didericis
892bfc164c
test / integration-docker (pull_request) Successful in 19s
tracker-policy-pr / check-pr (pull_request) Successful in 22s
test / unit (pull_request) Successful in 44s
lint / lint (push) Successful in 54s
test / integration-firecracker (pull_request) Successful in 3m19s
test / coverage (pull_request) Successful in 40s
test / publish-infra (pull_request) Has been skipped
podman's containers.conf `hosts_file` turns out to apply only to native `podman run`; the Docker-compatible API ignores it, and the agent types `docker`. (`base_hosts_file`, used before this, is a no-op in both paths on podman 5.4.2.) So no config key can put the gateway name in a nested container's /etc/hosts. The name is therefore resolved in the bottle, where /etc/hosts does carry it, and the address goes into the proxy URL handed to nested containers. NO_PROXY keeps the name, since that is matched against what a client asks for. Verified on the macOS host: with the gateway reachable, a nested container gets 200 from an allowlisted host and 403 from one that is not — the egress boundary applies inside nested containers too. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>