From 3906b5ad961238854ee07dba8da4e9693070b5be Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sun, 13 Jul 2025 13:04:33 +0000
Subject: [PATCH] prevent imds access on nsjail using iptables

---
 docker/DockerfileNsjail | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docker/DockerfileNsjail b/docker/DockerfileNsjail
index cd17557256..4a1e04b8d1 100644
--- a/docker/DockerfileNsjail
+++ b/docker/DockerfileNsjail
@@ -70,5 +70,9 @@ RUN curl -fLo coursier https://github.com/coursier/coursier/releases/download/v2
 	&& chmod +x /usr/bin/coursier
 RUN /usr/bin/java -jar /usr/bin/coursier about
 
+# iptables
+RUN apt-get install -y iptables
+RUN iptables -A OUTPUT -d 169.254.169.254 -j DROP && iptables -A FORWARD -d 169.254.169.254 -j DROP
+
 COPY --from=nsjail /nsjail/nsjail /bin/nsjail