Egress control · agent containers
Put Claude Code or Codex
in a default-deny box.
Outcall gives new users a one-command run path: install once, verify the matching daemon image, then run outcall run codex to scaffold one project, stage only the auth/config you intend, verify the isolated container path, and launch the real agent directly. It runs on Linux or in Docker Desktop's Linux runtime on macOS. Network policy is default-deny and enforced by nftables, DNS, and an HTTP proxy the container cannot bypass. Use outcall doctor --fix codexto repair Docker and project prerequisites. Add only named recipe grants or exact hosts with outcall allow codex github .
curl -fsSL https://outcall.dev/install.sh | sh
$ outcall allow codex github Allowed github for Codex CLI. Rules: .outcall/rules/codex.yaml Default deny remains active for every other destination. $ outcall allow codex https://api.sentry.io Allowed https://api.sentry.io for Codex CLI. $ outcall policy explain codex Default: block every destination not listed below. codex-openai-api - Codex may call OpenAI and ChatGPT endpoints. codex-github - Codex may access GitHub for repository operations. codex-host-api-sentry-io - Codex may access api.sentry.io over HTTPS.
What's in the box
One daemon. Six surfaces. Same source of truth.
Outcall ships the network plumbing, the policy plane, and the operator UX as a single binary. You don't stand up six tools to enforce egress — you stand up one.
Each agent host gets one Linux bridge with `policy drop` on FORWARD. Allow rules you write compile to nftables verdicts and hit-counters. Verify any rule is live with `nft list table inet outcall`.
The bridge gateway answers only for hosts in your rule set. Unlisted lookups return NXDOMAIN — agents fail immediately at name resolution, not after a 30-second TCP timeout that taints retries.
A forward proxy on the bridge matches plaintext HTTP on host + method + path, and HTTPS on CONNECT host + TLS SNI — no decryption, by design. A per-rule intercept mode is specified (S011) but intentionally not implemented in v0.1; HTTPS method/path/body is not visible inside the encrypted tunnel.
A Unix socket inside each container lets the agent ask the daemon via `outcall fetch <url>` (or `outcall exec`, `outcall file`, etc.) before acting, and submit new rule requests for operator approval. The agent never touches host policy directly; rule changes are auditable.
Drop YAML into `/etc/outcall/rules.d` and `outcall rules reload`. Networks and containers outlive the daemon — you can ship a rule change in seconds without rolling a single agent.
The `outcall` CLI, the JSON API on `/tmp/outcall/host.sock`, and the web dashboard all read the same daemon state. What you see in the UI is what `outcall rules list` prints — no separate inventory to drift.
How it fits together
One bridge. One source of truth.
The daemon is the only thing on the host that can change policy. Operators talk to the host socket. Containers talk to the agent socket. Neither side reaches the other.
Stop trusting agent defaults.
Start with one isolated project.
Outcall is open source, spec-first, and runs its daemon and agents in a Linux container runtime. Install once, then launch explicitly with outcall run claude or outcall run codex.