docs: add an Agent Firewall example policy page by jdomeracki-coder · Pull Request #29468 · coder/coder

jdomeracki-coder · 2026-09-17T08:28:08Z

The Agent Firewall page pointed at dogfood/coder/boundary-config.yaml with a relative link that escapes docs/, so it does not resolve on the published docs site. The dogfood template that consumed that file now lives in the infrastructure repository, leaving the docs link as its only reader.

Changes

Add docs/ai-coder/agent-firewall/example-policy.md: the broad allowlist as a docs-owned example, with deployment-specific hosts replaced by coder.example.com and internal entries dropped
Register the page in the sidebar source docs/manifest/ai-coder/ai-governance/agent-firewall.yml (regenerated docs/manifest.json) and repoint the link in the Agent Firewall page
Delete dogfood/coder/boundary-config.yaml

Checks: pnpm run format-docs, pnpm run lint-docs, make lint/emdash, and CI all clean.

Generated by Coder Agents on behalf of @jdomeracki-coder.

Template provisioning now lives in the infrastructure repository. The dogfood workflow keeps building and publishing the dogfood images. Generated by Coder Agents.

github-actions · 2026-09-17T08:28:18Z

Docs preview

Check off each page once it's been reviewed. If a page changes in a later push, its checkbox clears automatically so it gets a fresh look. Pages not yet wired into the docs navigation aren't listed here.

The dogfood workspace templates are now provisioned from the infrastructure repository. Keep only the image build inputs here and document the split. Generated by Coder Agents.

The Agent Firewall page linked a policy file outside docs/, which does not resolve on the published docs site. Move the example into a docs page and delete the repository copy. Generated by Coder Agents.

…plate-workflow

…food-template-sources

…firewall-example-policy

nickvigilante

A few semantic line break fixes and tweaks to word choice, but LGTM! 🚀

nickvigilante · 2026-09-17T13:51:24Z

+For the syntax of each entry, including method filters and wildcards, see the
+[rules engine](rules-engine.md).


Suggested change

For the syntax of each entry, including method filters and wildcards, see the

[rules engine](rules-engine.md).

For the syntax of each entry, including method filters and wildcards, refer to the [rules engine docs](rules-engine.md).

nickvigilante · 2026-09-17T13:52:03Z

+For a comprehensive configuration covering multi-language development, see the
+[example policy](./example-policy.md).


Suggested change

For a comprehensive configuration covering multi-language development, see the

[example policy](./example-policy.md).

For a comprehensive configuration covering multi-language development, check out the [example policy](./example-policy.md).

nickvigilante · 2026-09-17T13:52:35Z

+To load this policy in a template, pass it to the module's
+`agent_firewall_config` argument as described in
+[Agent Firewall](index.md).


Suggested change

To load this policy in a template, pass it to the module's

`agent_firewall_config` argument as described in

[Agent Firewall](index.md).

To load this policy in a template, pass it to the module's `agent_firewall_config` argument as described in [Agent Firewall](index.md).

nickvigilante · 2026-09-17T13:53:17Z

@@ -1,23 +1,39 @@
+---
+title: Example policy


Suggested change

title: Example policy

title: Example policy

description: Review a broad Agent Firewall allowlist policy for multi-language workspaces.

nickvigilante · 2026-09-17T13:54:00Z

+> [!NOTE]
+> Agent Firewall is part of [AI Governance](../ai-governance.md), which is
+> included with a Premium license.
+
+This page contains a broad Agent Firewall policy for workspaces where agents
+build software in many languages.
+It allows the domains an agent needs to fetch dependencies, read source
+repositories, and pull container images, and blocks everything else.
+
+Coder uses a policy of this shape on its own deployment.
+Treat it as a starting point: allow only the domains your workspaces actually
+need, and add your own Coder deployment domain.
+Most entries come from the
+[default allowed domains for Claude Code on the web](https://code.claude.com/docs/en/claude-code-on-the-web#default-allowed-domains).


Suggested change

> [!NOTE]

> Agent Firewall is part of [AI Governance](../ai-governance.md), which is

> included with a Premium license.

This page contains a broad Agent Firewall policy for workspaces where agents

build software in many languages.

