Network Security With Egress Control Sidecar And Dns Proxy

Secure, Fast, and Extensible Sandbox runtime for AI agents.

Unique: Combines DNS proxy layer with nftables filtering in a dedicated sidecar process, providing defense-in-depth where DNS-level blocking prevents resolution and netfilter rules block any direct IP-based access. This two-layer approach prevents DNS rebinding attacks and IP spoofing while maintaining low overhead.

vs others: Unlike simple firewall rules or iptables, the DNS proxy + nftables combination provides both DNS-level and network-level enforcement with policy-based filtering, offering better protection against sophisticated exfiltration attempts than single-layer approaches.