Show HN: CargoWall – eBPF Firewall for GitHub Actions(github.com)
github.com
Show HN: CargoWall – eBPF Firewall for GitHub Actions
https://github.com/code-cargo/cargowall-action
2 comments
Feels like CI/CD is still operating on a pretty optimistic threat model.
Yes - especially when you are building on GitHub hosted runners.
Enterprises who build within their own network typically have numerous safeguards on network egress. There is cost associated with that effort though and more friction to getting reliable, fast and repeatable build environments.
This eBPF firewall helps you lockdown that network egress on GitHub's cloud and gives you observability on what each build is reaching out to.
Enterprises who build within their own network typically have numerous safeguards on network egress. There is cost associated with that effort though and more friction to getting reliable, fast and repeatable build environments.
This eBPF firewall helps you lockdown that network egress on GitHub's cloud and gives you observability on what each build is reaching out to.
We originally built it to stop LLM agents from connecting to untrusted domains. After recent GitHub Actions supply chain compromises like the Trivy attack, we realized it'd work well for blocking untrusted connections from CI runners too.
It uses iptables DNAT to redirect all outbound port 53 traffic to a local DNS proxy, which checks each query against a hostname allowlist before forwarding. Resolved IPs from allowed responses are inserted into eBPF LPM trie maps, and a TC egress classifier attached to the network interface drops any packet whose destination IP/protocol/port isn't in the trie.
Cgroup hooks capture every socket connect/sendmsg call system-wide, mapping the socket cookie to the process to correlate where connections are coming from. It then correlates the connection times with steps to provide a summary of which connections originated from which steps.
ubuntu-latest and ubuntu-24.04 runners are supported. Simple one-step setup example:
eBPF Program: https://github.com/code-cargo/cargowall
GitHub Action: https://github.com/code-cargo/cargowall-action
We'd love for you to give it a try! Happy to answer questions or take feedback.