Enterprise networks
Run AgentBox where nothing reaches the internet directly, TLS is inspected, and only verified images may run.
Each of these is a line in the project's .env. The agentbox command selects the matching Compose override for every command, the generated .devcontainer names the same files, and agentbox check validates the values. From a checkout, layer the named file with -f.
Verified, prebuilt images
AGENTGATE_IMAGE=registry.example.com/agentgate@sha256:...
AGENTGATE_WORKSPACE_IMAGE=registry.example.com/agentgate-workspace@sha256:...Nothing is built from source, so no machine needs to reach npm or the OS package mirrors. Releases publish both images for linux/amd64 and linux/arm64, scanned and signed with cosign; verify them, mirror them, and name the digests. The overrides (compose.broker-image.yaml, compose.workspace-image.yaml) clear build, so up --build cannot rebuild under a verified image's name, and change nothing else about a service.
A mandatory forward proxy
AGENTGATE_CORPORATE_PROXY=http://proxy.example.com:8080
AGENTGATE_CORPORATE_NO_PROXY=.corp.example.com,ghe.example.com # optional- The broker and the model gateway make their provider and model calls through the proxy. The stack's own service names, and anything in
AGENTGATE_CORPORATE_NO_PROXY, are dialled directly. - The egress proxy chains each tunnel it has already allowed through the company proxy. The allow list, deny list, GitHub block, IP-literal block, and quotas are decided first, so the company proxy only sees what passed.
- The workspace is unchanged: its only route out is still the egress proxy.
Note
The company proxy resolves hostnames, so the private-address check applies to names the local resolver can also see, and cannot apply to names only the company proxy resolves. Only http:// proxies are supported (the tunnels inside stay TLS end to end); NTLM and Kerberos proxies need a local authenticating forwarder in front.
A proxy that inspects TLS
AGENTGATE_CORPORATE_CA_PATH=/etc/ssl/certs/corp-root.pemThe broker and model gateway add the CA to their trust store. The workspace entrypoint builds a bundle of the image's public roots plus the CA and points Git, curl, Python, npm, Node, and OpenSSL-based tools at it, so nothing is baked into the workspace image. The connection to the broker keeps its own CA.
Paths are absolute
The installed command runs Compose from the package directory, so a relative path in .env would resolve there. agentbox check rejects relative file settings and prints the absolute path to use.