HN Showcase
Back to browse
GitHub Repository

CargoWall Action to secure your GitHub Workflows

37 starsTypeScript

CargoWall – eBPF Firewall for GitHub Actions

by caleblloyd·Mar 31, 2026·14 points·2 comments
Visit ProjectView on HN

AI Analysis

●●SolidBig BrainSolve My Problem

eBPF firewall for GitHub Actions stops supply chain attacks at the kernel level.

Strengths
  • •Wire-protocol parsing with eBPF means zero code changes to existing workflows
  • •Per-step connection correlation shows exactly which CI step made suspicious calls
  • •DNS proxy with hostname allowlists prevents tunneling before IPs even resolve
Weaknesses
  • •Requires ubuntu-latest runners, no Windows or macOS support yet
  • •Competes with StepSecurity and other emerging CI security tools
Category
Security
Target Audience

DevOps engineers, CI/CD security teams

Similar To

StepSecurity · StackRox · Snyk

Post Description

We just open-sourced CargoWall - a lightweight eBPF firewall for GitHub Actions.

We originally built it to stop LLM agents from connecting to untrusted domains. After recent GitHub Actions supply chain compromises like the Trivy attack, we realized it'd work well for blocking untrusted connections from CI runners too.

It uses iptables DNAT to redirect all outbound port 53 traffic to a local DNS proxy, which checks each query against a hostname allowlist before forwarding. Resolved IPs from allowed responses are inserted into eBPF LPM trie maps, and a TC egress classifier attached to the network interface drops any packet whose destination IP/protocol/port isn't in the trie.

Cgroup hooks capture every socket connect/sendmsg call system-wide, mapping the socket cookie to the process to correlate where connections are coming from. It then correlates the connection times with steps to provide a summary of which connections originated from which steps.

ubuntu-latest and ubuntu-24.04 runners are supported. Simple one-step setup example:

uses: code-cargo/cargowall-action@v1 # or v1.0.0 for immutable tag with: mode: enforce allowed-hosts: | registry.npmjs.org

eBPF Program: https://github.com/code-cargo/cargowall

GitHub Action: https://github.com/code-cargo/cargowall-action

We'd love for you to give it a try! Happy to answer questions or take feedback.

Similar Projects