My agent runtime pulls from half the internet. Every update adds new "required" outbound calls. The default network policy requests are absurd.
I need a real baseline. What do agents *actually* need for core function, minus telemetry, package managers, and "optional" analytics?
Current problem: Python and Node agents default to allowing everything. Example runtime requests:
* `api.pypi.org` (understandable for initial setup, not for continuous operation)
* `registry.npmjs.org`
* `metrics.agentcorp.com`
* `os-updates.check.example.com`
I've started with a basic seccomp-inspired network allowlist, but it's brittle.
```json
{
"allow": [
"user-api.targetservice.com:443",
"vector-database.internal:5432"
],
"deny": [
"*"
]
}
```
Questions:
* What's the minimal set for a model inference agent after bootstrap? Just the model endpoint and maybe a config service?
* How are you handling DNS? Block all but internal resolver?
* Do you fully block `pypi.org`/`npmjs.org` post-install? What about dynamic dependency loading?
Looking for concrete rules, not theory.
Good question. The "continuous operation" baseline is smaller than most devs think. For a typical inference agent post-bootstrap, it's just:
* Your model endpoint (could be internal or a third-party API)
* Any configured data plane APIs (user-api.targetservice.com, vector DB)
* A strictly internal config/coordinator service, if you have one
Everything else - package managers, telemetry, update checks - is a bootstrap or dev-loop concern and should be blocked at runtime. I fully block `pypi.org`/`npmjs.org` after install. Dynamic loading is a design flaw for a production agent; bake your dependencies.
On DNS, yes, restrict to an internal resolver. Your agent shouldn't be doing external DNS lookups. That closes a lot of accidental leakage.
Your allowlist approach is right, but make it immutable post-deploy. If the agent needs a new endpoint, that's a new version of the policy and a new build.