Isolate Docker runtime networking - #2469
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4319376412
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4a23d638a5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
ApprovabilityVerdict: Not approved Macroscope's review found this PR not approvable — This PR changes Docker network namespaces, host callback routing, service exposure, and restricted-egress enforcement, affecting both runtime behavior and security boundaries. An unresolved review comment also identifies a concrete localhost IPv6 compatibility regression that needs validation. You can add or adjust custom eligibility rules. Learn more. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bde69926eb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
bde6992 to
0307fbf
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0307fbf184
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
0307fbf to
15a7f8d
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 15a7f8d046
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
15a7f8d to
591b638
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 591b638000
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
591b638 to
669944a
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 669944aef1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
ea1b4e9 to
f2d3ebc
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f2d3ebcea6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
f2d3ebc to
752a16f
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 752a16f2c0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
752a16f to
944a671
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 944a671cce
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
944a671 to
4844f9f
Compare
af7126b to
bee40a7
Compare
bee40a7 to
bd81959
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bd81959afc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if host.lower() == HOST_ALIAS or ( | ||
| callback is not None and host.lower().endswith("localhost") | ||
| ): | ||
| dial_host = "127.0.0.1" |
There was a problem hiding this comment.
When an unrestricted Docker harness receives a callback such as http://localhost:<port> but the host service listens only on ::1, this branch replaces the hostname with 127.0.0.1, so the relay returns 502 even though the URL worked with the previous host-network path and explicit ::1 callbacks are supported. Resolve localhost normally and try its loopback addresses rather than unconditionally pinning these names to IPv4.
Useful? React with 👍 / 👎.
bd81959 to
3693ce7
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3693ce7b60
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
3693ce7 to
f914d34
Compare
f914d34 to
a2dddb7
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a2dddb7bfb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit a2dddb7. Configure here.
a2dddb7 to
9ef4e74
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9ef4e74b7e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
9ef4e74 to
2a083c7
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2a083c700a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
2a083c7 to
0db4210
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0db4210bb1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
0db4210 to
c7ea548
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c7ea548714
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
c7ea548 to
3d72db2
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3d72db2a21
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
1 participant
Superseded by #2528.
Overview
Give each Docker runtime its own network namespace so task services cannot collide with listeners on the host. Closes #2319.
Details
Runtime.expose()so MCP URLs remain reachable without host networking.NO_PROXYexclusions into the runtime environment used for execution.The callback relay intentionally supports framework-owned HTTP endpoints. It rewrites loopback
Locationheaders to keep redirects reachable, but it does not rewrite application cookies or provide transparent TLS forwarding.Note
High Risk
Changes core Docker networking, MCP reachability, and egress/callback security boundaries; misconfiguration or kernel differences in the iptables cut could break sandboxes or leak host access.
Overview
Docker runtimes no longer use host networking. Containers run on bridge, reserve
SERVICE_PORT(8000), and publish it to a host-chosen 127.0.0.1 port so task listeners cannot collide with the host.Exposure and MCP URLs are unified on
Runtime.expose(): the base implementation now returnshttp://127.0.0.1:{port}instead ofNone;DockerRuntimereturns the recorded mapped URL.reachable_urlalways goes throughexpose, opens aPrimeTunnelwhen a local runtime must be reached from a remote consumer, and fails clearly if exposure is missing.serve_in_runtimebinds0.0.0.0only when the server is exposed and the runtime has apublished_port.Host-loopback callbacks from inside Docker go through
EgressProxy.callback_url(tokenized/.vf-host/paths) in unrestricted mode, withOrigin/Locationrewriting so HTTP redirects stay reachable; restricted mode still usesHOST_ALIASand dynamic route registration. Policy egress treats all loopback targets as non-proxyable.Restricted egress gets a reworked route flush + iptables cut (conntrack for replies, minimal default route). Unrestricted runtimes still start the proxy for callbacks only; exec/background env merges image and process
NO_PROXYand applies the policy proxy only after the cut (or for detached restricted servers).Reviewed by Cursor Bugbot for commit 3d72db2. Bugbot is set up for automated code reviews on this repo. Configure here.
Note
Isolate Docker runtime networking via bridge network and host-callback proxy
SERVICE_PORT(8000) to a random host loopback port, and always starts anEgressProxy— policy-enforced in restricted mode, callback-only in unrestricted mode.EgressProxygains tokenized host-callback routing so container-originated HTTP traffic can reach host-loopback services via stable proxy URLs, with correct header and redirect handling (egress.py).MCP_HOSTwhenexposed=Trueand the runtime has apublished_port;reachable_urlnow selects a direct, exposed, or tunneled URL based on colocation.prepare_executionis reworked to use explicitip/iptablesrouting rules; container environment composition is centralized in_container_env.Runtime.exposedefault now returnshttp://127.0.0.1:<port>instead ofNone; callers that previously handledNonefromexpose()need to adapt.DockerRuntime.host_urlnow raisesValueErrorfor non-HTTP or non-loopback URLs where it previously may have passed through.Macroscope summarized 3d72db2.