --dangerously-skip-permissions, --sandbox danger-full-access, an open seatbelt profile. The policy sits in the environment the agent cannot reconfigure, and the same policy governs headless runs where no one is at the prompt.

Requirements

A policy per environment class, for example coding-agents-dev and coding-agents-ci. A DoH virtual site for workstations and hosted runners. A static site for self-hosted runners and devcontainer hosts.

1. Devcontainers

Pass the resolvers on the container. Every tool inside the devcontainer resolves under the policy.

.devcontainer/devcontainer.json

{
  "name": "agent-workspace",
  "build": { "dockerfile": "Dockerfile" },
  "runArgs": ["--dns=<primary resolver IP>", "--dns=<secondary resolver IP>"]
}

2. CI runners

Self-hosted runners: configure the VM per the Linux VM page under coding-agents-ci. Hosted runners: start a local DoH proxy against the virtual site in the first job step.

.github/workflows/agent.yml

jobs:
  agent:
    runs-on: ubuntu-latest
    steps:
      - name: Resolve through the Securd policy
        run: |
          curl -sSL -o dnsproxy.tgz https://github.com/AdguardTeam/dnsproxy/releases/latest/download/dnsproxy-linux-amd64.tar.gz
          tar xzf dnsproxy.tgz && sudo mv linux-amd64/dnsproxy /usr/local/bin/
          sudo dnsproxy -l 127.0.0.1 -p 53 -u "https://doh.securd.com/${{ secrets.SECURD_DOH_ADDRESS }}" &
          sudo sed -i 's/^nameserver.*/nameserver 127.0.0.1/' /etc/resolv.conf
      - uses: actions/checkout@v4
      - run: codex exec --sandbox workspace-write --ask-for-approval never "run the test suite and fix failures"

3. Managed workstations

Deploy the virtual site URL as the operating system DoH profile through MDM. The DoH page carries the macOS, Windows and Linux settings. Developer tools need no change.

DoH profile

https://doh.securd.com/<virtual site address>

4. Gemini CLI docker sandbox

Gemini CLI passes SANDBOX_FLAGS to the docker run that starts its sandbox.

~/.gemini/.env

GEMINI_SANDBOX=docker
SANDBOX_FLAGS="--dns=<primary resolver IP> --dns=<secondary resolver IP>"

5. Keep the tool sandboxes on

They are the inner boundary. The policy holds everything the allowlist does not name.

~/.claude/settings.json

{
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "network": { "allowedDomains": ["api.anthropic.com", "github.com", "*.npmjs.org", "pypi.org", "files.pythonhosted.org"] }
  }
}

~/.codex/config.toml

sandbox_mode = "workspace-write"
approval_policy = "on-request"

[sandbox_workspace_write]
network_access = true

6. Learn, then enforce

Import the model provider template and the package registry template on coding-agents-ci. Run Learn Only for seven days, review New Query events, approve, then set Default Action to Deny and Greywall Mode to Enforce.

Verify

Run once inside the tool sandbox and once with the sandbox disabled. The answers must be identical.

verify.sh

getent hosts first-seen-$(date +%s).example      # expected: <block page address>
dig +time=2 +tries=1 @8.8.8.8 example.com        # expected: connection timed out
getent hosts api.openai.com                      # expected: a public address

Limits

Unmanaged laptops without an MDM DoH profile are not governed. Codex Cloud and other vendor-hosted execution are not covered.

Vendor documentation this page was verified against

Claude Code: Sandboxing (September 2026)
Codex: Agent approvals and security (September 2026)
Gemini CLI: Sandboxing (September 2026)

Vendor settings change. Securd behaviour on this page (the block page answer, the per-policy baseline, the DoH base) is a property of the product and does not.

Deployment standard CI runners DoH virtual sites Hermes Agent OpenClaw OpenHands

Evaluate Agent DNS with your own agent traffic

Deploy on a single policy in learning mode and review the recorded destinations with your team.

See It Live View Pricing