feat(coder/modules/boundary): add agent-firewall module by 35C4n0r · Pull Request #840 · coder/registry

35C4n0r · 2026-04-13T03:21:11Z

Description

Extracts boundary installation and wrapper logic into a standalone coder/agent-firewall module, decoupling it from agentapi.

Why

Boundary is currently embedded inside agentapi (scripts/boundary.sh) and duplicated in claude-code. This couples network isolation to the AI/Tasks stack, but boundary is a general-purpose primitive — users running a plain agent with no agentapi or tasks should be able to use it too.

What this adds

registry/coder/modules/agent-firewall/ — a new first-class module that:

Installs boundary via one of three strategies:
1. coder boundary subcommand (default, zero-install)
2. Direct binary from release (use_agent_firewall_directly = true)
3. Compiled from source (compile_agent_firewall_from_source = true)
Ships a comprehensive default allowlist config (Anthropic, OpenAI, VCS, package managers, cloud platforms, etc.)
Auto-fills the Coder deployment domain via data.coder_workspace.me.access_url
Supports inline config (agent_firewall_config) or external file (agent_firewall_config_path), mutually exclusive with cross-variable validation
Creates a wrapper script at $HOME/.coder-modules/coder/agent-firewall/scripts/agent-firewall-wrapper.sh
Strips CAP_NET_ADMIN from the coder binary (copies to coder-no-caps) to allow execution inside network namespaces without sys_admin
Supports pre_install_script / post_install_script hooks
Exposes agent_firewall_wrapper_path, agent_firewall_config_path, and scripts outputs for script coordination
No env vars exported — everything is output-only

Usage

module "agent-firewall" {
  source   = "registry.coder.com/coder/agent-firewall/coder"
  version  = "0.0.1"
  agent_id = coder_agent.main.id
}

Works standalone with any agent — no agentapi dependency required.

Testing

8 Terraform plan tests (agent-firewall.tftest.hcl): default outputs, compile from source, use directly, custom hooks, custom module directory, inline config, external config path, mutual exclusion validation
TypeScript integration tests (main.test.ts): state verification, coder subcommand happy path, inline config, config path skip, custom hooks, env var absence, wrapper execution, idempotent installation

Type of Change

New module

Module Information

Path: registry/coder/modules/agent-firewall
New version: v0.0.1
Breaking change: No

Related Issues

Closes #844

🤖 Generated by Coder Agents

…on scripts

Copilot

Pull request overview

Adds a new coder/boundary registry module intended to set up Boundary-related tooling for Coder workspaces.

Changes:

Introduces a Boundary install/setup shell script that can compile from source, install from release, or rely on coder boundary.
Adds a Terraform module (main.tf) that deploys and runs the install script on an agent.
Adds module README and Terraform native tests (.tftest.hcl).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 7 comments.

File	Description
`registry/coder/modules/boundary/scripts/install.sh`	Installs Boundary (or validates `coder boundary`) and generates a wrapper script.
`registry/coder/modules/boundary/main.tf`	Defines module variables and a `coder_script` to deliver/execute `install.sh`.
`registry/coder/modules/boundary/README.md`	Documents module usage and examples.
`registry/coder/modules/boundary/boundary.tftest.hcl`	Adds Terraform plan-time assertions for basic module wiring.

… install hooks

…lation and execution

…module

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 7 comments.

…missing mock support Three root causes: 1. boundary_script_destination used 'install.sh' - same filename that coder-utils writes to. This caused the running script to overwrite itself, corrupting bash's incremental read and producing empty install.log / no wrapper. Fix: rename to 'boundary-install.sh'. 2. coder-mock.sh didn't handle 'coder exp sync' commands used by coder-utils for script ordering. With set -o errexit, scripts failed immediately. Fix: add exp sync as no-op (exit 0). 3. Test setup used setupUtil which only extracts ONE coder_script, but coder-utils creates multiple (pre_install, install, post_install). Fix: extract all coder_scripts from terraform state and run them sequentially in lifecycle order. 4. wrapper-script-execution test called 'wrapper.sh --help' which the mock couldn't handle after the '--' separator (tried to exec '--help'). Fix: test with 'echo boundary-test' instead.

…e gracefully

…r scripts

The boundary command (both 'coder boundary' and standalone 'boundary') expects a '--' separator before the command to execute. The wrapper scripts were passing arguments directly without this separator, causing the wrapper-script-execution test to fail. 🤖 Generated by Coder Agents

This reverts commit 81df58f.

The boundary wrapper scripts pass arguments directly without a '--' separator. Updated the coder mock to match this behavior and adjusted the test comment accordingly. 🤖 Generated by Coder Agents

…nt printf - Revert log_dir back to /tmp/boundary_logs (static default) - Remove BOUNDARY_LOG_DIR template variable - Remove jail_type: landjail (debug leftover) - Remove printf for BOUNDARY_CONFIG_CONTENT (too verbose)

DevelopmentCats · 2026-05-07T12:36:09Z

Reviewing and testing this morning.

