Problem
--allow-host-service-ports in AWF is implemented purely via host iptables and has no effect under network-isolation (Docker topology) mode, which is gh-aw's default sandbox mode. Callers get the flag applied with no error, so sandboxed agents silently cannot reach services: containers via host.docker.internal.
Context
Reported in github/gh-aw#52140 (comment: "option B" chosen). gh-aw's legacy-security compiler logic and this AWF gap are two halves of the same bug; gh-aw is fixing the isolation-mode detection, but AWF needs matching support so --allow-host-service-ports works without requiring iptables/sudo mode.
Root Cause
--allow-host-service-ports today only wires host-level iptables rules (see src/host-iptables.ts), which are never applied in network-isolation/topology mode.- The agent container has no
host.docker.internal → host-gateway mapping in isolation mode (only the MCP gateway container gets --add-host host.docker.internal:host-gateway), so even routable traffic can't resolve the documented address.
Proposed Solution
Implement Option B: in topology/isolation mode, for each allowed host service port, add a Docker network route (e.g. extra_hosts: host.docker.internal:host-gateway plus targeted DNAT/ACCEPT rules scoped to those ports) to the agent container's compose service in src/docker-manager.ts, instead of relying solely on host iptables. Ensure awf --allow-host-service-ports documents and tests this path for isolation mode specifically (not just legacy-security/sudo mode).
Generated by Firewall Issue Dispatcher · auto · 26.5 AIC · ⊞ 9K · ◷
Problem
--allow-host-service-portsin AWF is implemented purely via host iptables and has no effect under network-isolation (Docker topology) mode, which is gh-aw's defaultsandboxmode. Callers get the flag applied with no error, so sandboxed agents silently cannot reachservices:containers viahost.docker.internal.Context
Reported in github/gh-aw#52140 (comment: "option B" chosen). gh-aw's
legacy-securitycompiler logic and this AWF gap are two halves of the same bug; gh-aw is fixing the isolation-mode detection, but AWF needs matching support so--allow-host-service-portsworks without requiring iptables/sudo mode.Root Cause
--allow-host-service-portstoday only wires host-level iptables rules (seesrc/host-iptables.ts), which are never applied in network-isolation/topology mode.host.docker.internal→ host-gateway mapping in isolation mode (only the MCP gateway container gets--add-host host.docker.internal:host-gateway), so even routable traffic can't resolve the documented address.Proposed Solution
Implement Option B: in topology/isolation mode, for each allowed host service port, add a Docker network route (e.g.
extra_hosts: host.docker.internal:host-gatewayplus targeted DNAT/ACCEPT rules scoped to those ports) to the agent container's compose service insrc/docker-manager.ts, instead of relying solely on host iptables. Ensureawf --allow-host-service-portsdocuments and tests this path for isolation mode specifically (not just legacy-security/sudo mode).