Buildcage
Restrict outbound access in Docker builds on GitHub Actions
What it does
Docker builds can fetch from any server on the internet. A compromised dependency could silently exfiltrate your build secrets. Buildcage prevents this. Define allowed domains, and everything else is blocked. Your Dockerfiles stay the same — no proxy injection, no certificate changes. TLS is never intercepted. Drop-in builder for Docker Buildx and GitHub Actions. - Audit mode to discover dependencies - Restrict mode to enforce your allowlist - Self-hostable for full control Open source.
Does the same job
all alternatives →- EBExtension-blocking domains removed by threat from other blacklists2017 · github.com · ▲614
- CECargoWall – eBPF Firewall for GitHub ActionsMar 2026 · github.com · ▲14
We just open-sourced CargoWall - a lightweight eBPF firewall for GitHub Actions. We originally built it to stop LLM agents from connecting to untrusted domains. After recent GitHub Actions supply chain compromises like the Trivy attack, we realized it'd work well for blocking untrusted connections from CI runners too. It uses iptables DNAT to redirect all outbound port 53 traffic to a local DNS proxy, which checks each query against a hostname allowlist before forwarding. Resolved IPs from allowed responses are inserted into eBPF LPM trie maps, and a TC egress classifier attached to the…
- CCCoasts – Containerized Hosts for AgentsMar 2026 · github.com · ▲99
Hi HN - We've been working on Coasts (“containerized hosts”) to make it so you can run multiple localhost instances, and multiple docker-compose runtimes, across git worktrees on the same computer. Here’s a demo: https://www.youtube.com/watch?v=yRiySdGQZZA. There are also videos in our docs that give a good conceptual overview: https://coasts.dev/docs/learn-coasts-videos. Agents can make code changes in different worktrees in isolation, but it's hard for them to test their changes without multiple localhost runtimes that are isolated and scoped to those…
- BBBuilding better base images2025 · github.com · ▲38
This project addresses the inefficiencies of traditional Dockerfile-based container builds where each customization layer creates storage bloat through duplicate dependencies from repeated apt-get install commands, network inefficiency from redundant package downloads across different images, and slow iteration cycles requiring full rebuilds of all previous steps. Our solution enables building minimal base images from scratch using debootstrap that precisely include only required components in the initial build, while allowing creation of specialized variants (Java, Kafka, etc.) from these…
More dev tools this month
the category →
The first open-source price index for GPU compute
Dev tools · 10d ago · getcomputable.com
OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.
Dev tools · 2d ago · opentrailpaper.com
Open-source GTM skills for technical founders
Dev tools · 29d ago · gtmcofounder.com
Launched alongside, March 2026
the whole month →
Switch from ChatGPT to Claude with import memory feature
AI · Mar 2026 · claude.com