It allows the domains an agent needs to fetch dependencies, read source

repositories, and pull container images, and blocks everything else.

Coder uses a policy of this shape on its own deployment.

Treat it as a starting point: allow only the domains your workspaces actually

need, and add your own Coder deployment domain.

Most entries come from the

[default allowed domains for Claude Code on the web](https://code.claude.com/docs/en/claude-code-on-the-web#default-allowed-domains).

> [!NOTE]

> Agent Firewall is part of [AI Governance](../ai-governance.md), which is included with a Premium license.

This page contains a broad Agent Firewall policy for workspaces where agents build software in many languages.

It allows the domains an agent needs to fetch dependencies, read source repositories, and pull container images, and blocks everything else.

Coder uses a policy of this shape on its own deployment.

Treat it as a starting point: allow only the domains your workspaces actually need, and add your own Coder deployment domain.

Most entries come from the [default allowed domains for Claude Code on the web](https://code.claude.com/docs/en/claude-code-on-the-web#default-allowed-domains).

@jdomeracki-coder

Removes the remains of the dogfood template provisioning pipeline from this repository. Template versions for the dogfood deployment are now pushed from the infrastructure repository, so this repo no longer needs Coder admin or template API-key secrets. ## Changes - Delete `dogfood/main.tf`, the `coderd_template` root module used only by the removed `deploy_template` job - Refresh comments and a docs reference that pointed at the removed pipeline The `deploy_template` job removal itself moved to #29468, where it is required to keep CI green. This branch predates that, so its diff still contains the same deletion; merge #29468 first and the overlap resolves cleanly. Image builds and publishing (`codercom/oss-dogfood`, `codercom/oss-dogfood-vscode-coder`) are unchanged. ## Follow-up These repository secrets and variables become unused and can be deleted/rotated: `CODER_SESSION_TOKEN`, `CODER_TEMPLATE_NAME`, `CODER_DOGFOOD_ANTHROPIC_API_KEY`, `CODER_DOGFOOD_OPENAI_API_KEY`, and the GCP workload identity provider/service account used for the Terraform state bucket. --- Generated by Coder Agents on behalf of @jdomeracki-coder.

@jdomeracki-coder

Deletes the dogfood template sources that were migrated to the infrastructure repository, leaving only the image build inputs in this repo. Stacked on #29400 (which removes the `deploy_template` job and `dogfood/main.tf`); depends on coder/dogfood#551 being applied first. #29468 stacks on top of this branch. ## Changes - Delete `dogfood/coder/main.tf`, `dogfood/coder-envbuilder/`, `dogfood/vscode-coder/main.tf`, and the template READMEs and guide - Delete `dogfood/coder/devcontainer.json`: its only reader was the retired `coder-envbuilder` template, and it referenced a `Dockerfile` removed in #24267 - Add `dogfood/README.md` documenting what remains here and where template changes go - Drop the now-empty dependabot entries (`/dogfood/coder-envbuilder` docker, `dogfood/*/` terraform) Kept: `dogfood/coder/ubuntu-22.04/`, `dogfood/coder/ubuntu-26.04/`, `dogfood/coder/Makefile`, and `dogfood/vscode-coder/Dockerfile`. Image builds, tags, and `scripts/dogfood/*` are unchanged; the contract with the templates is the published Docker tag. Checks: `actionlint`, `shellcheck`, `compute-base-sha.sh`/`compute-final-sha.sh` still resolve, docs lint and `make lint/emdash` clean. --- Generated by Coder Agents on behalf of @jdomeracki-coder. --------- Co-authored-by: McKayla はな <kayla@tree.camp>

…l-example-policy # Conflicts: # docs/manifest.json # dogfood/README.md

…l-example-policy # Conflicts: # docs/ai-coder/agent-firewall/index.md

nickvigilante

LGTM!

chore: remove dogfood template provisioning from CI

5a628b7

Template provisioning now lives in the infrastructure repository. The dogfood workflow keeps building and publishing the dogfood images. Generated by Coder Agents.

jdomeracki-coder self-assigned this Sep 17, 2026

chore: remove the migrated dogfood template sources

11758d3

The dogfood workspace templates are now provisioned from the infrastructure repository. Keep only the image build inputs here and document the split. Generated by Coder Agents.

