# stoker-managed: sandbox:stoker/firewall-allowlist.txt:ebb27d2514baa00e
github.com
api.github.com
codeload.github.com
objects.githubusercontent.com
raw.githubusercontent.com
# GitHub anycast IP ranges — FALLBACK only. The live source of truth
# is https://api.github.com/meta, which init-firewall.sh fetches on
# every run via `gh api meta` (or `curl`) and merges into the v4/v6
# ipsets. These static CIDRs are used when that fetch can't succeed
# (no network, parse error, gh/curl/jq missing) so the firewall still
# has a viable seed without the dynamic refresh.
192.30.252.0/22
185.199.108.0/22
140.82.112.0/20
143.55.64.0/20
2a0a:a440::/29
2606:50c0::/32
api.anthropic.com
console.anthropic.com
claude.ai
api.openai.com
auth.openai.com
chatgpt.com
registry-1.docker.io
auth.docker.io
production.cloudflare.docker.com
production.cloudfront.docker.com
pypi.org
files.pythonhosted.org
registry.npmjs.org
nodejs.org
deb.debian.org
security.debian.org
cli.github.com
downloads.1password.com
astral.sh

# --- Rubin: Docker-in-Docker testcontainers ------------------------------
# The Rubin sandbox runs Docker-in-Docker so testcontainers can pull and run
# images inside the AFK loop. The package init-firewall.sh reads CIDR lines
# (anything containing '/') straight into the ipset, so these are honored
# without modifying the package's firewall script.

# RFC1918 private ranges. Docker publishes a testcontainer's port and
# DNATs a localhost:hostport connection to the container's bridge IP
# (e.g. 172.17.0.x); after that rewrite the egress OUTPUT chain sees a
# private destination, not loopback. Allowlisting the bridge ranges lets
# that (and dockerd<->container) traffic through the OUTPUT REJECT.
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

# Cloudflare edge CIDRs. Docker Hub's CDN (and R2 blob storage) front on
# Cloudflare, and image-layer pulls hit ranges that a single getent
# snapshot of registry-1.docker.io / production.cloudflare.docker.com
# misses. Source: https://www.cloudflare.com/ips-v4 and /ips-v6. Static
# because the firewall itself would otherwise block the fetch; refresh
# only if a pull starts timing out on a new range (updates are years
# apart).
173.245.48.0/20
103.21.244.0/22
103.22.200.0/22
103.31.4.0/22
141.101.64.0/18
108.162.192.0/18
190.93.240.0/20
188.114.96.0/20
197.234.240.0/22
198.41.128.0/17
162.158.0.0/15
104.16.0.0/13
104.24.0.0/14
172.64.0.0/13
131.0.72.0/22
2400:cb00::/32
2606:4700::/32
2803:f800::/32
2405:b500::/32
2405:8100::/32
2a06:98c0::/29
2c0f:f248::/32

# AWS CloudFront edge CIDRs. Docker Hub fronts image *blobs* on TWO CDNs:
# production.cloudflare.docker.com (Cloudflare, covered above) AND
# production.cloudfront.docker.com (AWS CloudFront — NOTE: cloudFRONT, a
# different backend than the cloudFLARE host). Which CDN Docker routes a
# given blob through varies by region/time/rollout, so both must be
# covered or a `docker pull` dies mid-layer with
# `dial tcp <ip>:443: connect: network is unreachable`. These edge IPs
# rotate, so a getent snapshot of the hostname misses dockerd's actual
# connect IP — same reason the Cloudflare block above is static CIDRs.
# Source: https://ip-ranges.amazonaws.com/ip-ranges.json filtered to
# service==CLOUDFRONT && region==GLOBAL (the client-facing edge subset),
# collapsed — 94 v4 + 30 v6 as of 2026-06-01. Static snapshot: AWS adds
# prefixes over time, so if a pull starts failing on a new range, find the
# blocked DST with `sudo dmesg | grep STOKER-EGRESS-DROP` (the sandbox has
# no journalctl) and refresh this list from ip-ranges.json. Longer-term fix
# tracked in jsickcodes/stoker#217 (GHCR mirror / non-Docker-Hub images).
3.160.0.0/13
3.168.0.0/14
3.172.0.0/17
3.173.0.0/16
3.174.0.0/15
13.32.0.0/15
13.35.0.0/16
13.224.0.0/14
13.249.0.0/16
15.158.0.0/16
18.64.0.0/14
18.68.0.0/16
18.154.0.0/15
18.160.0.0/15
18.164.0.0/15
18.172.0.0/15
18.238.0.0/15
18.244.0.0/15
23.91.0.0/19
23.228.212.0/23
23.228.214.0/24
23.228.220.0/22
23.228.244.0/24
23.234.192.0/18
24.110.32.0/19
36.103.232.0/25
36.103.232.128/26
51.74.192.0/18
52.46.0.0/18
52.82.128.0/19
52.84.0.0/15
52.124.128.0/17
52.222.128.0/17
54.182.0.0/16
54.192.0.0/16
54.230.0.0/17
54.230.128.0/18
54.230.200.0/21
54.230.208.0/20
54.230.224.0/19
54.239.128.0/18
54.239.192.0/19
54.240.128.0/18
58.254.138.0/25
58.254.138.128/26
64.252.64.0/18
64.252.128.0/18
65.8.0.0/16
65.9.0.0/17
65.9.128.0/18
70.132.0.0/18
71.152.0.0/17
99.84.0.0/16
99.86.0.0/16
108.138.0.0/15
108.156.0.0/14
111.13.171.128/25
111.13.185.32/27
111.13.185.64/27
116.129.226.0/25
116.129.226.128/26
118.193.97.64/26
118.193.97.128/25
119.147.182.0/25
119.147.182.128/26
120.52.12.64/26
120.52.22.96/27
120.52.39.128/27
120.52.153.192/26
120.232.236.0/25
120.232.236.128/26
120.253.240.192/26
120.253.241.160/27
120.253.245.128/26
120.253.245.192/27
130.176.0.0/17
130.176.128.0/18
130.176.192.0/19
130.176.224.0/20
143.204.0.0/16
144.220.0.0/16
180.163.57.0/25
180.163.57.128/26
204.246.164.0/22
204.246.168.0/21
204.246.176.0/20
205.251.202.0/23
205.251.204.0/22
205.251.208.0/20
205.251.249.0/24
205.251.250.0/23
205.251.252.0/23
205.251.254.0/24
216.137.32.0/19
2001:3fc6:20::/43
2400:7fc0:500::/40
2404:c2c0:500::/40
2409:8c00:2421:300::/56
2409:8c00:2421:400::/56
2600:9000:ddd::/48
2600:9000:eee::/48
2600:9000:fff::/48
2600:9000:1000::/36
2600:9000:2000::/35
2600:9000:4000::/36
2600:9000:5200::/40
2600:9000:5308::/45
2600:9000:5310::/44
2600:9000:5320::/43
2600:9000:5340::/42
2600:9000:5380::/41
2600:9000:f000::/38
2600:9000:f400::/40
2600:9000:f500::/43
2600:9000:f520::/44
2600:9000:f534::/46
2600:9000:f538::/45
2600:9000:f540::/42
2600:9000:f580::/41
2600:9000:f600::/39
2600:9000:f800::/37
2600:f0f0:601::/48
2600:f0f0:602::/47
2600:f0f0:5504::/46
