stacklok / toolhive / 28647082193

68%

push

github

Make --allow-docker-gateway grant host access, not just unblock it (#5707)

* Make --allow-docker-gateway grant host access

In allowlist mode --allow-docker-gateway only suppressed the egress
proxy's deny rules for the Docker gateway. Because Squid is
first-match-wins, dropping the deny did nothing on its own: without a
later allow rule the request still fell through to the catch-all deny.
Users had to also add host.docker.internal (and a port) to their
allowlist for the flag to have any effect.

Emit explicit standalone http_access allow rules for the gateway
host(s) and IP when the flag is set, so the flag alone makes the host
reachable. The allow rules reference only the host/IP ACLs, not the
port ACL, keeping gateway access port-independent — host-local
services use arbitrary ports users would otherwise have to enumerate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Update E2E test for gateway allow rules

The egress config test asserted the gateway ACL names were entirely
absent under --allow-docker-gateway. The flag now replaces the deny
rules with allow rules referencing the same ACLs, so assert the deny
rules are gone and the allow rules are present instead.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

17 of 17 new or added lines in 1 file covered. (100.0%)

72440 of 106989 relevant lines covered (67.71%)

62.64 hits per line