Enforce AWF firewall on MCP sibling containers to prevent docker exec bypass

[Copilot]

MCP Gateway spawns sibling containers (safe-outputs, etc.) via Docker socket without inheriting proxy settings from AWF, allowing unrestricted network access via docker exec.

Changes

MCP Gateway container (pkg/workflow/mcp_servers.go)

• Pass proxy environment variables (HTTP_PROXY, HTTPS_PROXY, http_proxy, https_proxy, NO_PROXY, no_proxy) to gateway container via -e flags

Safe-outputs container config (pkg/workflow/mcp-config.go, pkg/workflow/mcp_renderer.go)

• Add proxy variables to container env configuration (JSON format for Copilot/Claude)
• Add proxy variables to env_vars list (TOML format for Codex)

Flow

AWF agent container (has proxy vars via --env-all)
  ↓ docker run -e HTTP_PROXY ...
MCP Gateway container (receives proxy vars)
  ↓ env: { "HTTP_PROXY": "${HTTP_PROXY}" }
Safe-outputs sibling container (inherits proxy vars)

Commands executed inside safe-outputs container now respect firewall rules, including those run via docker exec.

Related: githubnext/gh-aw-firewall#130

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[deep-report] Harden AWF firewall: enforce proxy/iptables on safe-outputs container to block docker exec escape</issue_title>
<issue_description>Description
Firewall escape testing confirmed that docker exec into the safe-outputs node:lts-alpine container allows unrestricted outbound access (example.com/google.com), bypassing AWF firewall rules. Apply proxy env vars and firewall rules to sibling containers (safe-outputs/MCP) or segment networks to ensure all containers enforce the same egress policy.

Expected Impact
Closes a critical firewall bypass vector and restores network policy enforcement across all AWF containers.

Suggested Agent
The Great Escapi or Workflow Health Manager

Estimated Effort
Medium (1-4 hours)

Data Source
DeepReport Intelligence Briefing 2026-01-16 (run 21071073449); discussion #10180

AI generated by DeepReport - Intelligence Gathering Agent

Comments on the Issue (you are @copilot in this section)

• Fixes [deep-report] Harden AWF firewall: enforce proxy/iptables on safe-outputs container to block docker exec escape #10322

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[pelikhan]

@Mossaka needed?