Network mode support for docker environment

[xiaoxiangmoe]

A transparent proxy for a Docker environment has been implemented to handle HTTP/HTTPS allowlisting.

[vercel]

@xiaoxiangmoe is attempting to deploy a commit to the Harbor Framework Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Enjoy a better diff viewing experience by clicking one of these URLs:

• devinreview
• diffshub
• linear

[xiaoxiangmoe]

This PR has some design limitations. In allowlist mode, it only enables support for HTTP/1/2 for IPv4 and IPv6, but not for HTTP/3, FTP, etc. More complex support might require more complex and difficult-to-read implementations, so I think it's okay to leave it like this for now.

This PR also added test cases for several scenarios:

• Switching between different network modes for tasks in multiple steps
• Test cases ensuring that --allow-agent-host works correctly

Here is a PoC which helps maintainers to review this PR. https://github.com/xiaoxiangmoe/gost-sidecar-egress-control-demo

[li-boxuan]

Thank you very much! I think this approach looks very promising. I'll try to test this with TB2 oracle solutions this week.

[alexgshaw]

@li-boxuan were you able to test it?

[li-boxuan]

@li-boxuan were you able to test it?

Yep I ran into some issues testing this against TB2 on my mac. I'll connect with @xiaoxiangmoe offline.

[li-boxuan]

Non-blocking comment:

Is there any chance we could make it easier for developers/users to understand what domain access is attempted but blocked?

Currently, if we miss a domain, the agent log probably shows sth like ssl.SSLEOFError which is not very informative.

[li-boxuan]

I tested this achieves 100% on TB2.1 with allowlists.

[devin-ai-integration]

Devin Review found 1 new potential issue.