myjailedagents

A Nix flake that runs opencode in a tightly confined jail with network traffic tunneled through mitmproxy.

Inspiration

This project is inspired by jailed-agents, which provides jailed agent environments using jail.nix. This flake extends that concept by adding a mandatory proxy layer for network security.

Features

• No direct network access - The jailed process cannot access the network directly
• Transparent proxying - All outbound traffic goes through mitmproxy via a Unix socket
• Allow-list enforcement - Only configured hosts (default: models.dev) are allowed
• TLS inspection - mitmproxy terminates TLS, with CA trust configured for Node.js
• DNS resolution - Allowed hosts are pre-resolved via /etc/hosts (jail has no DNS)

Quick Start

# Build the flake
nix build .#opencode-with-mitm

# Run with default allowed hosts (models.dev)
./result/bin/opencode-with-mitm --help

# Run with custom allowed hosts
MITM_ALLOW_HOSTS="models.dev ki-toolbox.scc.kit.edu" ./result/bin/opencode-with-mitm run hello world

# Or use nix run
nix run .#opencode-with-mitm -- run hello world

# Enable debug output (shows mitmproxy and tinyproxy logs)
DEBUG=1 nix run .#opencode-with-mitm --help

How It Works

1. Host-side mitmproxy - Listens on a Unix socket, enforces the allow-list, terminates TLS
2. tinyproxy + ip2unix - Forwards HTTP_PROXY traffic from the jail to the Unix socket
3. jail.nix - Creates the confined environment with no network namespace

The jail has no network access. Instead, it uses HTTP_PROXY pointing to tinyproxy, which forwards via ip2unix to the Unix socket that mitmproxy listens on.

Environment Variables

• MITM_ALLOW_HOSTS - Space-separated list of allowed hosts (default: models.dev)
• MITM_PORT - Proxy port (default: 8000)
• DEBUG=1 - Show mitmproxy and tinyproxy output
• OPENCODE_DISABLE_JAIL=1 - Run without jail (for debugging)