…n config at runtime - Rename all public input variables: boundary_* -> agent_firewall_* - Rename outputs: boundary_wrapper_path -> agent_firewall_wrapper_path, boundary_config_path -> agent_firewall_config_path - Set log_dir to $HOME/.coder-modules/coder/boundary/logs/boundary_logs in default config template - Expand $HOME in config content via sed at runtime before writing to disk, so the config contains absolute paths - Internals (locals, template vars, script logic) unchanged

matifali · 2026-05-07T16:41:01Z

Lets rename the module path to agent-firewall

matifali

LGTM Thanks

DevelopmentCats

LGTM as well

35C4n0r added 2 commits April 13, 2026 08:45

feat(boundary): add boundary module with installation and configurati…

2b459f7

…on scripts

chore: bun fmt

e4e059b

35C4n0r self-assigned this Apr 13, 2026

35C4n0r requested a review from Copilot April 13, 2026 03:28

Copilot started reviewing on behalf of 35C4n0r April 13, 2026 03:28 View session

Copilot AI reviewed Apr 13, 2026

View reviewed changes

35C4n0r marked this pull request as draft April 13, 2026 03:38

35C4n0r and others added 4 commits April 14, 2026 16:37

feat(boundary): enhance installation with wrapper script and pre/post…

12ca1b1

… install hooks

Merge branch 'main' into 35C4n0r/feat-boundary-module

abba320

feat(boundary): add tests and mock scripts for boundary module instal…

0a7aa71

…lation and execution

docs: update README with script synchronization details for boundary …

8dc8c8b

…module

35C4n0r requested a review from Copilot April 14, 2026 17:58

Copilot started reviewing on behalf of 35C4n0r April 14, 2026 17:59 View session

Copilot AI reviewed Apr 14, 2026

View reviewed changes

35C4n0r mentioned this pull request Apr 14, 2026

feat(registry/coder/modules/coder-utils): make install_script and start_script optional #842

Merged

4 tasks

Jay Kumar and others added 8 commits April 14, 2026 18:19

chore: description fix

ce15e06

chore(boundary): remove unused boundary-mock.sh

946204d

fix(boundary): improve command check for 'coder' to handle errors mor…

8b88931

…e gracefully

fix(boundary): remove unnecessary argument passing in boundary wrappe…

f45b2e9

…r scripts

Revert "fix: add '--' separator in boundary wrapper scripts"

f081d87

This reverts commit 81df58f.

fix(tests): update mock and test to not require '--' separator

ec2e16f

The boundary wrapper scripts pass arguments directly without a '--' separator. Updated the coder mock to match this behavior and adjusted the test comment accordingly. 🤖 Generated by Coder Agents

35C4n0r marked this pull request as ready for review April 15, 2026 17:27

35C4n0r requested review from evgeniy-scherbina and matifali April 15, 2026 17:28

matifali requested review from SasSwart, dannykopping and jcjiang and removed request for matifali April 16, 2026 04:50

35C4n0r marked this pull request as ready for review May 7, 2026 07:52

matifali reviewed May 7, 2026

View reviewed changes

Comment thread registry/coder/modules/boundary/config.yaml.tftpl Outdated

Comment thread registry/coder/modules/agent-firewall/boundary.tftest.hcl Outdated

matifali reviewed May 7, 2026

View reviewed changes

Comment thread registry/coder/modules/agent-firewall/README.md Outdated

Comment thread registry/coder/modules/boundary/README.md Outdated

Comment thread registry/coder/modules/boundary/README.md Outdated

Comment thread registry/coder/modules/boundary/README.md Outdated

35C4n0r and others added 3 commits May 7, 2026 20:08

feat: address partial comments

68c4aa9

revert(boundary): undo agent_firewall rename, keep boundary_* naming

7ac464c

This comment was marked as duplicate.

Sign in to view

35C4n0r added 3 commits May 7, 2026 21:35

docs(readme): enhance examples and clarify usage of boundary module

c7bc520

docs(readme): add references section for boundary documentation

0cdfd84

bun fmt

3a7471b

matifali approved these changes May 7, 2026

View reviewed changes

feat: only folder renaming

02f0bc3

matifali reviewed May 7, 2026

View reviewed changes

Comment thread registry/coder/modules/agent-firewall/scripts/install.sh.tftpl

Comment thread registry/coder/modules/agent-firewall/README.md Outdated

Comment thread registry/coder/modules/boundary/README.md Outdated

feat: boundary to agent-firewall refactor

f255d6c

35C4n0r force-pushed the 35C4n0r/feat-boundary-module branch from f58688c to f255d6c Compare May 7, 2026 17:58

matifali approved these changes May 7, 2026

View reviewed changes

DevelopmentCats reviewed May 8, 2026

View reviewed changes

Comment thread registry/coder/modules/agent-firewall/main.tf

DevelopmentCats approved these changes May 8, 2026

View reviewed changes

35C4n0r changed the title ~~feat(coder/modules/boundary): add boundary module~~ feat(coder/modules/boundary): add agent-firewall module May 9, 2026

35C4n0r enabled auto-merge (squash) May 9, 2026 06:12

feat: absolute link to default agent-firewall config in README

570081c

35C4n0r removed request for SasSwart, evgeniy-scherbina and jcjiang May 10, 2026 06:22

Merge branch 'main' into 35C4n0r/feat-boundary-module

f7a8e4f

35C4n0r merged commit 99510a1 into main May 10, 2026
4 checks passed

35C4n0r deleted the 35C4n0r/feat-boundary-module branch May 10, 2026 06:23

Conversation

35C4n0r commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Why

What this adds

Usage

Testing

Type of Change

Module Information

Related Issues

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

DevelopmentCats commented May 7, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as duplicate.

Uh oh!

matifali commented May 7, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

matifali left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

DevelopmentCats left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

35C4n0r commented Apr 13, 2026 •

edited

Loading