The default
An allowlist
ports defaults to [443].
context.fetch checks host and effective port against network.egress before
the request leaves.
It requires an operator to enable it
Direct egress is off unless the operator setsTINY_FIRECRACKER_ALLOW_EGRESS=true on the worker. Otherwise
capabilities() reports it honestly and planning rejects the manifest — a
plan refuses rather than a deploy failing halfway.
Hostnames are resolved once, by the host
When egress is enabled, the host resolves each declared hostname once, at deploy time, and writes the resulting addresses into that VM’s own nftables forward chain, along with a single permitted DNS resolver (TINY_EGRESS_RESOLVER, default 1.1.1.1) and a masquerade rule for the guest
address.
Resolving on the host rather than trusting the guest’s own DNS is the point. A
name-based rule can be widened later by whoever controls the answer; a pinned
address cannot. The guest cannot widen its own allowlist afterwards by answering
DNS differently.
Private ranges are refused outright
A hostname that resolves into a private range is refused, not allowed with a warning. An egress rule that reaches the host’s own network is lateral movement, not egress.Widening the allowlist is an approval gate
A new outbound host in production triggersEGRESS_ALLOWLIST_EXPANDED. The
deployment pauses in awaiting_approval. See Approvals.
What this does not do
It does not open the broker port to arbitrary traffic
It does not open the broker port to arbitrary traffic
Guest-originated connections to the host are still accepted only on the
control-plane port that serves the broker and the data service. Egress rules
are a separate forward chain.
It does not survive a re-resolve
It does not survive a re-resolve
Addresses are pinned for the life of that VM. If the upstream changes IPs,
redeploy. That is a deliberate trade for the guarantee above.
It is not a degraded mode if nftables fails
It is not a degraded mode if nftables fails
Firecracker itself does not filter network traffic. The backend fails the
deployment if TAP or nftables creation fails — removing or bypassing that
setup is a security failure, not a fallback.