Scope agent connections without a sidecar
A resolver setting in the manifest.
Policy at the network layer. No service mesh changes, no sidecars.
| Timestamp | Action | Site | Query Name | Source IP | Reason |
|---|---|---|---|---|---|
| 2026-09-15 03:10:02 | accept | build-agent | pypi.org | 10.40.8.2 | allow list |
| 2026-09-15 03:10:02 | accept | build-agent | files.pythonhosted.org | 10.40.8.2 | allow list |
| 2026-09-15 03:10:09 | greywall | build-agent | pkg-mirror-cdn.top | 10.40.8.2 | first seen, rank 0 |
| 2026-09-15 03:10:09 | accept | build-agent | github.com | 10.40.8.2 | allow list |
| 2026-09-15 03:11:30 | block | build-agent | dns.google | 10.40.8.2 | category: DoH provider |
Pipelines and agents reach the internet by default
A runner installs whatever the lockfile says and a coding agent fetches whatever it decides to. Both hold repository credentials. Egress by IP cannot express "the registries and the repo host, and nothing else," and a mesh change for every cluster is not a control anyone maintains.
Dependencies phone home
A poisoned package resolves a name during install. First-seen with rank zero is the tell.
Mesh and sidecar cost
A proxy per pod adds latency, config and a second failure mode. A resolver setting adds a line.
Per-environment scope
Build policies allow registries. Runtime policies must not.
The manifest is the deployment
dnsConfig or dns
Pod dnsConfig, compose dns, the daemon default for spawned sandboxes, a DoH proxy step on hosted runners.
NetworkPolicy for port 53
DNS egress only to the Securd resolvers. Everything else on 53 or 853 is dropped and counted.
Build and runtime policies
Registries on the build policy with the package registry template. Runtime policies hold everything first-seen.
DevOps and MLOps capabilities
Kubernetes
Per-namespace policies with dnsConfig, or a CoreDNS forward for one cluster-wide policy.
Docker and Compose
Per-container dns entries and the daemon default for containers the agent starts itself.
AWS, GCP, Azure
VPC option sets, forwarding zones and firewall rules with Terraform on each environment page.
CI runners
GitHub Actions and GitLab runners, self-hosted or hosted, with a DoH virtual site.
Registry templates
PyPI, npm, crates.io and Maven Central as a build policy template. Not on runtime policies.
Config as code
Policies and lists through the API with scoped keys. Apply from the pipeline; every change logged.
Pin DNS egress in the namespace
Port 53 only to the assigned resolvers; HTTPS unchanged. A workload that tries another resolver is denied and logged by the CNI.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: dns-only-to-securd, namespace: agents-research }
spec:
podSelector: {}
policyTypes: ["Egress"]
egress:
- to: [{ ipBlock: { cidr: <primary resolver IP>/32 } }, { ipBlock: { cidr: <secondary resolver IP>/32 } }]
ports: [{ protocol: UDP, port: 53 }, { protocol: TCP, port: 53 }]
- to: [{ ipBlock: { cidr: 0.0.0.0/0 } }]
ports: [{ protocol: TCP, port: 443 }]Questions teams ask
Does this add latency to builds?
Anycast resolvers with caching answer the lookup; the connection is unchanged. There is no proxy in the data path.
How do hosted runners work?
A job step starts a local DoH proxy against a virtual site and points resolv.conf at it. The CI runners page has the workflow.
Can policies be applied from the pipeline?
Yes. Policies, lists and sites are API resources with scoped keys. Every change is logged and revertible.
Scope one namespace this week
A dnsConfig block and a NetworkPolicy. Review the first-seen names on Friday.