jdomeracki-coder marked this pull request as draft September 17, 2026 09:24

jdomeracki-coder mentioned this pull request Sep 17, 2026

chore: remove dogfood template provisioning from CI #29400

Merged

docs: add an Agent Firewall example policy page

7dcce90

The Agent Firewall page linked a policy file outside docs/, which does not resolve on the published docs site. Move the example into a docs page and delete the repository copy. Generated by Coder Agents.

jdomeracki-coder force-pushed the jd/docs-agent-firewall-example-policy branch from 6229c8c to 7dcce90 Compare September 17, 2026 09:41

jdomeracki-coder changed the base branch from main to jd/remove-dogfood-template-sources September 17, 2026 09:41

jdomeracki-coder mentioned this pull request Sep 17, 2026

chore: remove the migrated dogfood template sources #29469

Merged

jdomeracki-coder added 3 commits September 17, 2026 09:46

Merge remote-tracking branch 'origin/main' into jd/remove-dogfood-tem…

a19ced2

…plate-workflow

Merge branch 'jd/remove-dogfood-template-workflow' into jd/remove-dog…

e0dc755

…food-template-sources

Merge branch 'jd/remove-dogfood-template-sources' into jd/docs-agent-…

702de79

…firewall-example-policy

jdomeracki-coder marked this pull request as ready for review September 17, 2026 09:47

jdomeracki-coder requested a review from nickvigilante September 17, 2026 10:55

nickvigilante approved these changes Sep 17, 2026

View reviewed changes

docs(docs/ai-coder/agent-firewall): apply review suggestions

4f26b86

Base automatically changed from jd/remove-dogfood-template-sources to main September 18, 2026 07:55

jdomeracki-coder added 4 commits October 12, 2026 14:54

Merge remote-tracking branch 'origin/main' into jd/docs-agent-firewal…

dc7ed59

…l-example-policy # Conflicts: # docs/manifest.json # dogfood/README.md

Merge branch 'main' into jd/docs-agent-firewall-example-policy

1f8b88e

Merge remote-tracking branch 'origin/main' into jd/docs-agent-firewal…

5e825bf

…l-example-policy # Conflicts: # docs/ai-coder/agent-firewall/index.md

docs(docs): register the example policy in the manifest sources

12116be

jdomeracki-coder requested a review from nickvigilante October 19, 2026 14:33

nickvigilante approved these changes Oct 20, 2026

View reviewed changes

jdomeracki-coder merged commit 7777bf3 into main Oct 20, 2026
35 checks passed

jdomeracki-coder deleted the jd/docs-agent-firewall-example-policy branch October 20, 2026 14:12

github-actions Bot locked and limited conversation to collaborators Oct 20, 2026

Navigation Menu

Repository navigation

docs: add an Agent Firewall example policy page - #29468

docs: add an Agent Firewall example policy page#29468
jdomeracki-coder merged 11 commits into
mainfrom
jd/docs-agent-firewall-example-policy

jdomeracki-coder commented Sep 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 17, 2026 •

edited

Loading

Uh oh!

nickvigilante left a comment

Uh oh!

nickvigilante Sep 17, 2026

Uh oh!

nickvigilante Sep 17, 2026

Uh oh!

nickvigilante Sep 17, 2026

Uh oh!

nickvigilante Sep 17, 2026

Uh oh!

nickvigilante Sep 17, 2026

Uh oh!

nickvigilante left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		For the syntax of each entry, including method filters and wildcards, see the
		[rules engine](rules-engine.md).

		For a comprehensive configuration covering multi-language development, see the
		[example policy](./example-policy.md).

	title: Example policy
	title: Example policy
	description: Review a broad Agent Firewall allowlist policy for multi-language workspaces.

Conversation

jdomeracki-coder commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

github-actions Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Docs preview

Uh oh!

nickvigilante left a comment

Choose a reason for hiding this comment

Uh oh!

nickvigilante Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

nickvigilante Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

nickvigilante Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

nickvigilante Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

nickvigilante Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

nickvigilante left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jdomeracki-coder commented Sep 17, 2026 •

edited

Loading

github-actions Bot commented Sep 17, 2026 •

edited

Loading