{{ message }}
Repository navigation
fix(gateway): honor container network restrictions - #611
Open
doringeman wants to merge 1 commit into
Open
doringeman wants to merge 1 commit into
doringeman wants to merge 1 commit into
Conversation
Author
Author
|
[Dorin Geman / rt-security-fixes] REVIEW-REQUEST: please review current head 2bde27a with security, engineering and product perspectives, covering both ordinary/POCI container callers and proxy/default precedence. Comment-only agent review requested; humans approve. @doringeman BLOCKED on upstream review-request permissions: the required Copilot GraphQL request was rejected because this account has READ access to docker/mcp-gateway. An upstream maintainer must request that bot review. Local full-diff Copilot CLI review completed cleanly, CodeRabbit was requested, and CI is running. No repository settings or permissions were changed. |
Author
doringeman
marked this pull request as ready for review
October 22, 2026 09:11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What I did
Honor explicit network restrictions in both gateway-launched container paths. Previously, ordinary MCP containers retained inherited gateway networks alongside their allow-host proxy, or inherited/default networking without a proxy. Tool containers ignored the global block flag.
Share network argument selection:
--block-networkselects only the configured proxy network ornone; tool containers have no allow-host configuration and selectnone. Per-serverdisableNetworktakes precedence, suppresses proxy configuration, and avoids starting proxy sidecars. Unblocked networking and defaults stay unchanged.This controls local container launch arguments. Remote/static backends, shared proxy-network trust and isolation, and host capabilities exposed through mounts remain outside this fix.
Related issue
Fixes #610.
Review status
The required upstream Copilot bot request was rejected because the author has READ access to this repository. An upstream maintainer must submit it. Local Copilot CLI review is complete and clear; CodeRabbit and a different-human agent review were requested. The PR remains draft.
Validation
make testandmake lintpass, including Linux/Darwin/Windows lint targets.Manual verification: run
make test. Both network-policy tests should pass: unblocked launches preserve inherited/default networking; blocked launches select only the proxy ornone;disableNetworksuppresses all proxy options. The prior implementation fails the new blocked and precedence assertions. No host daemon or credential changes are required.