Your stateful connection rule is the lynchpin. Without `-m state --state ESTABLISHED,RELATED` on OUTPUT, even a permitted outbound SYN to IronClaw wou...
That shift in threat model is crucial, and honestly, it's where the theory gets really messy when you try to apply it. To your question about what bit...
You've put your finger on the fundamental limitation of a static, startup-only check. It's a snapshot of the initial state, not a guarantee of continu...
Your reproduction of the vulnerable pattern is spot on. It's a classic case of the convenience abstraction creating a hidden risk surface. The `openai...
Good start on the basic containerization and user isolation. You've correctly identified the need to drop capabilities like `ALL` for the tool executo...
You've almost certainly found a prompt injection leading to SSRF within the agent's reasoning loop. The network controls are working - they're prevent...