Coder powers secure, scalable development across key industries — automotive, finance, government, and technology — enabling faster builds, tighter compliance, and seamless AI adoption in enterprise-grade cloud environments.
Network isolation tool for monitoring and restricting HTTP/HTTPS requests
Usage
coder agent-firewall [flags] [args...]
Description
boundary creates an isolated network environment for target processes, intercepting HTTP/HTTPS traffic through a transparent proxy that enforces user-defined allow rules.
Options
--config
Type
yaml-config-path
Environment
$BOUNDARY_CONFIG
Path to YAML config file.
--allow
Type
string
Environment
$BOUNDARY_ALLOW
Allow rule (repeatable). These are merged with allowlist from config file. Format: "pattern" or "METHOD[,METHOD] pattern".
--log-level
Type
string
Environment
$BOUNDARY_LOG_LEVEL
YAML
log_level
Default
warn
Set log level (error, warn, info, debug).
--log-dir
Type
string
Environment
$BOUNDARY_LOG_DIR
YAML
log_dir
Set a directory to write logs to rather than stderr.
--proxy-port
Type
int
Environment
$PROXY_PORT
YAML
proxy_port
Default
8080
Set a port for HTTP proxy.
--pprof
Type
bool
Environment
$BOUNDARY_PPROF
YAML
pprof_enabled
Enable pprof profiling server.
--pprof-port
Type
int
Environment
$BOUNDARY_PPROF_PORT
YAML
pprof_port
Default
6060
Set port for pprof profiling server.
--jail-type
Type
string
Environment
$BOUNDARY_JAIL_TYPE
YAML
jail_type
Default
nsjail
Jail type to use for network isolation. Options: nsjail (default), landjail.
--use-real-dns
Type
bool
Environment
$BOUNDARY_USE_REAL_DNS
YAML
use_real_dns
Use real DNS in the jail instead of the dummy DNS (allows DNS exfiltration). Default: false.
--no-user-namespace
Type
bool
Environment
$BOUNDARY_NO_USER_NAMESPACE
YAML
no_user_namespace
Do not create a user namespace. Use in restricted environments that disallow user NS (e.g. Bottlerocket in EKS auto-mode).
--disable-audit-logs
Type
bool
Environment
$DISABLE_AUDIT_LOGS
YAML
disable_audit_logs
Disable sending of audit logs to the workspace agent when set to true.
--log-proxy-socket-path
Type
string
Environment
$CODER_AGENT_BOUNDARY_LOG_PROXY_SOCKET_PATH
Default
/tmp/boundary-audit.sock
Path to the socket where the boundary log proxy server listens for audit logs.
--version
Type
bool
Print version information and exit.
--enable-session-correlation
Type
bool
Environment
$BOUNDARY_SESSION_CORRELATION_ENABLED
YAML
session_correlation_enabled
Enable session correlation header injection. When no inject targets are configured, the target is auto-derived from CODER_AGENT_URL (set automatically inside Coder workspaces). Disable for deployments without Coder AI Gateway in front.
--session-id-inject-target
Type
string
Environment
$BOUNDARY_SESSION_ID_INJECT_TARGET
Inject target for session correlation headers. Repeat the flag once per target; each value describes exactly one target. Format: "domain= [path=]". Example: --session-id-inject-target "domain=prod.coder.com path=/api/v2/aibridge/*".
