docs(nested-containers): record what live verification established

Documents the proxy-layer precedence that took four attempts to get right, the blob-CDN routes every registry needs alongside its own, the podman 5 networking packages and how each one fails when absent, and the BusyBox wget caveat. Closes the DNS open question: public resolution inside a nested container fails by design; reaching the proxy was the real problem. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-21 21:01:35 -04:00
parent 0bf7f9ece6
commit 913bcab6a0
2 changed files with 64 additions and 5 deletions
@@ -116,8 +116,20 @@ egress:
      dlp: { outbound_detectors: false, inbound_detectors: false }
    - host: quay.io
      dlp: { outbound_detectors: false, inbound_detectors: false }
+    # Registries redirect layer blobs to a separate CDN host, which needs its
+    # own route or the pull 403s partway through.
+    - host: production.cloudfront.docker.com
+    - host: pkg-containers.githubusercontent.com
+    - host: cdn01.quay.io
 ```

+Inside a nested container the same allowlist applies — an allowlisted host
+returns 200 and anything else gets a 403 from the proxy. The gateway's CA and
+proxy settings are wired in automatically, so `docker run … curl https://…`
+works with no extra flags. One caveat: Alpine's BusyBox `wget` drops the
+connection after TLS interception and reports "error getting response"; `curl`
+against the same host works, so reach for `curl` when testing egress.
+
 ### Firecracker on Linux

 On Linux, a KVM-capable host defaults to the Firecracker backend. It needs: