docs: clarify container privilege drop in security architecture

[Copilot]

The security architecture doc did not call out that the agent container drops CAP_NET_ADMIN after iptables setup, leaving the firewall rules immutable even if code escalates. This updates the NAT-table section to include that hardening detail.

• Security architecture update: add explicit mention of dropping CAP_NET_ADMIN after iptables rule setup to prevent rule tampering.

**Container iptables (NAT table)** — ... After rule setup, the container drops `CAP_NET_ADMIN` capability, preventing malicious code from modifying firewall rules.

Original prompt

Expand line 95-96 in security-architecture.md to include the privilege drop:

Container iptables (NAT table) — Inside the agent container, NAT rules intercept outbound HTTP (port 80) and HTTPS (port 443) traffic, rewriting the
destination to Squid at 172.30.0.10:3128. This handles traffic from the agent process itself and any child processes (including stdio MCP servers).

The agent container uses a two-stage entrypoint for secure initialization:

1. Stage 1 (setup-iptables.sh): Runs as root with NET_ADMIN capability to configure iptables NAT rules
2. Stage 2 (entrypoint.sh): Permanently drops NET_ADMIN using capsh --drop=cap_net_admin, then switches to non-root user via gosu

This ensures that even if malicious code escalates to root inside the container, it cannot modify iptables rules to bypass the firewall—the capability has
been removed from the kernel's bounding set.

Custom agent used: technical-doc-writer
AI technical documentation writer for awf library using Astro Starlight

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.