[{"data":1,"prerenderedAt":118},["ShallowReactive",2],{"project-47588383":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":31,"aspects":33,"strip":35,"post_text":37,"what":38,"said":61,"maker_in_thread":67,"shape":69,"grid":71,"attempts":80,"same_week":81,"maker_shows":15,"maker_hidden":111,"reader_version":112,"card":113},"47588383","CargoWall","eBPF Firewall for GitHub Actions","title","Show HN: CargoWall – eBPF Firewall for GitHub Actions","https:\u002F\u002Fgithub.com\u002Fcode-cargo\u002Fcargowall-action","github.com","caleblloyd",1774969359,2026,14,2,2473,4366,57,"shown","security_privacy","network egress firewall for ci","library",[24,25,26,27],"ebpf firewall","github actions","ci security","egress filtering","quiet",null,{"positive":31,"neutral":32,"mixed":32,"critical":32},1,0,{"idea":34},{"positive":31,"critical":32},[32,36],5,"We just open-sourced CargoWall - a lightweight eBPF firewall for GitHub Actions.\n\nWe originally built it to stop LLM agents from connecting to untrusted domains. After recent GitHub Actions supply chain compromises like the Trivy attack, we realized it'd work well for blocking untrusted connections from CI runners too.\n\nIt uses iptables DNAT to redirect all outbound port 53 traffic to a local DNS proxy, which checks each query against a hostname allowlist before forwarding. Resolved IPs from allowed responses are inserted into eBPF LPM trie maps, and a TC egress classifier attached to the netw",{"problem":39,"audience":29,"pricing":29,"motivation":45,"time_to_build":29,"stack":49,"openness":58,"stage":59,"team_size":60},{"value":40,"source":41,"evidence":42},"Untrusted outbound connections from CI runners, such as those from supply chain compromises","maker",[43],{"id":44},"post",{"value":46,"source":41,"evidence":47},"Originally built to stop LLM agents from connecting to untrusted domains; extended to CI after supply chain attacks",[48],{"id":44},[50,54],{"value":51,"source":41,"evidence":52},"eBPF",[53],{"id":44},{"value":55,"source":41,"evidence":56},"iptables",[57],{"id":44},"open_source","launched","unknown",{"praise":62,"objections":63,"requests":64,"questions":65,"alternatives":66},[],[],[],[],[],{"comments":32,"answered":32,"key":68},[],{"commenters":15,"max_depth":15,"maker_replies":32,"first_comment_mins":70,"lifespan_hours":32},9,[72,76],[73,32,32,74,75,32],"47588530","other\u002Fneutral\u002Fnone","wkd415",[77,32,36,78,79,32],"47588785","project\u002Fpositive\u002Fidea","matthewdevenny",[],[82,87,91,96,101,106],{"id":83,"name":84,"points":85,"category":86},"47593422","1-Bit Bonsai",430,"ai",{"id":88,"name":89,"points":90,"category":86},"47536761","nullclaw",340,{"id":92,"name":93,"points":94,"category":95},"47557921","Git bayesect",337,"dev_tools",{"id":97,"name":98,"points":99,"category":100},"47580350","30u30.fyi",256,"other",{"id":102,"name":103,"points":104,"category":105},"47571183","korb",205,"consumer_social",{"id":107,"name":108,"points":109,"category":110},"47589856","pg_textsearch",203,"data",false,"v2",{"id":114,"name":5,"line":6,"ai":111,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":29,"top":18,"kw":115,"maker":11,"domain":10,"tier":19,"attempts":32,"strip":116,"url":9,"mix":117,"praise":-1,"objection":-1,"sub":21},47588383,[24,25,26,27],"05",[31,32,32,32],1794036697362]