Docker and Compose

docker run

docker run --rm \
  --dns <primary resolver IP> --dns <secondary resolver IP> \
  -e SECURD_BLOCK_ADDRS=<block page address> \
  ghcr.io/example/research-agent:1.4

Compose

services:
  research-agent:
    image: ghcr.io/example/research-agent:1.4
    dns:
      - <primary resolver IP>
      - <secondary resolver IP>
    environment:
      SECURD_BLOCK_ADDRS: "<block page address>"
  finance-agent:
    image: ghcr.io/example/finance-agent:2.0
    dns:
      - <primary resolver IP of a different site>
      - <secondary resolver IP of a different site>

Host firewall

Deny outbound port 53 from the container network to any destination except the assigned resolvers. On a Linux host this is one iptables or nftables rule.

iptables -A DOCKER-USER -p udp --dport 53 ! -d <primary resolver IP> -j DROP
iptables -A DOCKER-USER -p tcp --dport 53 ! -d <primary resolver IP> -j DROP

Daemon default for containers you do not start yourself

Agent runtimes that spawn their own sandbox containers (Hermes Agent, OpenClaw, OpenHands, Gemini CLI) do not pass a --dns flag. Those containers take the Docker daemon default. On a host that runs systemd-resolved, the daemon cannot use the 127.0.0.53 stub; it substitutes the upstream servers it finds, or a public resolver when it finds none. The container then resolves under whatever the daemon chose, not under the policy assigned to the agent. Set the daemon default explicitly so every spawned container resolves under the sandbox policy.

{
  "dns": ["<primary resolver IP>", "<secondary resolver IP>"],
  "dns-search": []
}

Apply and verify the daemon default

A container started with no --dns flag must report the Securd resolvers. Any other resolver in that file is a path around the policy for every sandbox the agent spawns.

sudo systemctl restart docker
docker run --rm alpine cat /etc/resolv.conf
# expected: nameserver <primary resolver IP>
#           nameserver <secondary resolver IP>