{"id":49861422,"url":"https://github.com/staex-io/cijail","last_synced_at":"2026-05-14T21:43:09.453Z","repository":{"id":234899361,"uuid":"789709777","full_name":"staex-io/cijail","owner":"staex-io","description":"CI/CD pipeline process jail that filters outgoing network traffic.","archived":false,"fork":false,"pushed_at":"2024-04-21T21:03:30.000Z","size":73,"stargazers_count":1,"open_issues_count":1,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2024-04-22T12:01:30.656Z","etag":null,"topics":["cd","ci","firewall","jail","pipeline","process"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/staex-io.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2024-04-21T10:43:31.000Z","updated_at":"2024-04-23T14:12:59.006Z","dependencies_parsed_at":"2024-04-23T14:12:47.322Z","dependency_job_id":"6e706c2f-4002-470f-943a-3fbfc2e333a1","html_url":"https://github.com/staex-io/cijail","commit_stats":null,"previous_names":["staex-io/cijail"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/staex-io/cijail","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/staex-io%2Fcijail","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/staex-io%2Fcijail/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/staex-io%2Fcijail/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/staex-io%2Fcijail/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/staex-io","download_url":"https://codeload.github.com/staex-io/cijail/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/staex-io%2Fcijail/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33044931,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-13T13:14:54.681Z","status":"online","status_checked_at":"2026-05-14T02:00:06.663Z","response_time":57,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cd","ci","firewall","jail","pipeline","process"],"created_at":"2026-05-14T21:43:08.991Z","updated_at":"2026-05-14T21:43:09.444Z","avatar_url":"https://github.com/staex-io.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Introduction\n\nCijail is a CI/CD pipeline process jail that helps prevent supply chain attacks.\nCijail filters outgoing network traffic in accordance with\n- allow list of HTTP/HTTPS URLs,\n- allow list of endpoints (specified by an IP:PORT, UNIX domain socket path or netlink socket) and\n- allow list of DNS names.\n\n**By default the outgoing traffic for all domain names, IP addresses and ports is blocked.**\nCijail makes it impossible to exfiltrate the data over DNS and makes it difficult to do by other means.\n\nCijail is implemented using [`seccomp`](https://man7.org/linux/man-pages/man2/seccomp.2.html) and\nsometimes needs [`CAP_SYS_PTRACE`](https://man7.org/linux/man-pages/man7/capabilities.7.html) capability to read memory of the processes being traced.\nOur local Docker installation does not require this privilege,\nwhereas Github Actions runners require.\nThe capability is dropped before the command is executed.\n\nURL filtering is implemented using HTTP/HTTPS proxy that runs locally.\nWe automatically set the usual `http_proxy` and `https_proxy` variables,\nand similar variables for `git`, `pip`, `npm` etc.\nPlease, create an issue if your build tool does not work.\n\nHTTPS proxy creates root CA certificate that is used to sign every response sent to the client.\nCurrently this CA certificate is automatically installed as trusted into the system store.\nUsually this is enough to make most of the applications recognize it as trusted.\nPlease, create an issue if your build tool does not work.\n\n\n# Usage\n\n\n## Use manually\n\nCijail will print all IP addresses, ports nad domain names that it blocked\nas well as the corresponding system calls.\nThe output looks like the following.\n```bash\n# DNS request (connection to DNS server is allowed whereas name resolution is not)\n🌊 env CIJAIL_ENDPOINTS='one.one.one.one:53' \\\n    cijail \\\n    dig staex.io @1.1.1.1\n[Sun Apr 04 17:28:22 2024] cijail: allow connect 1.1.1.1:53\n[Sun Apr 04 17:28:22 2024] cijail: deny sendmmsg staex.io\n\n# HTTPS request (specific URL is allowed)\n🌊 env CIJAIL_ENDPOINTS='https://api.github.com/repos/staex-io/cijail/releases' \\\n    cijail \\\n    curl https://api.github.com/repos/staex-io/cijail/releases\n[Thu May 09 07:20:45 2024] cijail-proxy: allow 200 https://api.github.com/repos/staex-io/cijail/releases\n```\n\n- Use `CIJAIL_ENDPOINTS` to restrict which endpoints are allowed to be sent traffic to.\n  These can be DNS names (i.e. allow only name resolution, but not the traffic),\n  DNS names plus port, IP address plus port, HTTP/HTTPS URL, UNIX socket paths netlink sockets.\n- Use `CIJAIL_DRY_RUN=1` to discover what is blocked by the current rules.\n  Specifying `CIJAIL_DRY_RUN=0` is not mandatory.\n  Dry run always fails.\n- Use `CIJAIL_ALLOW_LOOPBACK=1` to allow sending any traffic to any address and port\n  in the loopback network\n  (`127.0.0.1/8` and `::1`).\n\nBelow are `CIJAIL_ENDPOINTS` examples.\n```bash\nhttps://github.com/    # allow HTTPS packets to/from github.com:443 with a URL starting with \"https://github.com/\"\n1.1.1.1:53             # allow TCP/UDP packets to/from 1.1.1.1:53\none.one.one.one        # allow DNS packets that resolve `one.one.one.one` to IP addresses\n@/tmp/unix             # allow packets to/from abstract UNIX socket with path \"\\0/tmp/unix\"\n/tmp/unix              # allow packets to/from named UNIX socket with path \"/tmp/unix\"\n[netlink]              # allow packets to/from netlink socket\n```\n\n\n## Use in Github Actions\n\nAdd the following lines to your `Dockerfile`.\n\n```dockerfile\nCOPY --from=ghcr.io/staex-io/cijail:latest / /usr/local\nENTRYPOINT [\"/usr/local/bin/cijail\"]\n```\n\nThen in your CI/CD pipeline define a list of allowed domain names and endpoints.\n\n```yaml\njobs:\n  build:\n    container:\n      image: your-image-with-cijail-installed-as-entrypoint\n      options: --cap-add CAP_SYS_PTRACE\n    env:\n      CIJAIL_ENDPOINTS: github.com:443\n    steps:\n      - name: Lint\n        run: cijail ./ci/lint.sh\n      - name: Test\n        run: cijail ./ci/test.sh\n```\n\n⚠️ Github Actions do not respect Docker's `ENTRYPOINT`,\nand you have to prepend `cijail` to every command in each step.\n\nSee this repository's [Github workflow](.github/workflows/ci.yml) as a real-world example.\n\n\n## Use in a Gitlab pipeline\n\nAdd the following lines to your `.gitlab-ci.yml`.\n\n```yaml\nvariables:\n  CIJAIL_ENDPOINTS: gitlab.com:443\n```\n\n✅ Gitlab CI/CD pipelines respect Docker's `ENTRYPOINT`,\nand you do not have to prepend `cijail` to every command.\n\nThen you *might* need to add `CAP_SYS_PTRACE` capability to your Gitlab runner configuration.\nCurrently this is supported only for the runners that you host yourself.\nTo do that add the following lines to `/etc/gitlab-runner/config.toml`.\n\n```toml\n[[runners]]\n  [runners.docker]\n    cap_add = [\"SYS_PTRACE\"]\n```\n\n\n# Caveats\n\n- You can not run `cijail` inside another `cijail`. We are investigating the issue.\n- Cijail **must be** the first process that you run in the Docker container\n  because it controls only its descendants.\n  Usually this is not a problem in CI/CD.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstaex-io%2Fcijail","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstaex-io%2Fcijail","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstaex-io%2Fcijail/lists"}