Show HN: Buildcage – Egress filtering for Docker builds (SNI-based, no MitM)github.com2 ポイント·投稿者 dash14·4 か月前·0 コメント
Show HN: Buildcage – Restrict outbound network access during Docker buildsgithub.com1 ポイント·投稿者 dash14·5 か月前·2 コメント
dash14·5 か月前·議論Thanks for the interest and great question!The allowlist uses nginx's map directive with the `hostnames` parameter, so it supports several matching patterns:- Exact domains: `registry.npmjs.org` - Prefix wildcards: `.cloudfront.net` (matches any subdomain) - Suffix wildcards: `github.` (matches github.com, github.io, etc.) - Combined wildcards: `.example.com` (shorthand for both example.com and .example.com) - Regex patterns: `~^.\.amazonaws\.com$` for full PCRE supportFull nginx map documentation: https://nginx.org/en/docs/http/ngx_http_map_module.htmlI'll add this to the documentation. Thanks!
The allowlist uses nginx's map directive with the `hostnames` parameter, so it supports several matching patterns:
- Exact domains: `registry.npmjs.org` - Prefix wildcards: `.cloudfront.net` (matches any subdomain) - Suffix wildcards: `github.` (matches github.com, github.io, etc.) - Combined wildcards: `.example.com` (shorthand for both example.com and .example.com) - Regex patterns: `~^.\.amazonaws\.com$` for full PCRE support
Full nginx map documentation: https://nginx.org/en/docs/http/ngx_http_map_module.html
I'll add this to the documentation. Thanks!