An egress firewall for every GitHub Actions run.
CargoWall is an eBPF firewall that runs in the kernel of every runner. It only lets a workflow, or the AI agent running in it, reach the destinations its policy allows, so a compromised action has nowhere to send your secrets.
47
destinations seen
38
allowed by policy
9
blocked this week
Policies
- OrganizationEnforce
acme-corp12 rules
- RepositoryEnforce
payments-api+4 rules
- WorkflowEnforce
release.yml+2 rules
- Agent runtimeAudit
coding-agent+6 rules
Live decisions
- registry.npmjs.org:443web · buildAllowed
- api.github.com:443payments-api · testAllowed
- gist.githubusercontent.com:443payments-api · releaseBlocked
- 10.0.0.0/8 · artifactoryinfra · deployAllowed
- x7f2.tunnel-dns.net:53docs · buildBlocked
Trusted by teams managing GitHub at scale
Why runner egress matters
The actions you trust are the way in.
A runner can reach any host on the internet by default. Every one of these attacks needed exactly that: one outbound connection to somewhere the workflow never should have talked to.
- CVE-2025-30066
tj-actions/changed-files
A stolen token let attackers rewrite version tags. The payload dumped CI/CD secrets (cloud keys, GitHub tokens, private keys) into workflow logs across more than 23,000 repositories.
- Supply chain compromise
aquasecurity/trivy-action
Attackers force-pushed 75 of 76 version tags on Aqua Security's official Trivy scanner action, turning a security tool into an exfiltration channel.
- Maintainer breach
TanStack
A compromised maintainer account pushed malicious workflows into a popular open source project, pivoting through CI toward downstream consumers and their secrets.
The same pattern, on AI agents
Coding agents run on the same runtime, with more reach.
Agents fetch packages, call APIs and model providers, and act on prompts nobody fully controls. Private data, untrusted input and open egress is the combination that leaks credentials. CargoWall gives agent runtimes their own policies, so they can do the job without an open door to the internet.
Sources: CISA alert (CVE-2025-30066), Wiz Research, StepSecurity, Aqua Security, Palo Alto Networks Unit 42.
CargoWall
A compromised action can't phone home.
Supply chain attacks on GitHub Actions steal secrets by sending them somewhere. CargoWall's eBPF firewall sits on every runner and only lets a job reach what its policy allows.
- 1
Audit
Every outbound connection logged for every job, nothing blocked.
- 2
Baseline
Policies generated from what your workflows actually reach.
- 3
Enforce
Anything outside policy is dropped in the kernel, before a byte leaves.
- registry.npmjs.org:443In policyAllowed
- api.github.com:443In policyAllowed
- artifactory.acme.internal:443In policyAllowed
- crypto-miner.xyz:443Not in policyBlocked
- x7f2.tunnel-dns.net:53DNS tunnelBlocked
What CargoWall does
Kernel-level control, without slowing anyone down.
Policies at three levels
Per workflow, per repository or across the organization. The most specific policy wins.
IP, port, CIDR and DNS filtering
Hostnames, IP addresses and CIDR blocks, IPv4 and IPv6. DNS queries are filtered in the kernel, so tunnels never leave the runner.
Every runner
GitHub-hosted and self-hosted runners, including Docker and Kubernetes. No proxy and no runner changes.
Near-zero overhead
Decisions happen in the kernel data path, with no userspace proxy, packet copying or TLS termination.
A full network audit log
Every connection attempt with its workflow, job, destination, port and decision, allowed or blocked.
Sudo lockdown
Workflow steps cannot use sudo to change network configuration, unload the firewall or bypass policy.
Rolled out for you
CodeCargo adds the CargoWall action to every workflow as pull requests, across hundreds of repositories at once.
Agent runtime policies
Separate, flexible allowlists for AI coding agents, so they can reach what they need and nothing else.
When something breaks upstream
A compromised action, handled as one decision.
When an action you depend on is compromised, CodeCargo finds every workflow that uses it, proposes the whole response at once, and runs it the moment one approver says yes. Every safety rule still applies; only the waiting goes away.
Scoped
9 workflows in 6 repositories use the compromised action
Contained
Action blocked in the org; every use pinned to the last known-good commit
Traced
2 runs contacted the attacker; 4 secrets they could reach, with owners
Closed
Secrets rotated, pins verified, incident report ready for the auditors
Part of Secure
Egress control is one layer.
Secure pairs CargoWall with guardrails on every workflow, GHAS alert triage and compromised-action response, in one place for your security team.
See how Secure works →And in Manage
A platform team for your GitHub.
Manage keeps every workflow secure, cheap and on standard, at the autonomy you set, including moving workflows from CargoWall audit to enforce.
See how Manage works →CargoWall questions.
What security and platform teams ask before they put a firewall on their runners.
What is CargoWall?
CargoWall is an eBPF-based egress firewall for GitHub Actions runners and AI agent runtimes. It enforces network policies in the kernel, so a workflow can only reach the destinations its policy allows. It is part of CodeCargo Secure.
Do I need to modify my workflows to use CargoWall?
Each workflow needs a small CargoWall action. CodeCargo adds it for you across your organization as pull requests, so nobody edits workflows by hand.
Will CargoWall slow down my pipelines?
No. Policy decisions happen in the kernel data path with no userspace proxy, packet copying or TLS termination, so the overhead is comparable to iptables rules.
Can I test policies before enforcing them?
Yes. Audit mode logs every connection and policy decision without blocking anything. CodeCargo suggests policies from what your workflows actually reach, and you switch to enforce when you are ready, per workflow or repository.
Does CargoWall work with self-hosted runners?
Yes. CargoWall works on GitHub-hosted and self-hosted runners, including Docker and Kubernetes.
How are policies scoped?
Per workflow, per repository or across the organization, with the most specific policy taking precedence. Policies allow hostnames, IP addresses and CIDR blocks.
How does DNS filtering work?
CargoWall intercepts DNS queries in the kernel and blocks unauthorized resolutions before the query leaves the runner, which stops DNS tunneling and hostname-based exfiltration.
Can a workflow step turn CargoWall off?
No. Sudo lockdown stops workflow steps from using sudo to change network configuration, unload the eBPF programs or bypass policy.
What happens when a connection is blocked?
It is dropped in the kernel before it is established, and logged with the workflow, job, destination and the policy that blocked it.